Skip to content

Commit

Permalink
pgsql: fix u16 overflow in query data_row
Browse files Browse the repository at this point in the history
Found by oss-fuzz with quadfuzz.

Cf https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=63113

According to PostgreSQL documentation the maximum number of rows can be
the maximum of tuples that can fit onto max u32 pages - 4,294,967,295 (cf
https://www.postgresql.org/docs/current/limits.html). Some rough
calculations for that indicate that this could go over max u32, so
updating the data_row data type to u64.

Bug OISF#6389

(cherry picked from commit 8d3de85)
  • Loading branch information
jufajardini authored and victorjulien committed Jan 9, 2024
1 parent ba3f1f8 commit 2e6322b
Show file tree
Hide file tree
Showing 3 changed files with 5 additions and 5 deletions.
2 changes: 1 addition & 1 deletion rust/src/pgsql/logger.rs
Original file line number Diff line number Diff line change
Expand Up @@ -237,7 +237,7 @@ fn log_response(res: &PgsqlBEMessage, jb: &mut JsonBuilder) -> Result<(), JsonEr
row_cnt,
data_size,
}) => {
jb.set_uint("data_rows", (*row_cnt).into())?;
jb.set_uint("data_rows", *row_cnt)?;
jb.set_uint("data_size", *data_size)?;
}
PgsqlBEMessage::NotificationResponse(NotificationResponse {
Expand Down
2 changes: 1 addition & 1 deletion rust/src/pgsql/parser.rs
Original file line number Diff line number Diff line change
Expand Up @@ -210,7 +210,7 @@ pub struct BackendKeyDataMessage {
#[derive(Debug, PartialEq, Eq)]
pub struct ConsolidatedDataRowPacket {
pub identifier: u8,
pub row_cnt: u16,
pub row_cnt: u64,
pub data_size: u64,
}

Expand Down
6 changes: 3 additions & 3 deletions rust/src/pgsql/pgsql.rs
Original file line number Diff line number Diff line change
Expand Up @@ -50,7 +50,7 @@ pub struct PgsqlTransaction {
pub request: Option<PgsqlFEMessage>,
pub responses: Vec<PgsqlBEMessage>,

pub data_row_cnt: u16,
pub data_row_cnt: u64,
pub data_size: u64,

tx_data: AppLayerTxData,
Expand Down Expand Up @@ -82,10 +82,10 @@ impl PgsqlTransaction {
}

pub fn incr_row_cnt(&mut self) {
self.data_row_cnt += 1;
self.data_row_cnt = self.data_row_cnt.saturating_add(1);
}

pub fn get_row_cnt(&self) -> u16 {
pub fn get_row_cnt(&self) -> u64 {
self.data_row_cnt
}

Expand Down

0 comments on commit 2e6322b

Please sign in to comment.