]> granicus.if.org Git - postgresql/commit
Convert newlines to spaces in names written in pg_dump comments.
authorTom Lane <tgl@sss.pgh.pa.us>
Thu, 23 Feb 2012 20:53:34 +0000 (15:53 -0500)
committerTom Lane <tgl@sss.pgh.pa.us>
Thu, 23 Feb 2012 20:53:34 +0000 (15:53 -0500)
commita7f6cb85486b1f3eacd86155af2fdc20a1dc2bec
treed06fa9ce0fcf382574e0914f46bc1e581786896c
parentd1b8b8fbea0b34907b9571d2f7506e2089adb011
Convert newlines to spaces in names written in pg_dump comments.

pg_dump was incautious about sanitizing object names that are emitted
within SQL comments in its output script.  A name containing a newline
would at least render the script syntactically incorrect.  Maliciously
crafted object names could present a SQL injection risk when the script
is reloaded.

Reported by Heikki Linnakangas, patch by Robert Haas

Security: CVE-2012-0868
src/bin/pg_dump/pg_backup_archiver.c