2010/3/1 Zdenek Kotala <zdenek.kot...@sun.com>: > Magnus Hagander píše v čt 25. 02. 2010 v 15:17 +0100: >> On Thu, Feb 25, 2010 at 15:04, Zdenek Kotala <zdenek.kot...@sun.com> wrote: >> > Hi all, >> > >> > I got following stack: >> > >> > fffffd7ffed14b70 strlen () + 40 >> > fffffd7ffed71665 snprintf () + e5 >> > fffffd7fff36d088 pg_GSS_startup () + 88 >> > fffffd7fff36d43a pg_fe_sendauth () + 15a >> > fffffd7fff36e557 PQconnectPoll () + 3b7 >> > fffffd7fff36e152 connectDBComplete () + a2 >> > fffffd7fff36dc32 PQsetdbLogin () + 1b2 >> > 000000000041e96d main () + 30d >> > 000000000041302c ???????? () >> > >> > It seems that connection is not fully configured and krbsrvname or pghost >> > is >> > not filled. Following code in fe-auth.c pg_GSS_startup() causes a crash: >> > >> > 440 maxlen = NI_MAXHOST + strlen(conn->krbsrvname) + 2; >> > 441 temp_gbuf.value = (char *) malloc(maxlen); >> > 442 snprintf(temp_gbuf.value, maxlen, "%...@%s", >> > 443 conn->krbsrvname, conn->pghost); >> > 444 temp_gbuf.length = strlen(temp_gbuf.value); >> > >> > And following code in fe-connect.c fillPGconn() fill NULL value. >> > >> > 571 tmp = conninfo_getval(connOptions, "krbsrvname"); >> > 572 conn->krbsrvname = tmp ? strdup(tmp) : NULL; >> > >> > I think that pg_GSS_startup should sanity the input. >> >> How did you get NULL in there? :-) >> There's a default set for that one that's PG_KRB_SRVNAM, so it really >> should never come out as NULL, I think... > > Yeah, you are right. conn->krbsrvname is "postgres" and conn->pghost is > null
Ah, good. We should defentd against that then. >> As for pghost, that certainly seems to be a bug. We check that one in >> krb5 and SSPI, but for some reason we seem to be missing it in GSSAPI. > > Yes. The check should be in GSSAPI too. > > However what I see in pg_hba.conf is following line: > > local all all gss > > Gss is used on local unix socket which probably cause a problem that > conn->pghost is not filled when psql tries to connect. So there are really two errors - because we should disallow that. See attached patch - can you confirm it removes the crash with just the client side applied, and then that it properly rejects GSS with the server side applied as well? -- Magnus Hagander Me: http://www.hagander.net/ Work: http://www.redpill-linpro.com/
gss_nohost.patch
Description: Binary data
-- Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org) To make changes to your subscription: http://www.postgresql.org/mailpref/pgsql-hackers