From: Tom Lane <tgl@sss.pgh.pa.us>
To: Flavien GUEDEZ <flav.pg@oopacity.net>
Cc: pgsql-bugs@lists.postgresql.org
Subject: Re: Insufficient memory access checks in pglz_decompress
Date: Wed, 18 Oct 2023 20:48:03 -0400
Message-ID: <3235130.1697676483@sss.pgh.pa.us> (raw)
In-Reply-To: <bb74b9f4-65c1-4d89-af20-7de623948e36@oopacity.net>
References: <01fc0593-e31e-463d-902c-dd43174acee2@oopacity.net>
<3116807.1697642067@sss.pgh.pa.us>
<bb74b9f4-65c1-4d89-af20-7de623948e36@oopacity.net>
Flavien GUEDEZ <flav.pg@oopacity.net> writes:
> Thanks for your feedback, you are definitely right, I did not notice
> that (dp - off) was staying the same in the while loop.
> Here is another much smaller patch.
I thought of another thing we should change: it's better to perform
the test as "off > (dp - dest)" than the way you formulated it.
"dp - dest" is certainly computable, since it's the number of bytes
we've written to the output buffer so far. But "dp - off" could,
with bad luck and a buffer near the start of memory, wrap around
to look like it's after "dest".
Pushed with that change and a little fiddling with the comment.
Thanks for the report!
regards, tom lane
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-bugs@postgresql.org
Cc: tgl@sss.pgh.pa.us, flav.pg@oopacity.net, pgsql-bugs@lists.postgresql.org
Subject: Re: Insufficient memory access checks in pglz_decompress
In-Reply-To: <3235130.1697676483@sss.pgh.pa.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox