• Noah Misch's avatar
    Prevent stack overflow in json-related functions. · 08fa47c4
    Noah Misch authored
    Sufficiently-deep recursion heretofore elicited a SIGSEGV.  If an
    application constructs PostgreSQL json or jsonb values from arbitrary
    user input, application users could have exploited this to terminate all
    active database connections.  That applies to 9.3, where the json parser
    adopted recursive descent, and later versions.  Only row_to_json() and
    array_to_json() were at risk in 9.2, both in a non-security capacity.
    Back-patch to 9.2, where the json type was introduced.
    
    Oskari Saarenmaa, reviewed by Michael Paquier.
    
    Security: CVE-2015-5289
    08fa47c4
jsonfuncs.c 97.5 KB