Correct pg_recvlogical server version test.
authorNoah Misch <noah@leadboat.com>
Thu, 26 Apr 2018 01:50:29 +0000 (18:50 -0700)
committerNoah Misch <noah@leadboat.com>
Thu, 26 Apr 2018 01:50:29 +0000 (18:50 -0700)
The predecessor test boiled down to "PQserverVersion(NULL) >= 100000",
which is always false.  No release includes that, so it could not have
reintroduced CVE-2018-1058.  Back-patch to 9.4, like the addition of the
predecessor in commit 8d2814f274def85f39fbe997d454b01628cb5667.

Discussion: https://postgr.es/m/20180422215551.GB2676194@rfd.leadboat.com

src/bin/pg_basebackup/streamutil.c

index 4fd536931b197e9858dbda7f1366d4c60d74cb93..77ae91fbe73bd848e7eb115b504dd4c8e28c579d 100644 (file)
@@ -223,7 +223,7 @@ GetConnection(void)
     * 10, so the search path cannot be changed (by us or attackers) on
     * earlier versions.
     */
-   if (dbname != NULL && PQserverVersion(conn) >= 100000)
+   if (dbname != NULL && PQserverVersion(tmpconn) >= 100000)
    {
        PGresult   *res;