From: Tom Lane <tgl@sss.pgh.pa.us>
To: Flavien GUEDEZ <flav.pg@oopacity.net>
cc: pgsql-bugs@lists.postgresql.org
Subject: Re: Insufficient memory access checks in pglz_decompress
In-reply-to: <bb74b9f4-65c1-4d89-af20-7de623948e36@oopacity.net>
References: <01fc0593-e31e-463d-902c-dd43174acee2@oopacity.net>
 <3116807.1697642067@sss.pgh.pa.us>
 <bb74b9f4-65c1-4d89-af20-7de623948e36@oopacity.net>
Comments: In-reply-to Flavien GUEDEZ <flav.pg@oopacity.net>
	message dated "Wed, 18 Oct 2023 18:46:56 +0200"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <3235129.1697676483.1@sss.pgh.pa.us>
Date: Wed, 18 Oct 2023 20:48:03 -0400
Message-ID: <3235130.1697676483@sss.pgh.pa.us>
Archived-At: 
 <https://www.postgresql.org/message-id/3235130.1697676483%40sss.pgh.pa.us>
Precedence: bulk

Flavien GUEDEZ <flav.pg@oopacity.net> writes:
> Thanks for your feedback, you are definitely right, I did not notice 
> that (dp - off) was staying the same in the while loop.
> Here is another much smaller patch.

I thought of another thing we should change: it's better to perform
the test as "off > (dp - dest)" than the way you formulated it.
"dp - dest" is certainly computable, since it's the number of bytes
we've written to the output buffer so far.  But "dp - off" could,
with bad luck and a buffer near the start of memory, wrap around
to look like it's after "dest".

Pushed with that change and a little fiddling with the comment.
Thanks for the report!

			regards, tom lane