From 861fef876f3cb8a50437ee41b6ba4c8d0cb1e239 Mon Sep 17 00:00:00 2001
From: Frédéric Buclin <LpSolit@gmail.com>
Date: Thu, 5 Aug 2010 00:10:22 +0200
Subject: Bug 583690: (CVE-2010-2759) [SECURITY][PostgreSQL] Bugzilla crashes
 when viewing a bug if a comment contains 'bug <num>' or 'attachment <num>'
 where <num> is greater than the max allowed integer r=mkanat a=LpSolit

---
 Bugzilla/Object.pm | 5 +++++
 1 file changed, 5 insertions(+)

(limited to 'Bugzilla/Object.pm')

diff --git a/Bugzilla/Object.pm b/Bugzilla/Object.pm
index a7c92b269..66dac9422 100644
--- a/Bugzilla/Object.pm
+++ b/Bugzilla/Object.pm
@@ -87,6 +87,9 @@ sub _init {
           || ThrowCodeError('param_must_be_numeric',
                             {function => $class . '::_init'});
 
+        # Too large integers make PostgreSQL crash.
+        return if $id > MAX_INT_32;
+
         $object = $dbh->selectrow_hashref(qq{
             SELECT $columns FROM $table
              WHERE $id_field = ?}, undef, $id);
@@ -165,6 +168,8 @@ sub new_from_list {
         detaint_natural($id) ||
             ThrowCodeError('param_must_be_numeric',
                           {function => $class . '::new_from_list'});
+        # Too large integers make PostgreSQL crash.
+        next if $id > MAX_INT_32;
         push(@detainted_ids, $id);
     }
     # We don't do $invocant->match because some classes have
-- 
cgit v1.2.3-24-g4f1b