mirror of
https://github.com/postgres/postgres.git
synced 2026-05-27 12:00:13 -04:00
1ebda7da9a
Maliciously crafted key value updates could achieve SQL injection within check_foreign_key(). To fix, ensure new key values are properly quoted and escaped in the internally generated SQL statements. While at it, avoid potential buffer overruns by replacing the stack buffers for internally generated SQL statements with StringInfo. Reported-by: Nikolay Samokhvalov <nik@postgres.ai> Author: Nathan Bossart <nathandbossart@gmail.com> Reviewed-by: Noah Misch <noah@leadboat.com> Reviewed-by: Tom Lane <tgl@sss.pgh.pa.us> Reviewed-by: Fujii Masao <masao.fujii@gmail.com> Security: CVE-2026-6637 Backpatch-through: 14 |
||
|---|---|---|
| .. | ||
| expected | ||
| sql | ||
| .gitignore | ||
| autoinc--1.0.sql | ||
| autoinc.c | ||
| autoinc.control | ||
| autoinc.example | ||
| insert_username--1.0.sql | ||
| insert_username.c | ||
| insert_username.control | ||
| insert_username.example | ||
| Makefile | ||
| meson.build | ||
| moddatetime--1.0.sql | ||
| moddatetime.c | ||
| moddatetime.control | ||
| moddatetime.example | ||
| refint--1.0.sql | ||
| refint.c | ||
| refint.control | ||
| refint.example | ||