From: Noah Misch <noah@leadboat.com>
Date: Tue, 19 Aug 2014 02:59:31 +0000 (-0400)
Subject: Replace a few strncmp() calls with strlcpy().
X-Git-Tag: REL9_5_ALPHA1~1603
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=fb2aece8ae4e6f23310d7c87c7da3fec6f5df3a1;p=postgresql

Replace a few strncmp() calls with strlcpy().

strncmp() is a specialized API unsuited for routine copying into
fixed-size buffers.  On a system where the length of a single filename
can exceed MAXPGPATH, the pg_archivecleanup change prevents a simple
crash in the subsequent strlen().  Few filesystems support names that
long, and calling pg_archivecleanup with untrusted input is still not a
credible use case.  Therefore, no back-patch.

David Rowley
---

diff --git a/contrib/pg_archivecleanup/pg_archivecleanup.c b/contrib/pg_archivecleanup/pg_archivecleanup.c
index 212b267fcf..97225a81a7 100644
--- a/contrib/pg_archivecleanup/pg_archivecleanup.c
+++ b/contrib/pg_archivecleanup/pg_archivecleanup.c
@@ -108,7 +108,12 @@ CleanupPriorWALFiles(void)
 	{
 		while (errno = 0, (xlde = readdir(xldir)) != NULL)
 		{
-			strncpy(walfile, xlde->d_name, MAXPGPATH);
+			/*
+			 * Truncation is essentially harmless, because we skip names of
+			 * length other than XLOG_DATA_FNAME_LEN.  (In principle, one
+			 * could use a 1000-character additional_ext and get trouble.)
+			 */
+			strlcpy(walfile, xlde->d_name, MAXPGPATH);
 			TrimExtension(walfile, additional_ext);
 
 			/*
diff --git a/src/backend/access/transam/xlogarchive.c b/src/backend/access/transam/xlogarchive.c
index 37745dce89..047efa2672 100644
--- a/src/backend/access/transam/xlogarchive.c
+++ b/src/backend/access/transam/xlogarchive.c
@@ -459,7 +459,8 @@ KeepFileRestoredFromArchive(char *path, char *xlogfname)
 							xlogfpath, oldpath)));
 		}
 #else
-		strncpy(oldpath, xlogfpath, MAXPGPATH);
+		/* same-size buffers, so this never truncates */
+		strlcpy(oldpath, xlogfpath, MAXPGPATH);
 #endif
 		if (unlink(oldpath) != 0)
 			ereport(FATAL,