Re: [BUGS] user authentication crash by Erik Luke (20-08-2001;

Поиск
Список
Период
Сортировка
От Thomas Yackel
Тема Re: [BUGS] user authentication crash by Erik Luke (20-08-2001;
Дата
Msg-id sbe07e58.037@gwsmtp.ohsu.edu
обсуждение исходный текст
Список pgsql-hackers
A few clarifications so you have more to go on: 

to create the problem, we used the sql command with the "';" following the [CR] at the end of the typed characters as
shownhere:
 

alter user yyyyy with password 'xxxxxx
';

then we attempted to log in as that user from another users' local session using the psql -username=yyyyy command.

none of the users had a 'validuntil' date (it was null).  But setting one didn't help either.

we are using 7.1.3 on a solaris machine.  We noticed the problem when we examined the pg_pwd file and saw that the
validuntildate we entered was preceded what looked like an early line wrap.
 

I was quite surprised that such a small input error could cause the backend to shutdown.  Should psql remove [CR]s that
arecontained within ''? (at least for this command)?
 

Thanks for looking into this problem.

Tom

>>> Tom Lane <tgl@sss.pgh.pa.us> 10/31/01 21:43 PM >>>
"Thomas Yackel" <yackelt@ohsu.edu> writes:
> I got the error: "Bad abstime external representation ''" when attempted to start psql as a particular user and the
postmastershutdown.
 

> The problem, we discovered, is that this user had a carriage return contained within his password.  Changing the
passwordto remove the CR avoided the system shutdown.
 

Hmm.  I can see how a linefeed in a password would create a problem (it
breaks the line-oriented formatting of the pg_pwd file).  However, I
can't reproduce a postmaster crash here.  Either I'm not testing the
right combination of circumstances, or current sources are more robust
about this tha 7.1.  That's not unlikely given that Bruce rewrote the
password-file-parsing code a couple months ago.

In any case it seems like it'd be a good idea to forbid nonprinting
characters in passwords.  Comments anyone?
        regards, tom lane



В списке pgsql-hackers по дате отправления:

Предыдущее
От: "Marc G. Fournier"
Дата:
Сообщение: Server going down for several hours ...
Следующее
От: "Tille, Andreas"
Дата:
Сообщение: Re: Serious performance problem