From: Michael Paquier <michael@paquier.xyz>
To: Tom Lane <tgl@sss.pgh.pa.us>
Cc: Dmitry Koval <d.koval@postgrespro.ru>
Cc: pgsql-bugs@lists.postgresql.org
Subject: Re: BUG #18274: Error 'invalid XML content'
Date: Mon, 15 Jan 2024 13:18:54 +0900
Message-ID: <ZaSyLnPwVpzHxDCU@paquier.xyz> (raw)
In-Reply-To: <1369582.1705288593@sss.pgh.pa.us>
References: <18274-98d16bc03520665f@postgresql.org>
<1616257.1704651529@sss.pgh.pa.us>
<5588db01-45be-48ff-b158-85f789bc502c@postgrespro.ru>
<1314313.1705259848@sss.pgh.pa.us>
<0eea123f-388a-41ea-9df3-d4606cf9ed8d@postgrespro.ru>
<ZaRvbaQ8V9uGxXGD@paquier.xyz>
<1369582.1705288593@sss.pgh.pa.us>
On Sun, Jan 14, 2024 at 10:16:33PM -0500, Tom Lane wrote:
> Blowing out a backend's memory or CPU consumption is not something
> we try hard to prevent, so I'm not terribly worried on that score.
> The one thing I'm concerned about is that raising these limits could
> make bugs (like integer overflow problems) reachable that were not
> otherwise, and that such bugs might rise to the level of security
> problems. They've had such issues before (CVE-2022-40303) and it'd be
> foolish to be sure that none remain. Still, that's clearly their bug
> not our bug.
Interesting. We could always keep our coding more defensive, not sure
entirely how. I am not sure that this is enough to not just use the
upper limit, though. Being able to manipulate larger XML elements
sounds like a fair argument from the user perspective these days,
especially with memory being cheaper and larger.
1fb2e0dfc631 has added the huge option back in 2009 in libxml2, so
it's been around for some time.
--
Michael
Attachments:
[application/pgp-signature] signature.asc (832B, ../ZaSyLnPwVpzHxDCU@paquier.xyz/2-signature.asc)
download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-bugs@postgresql.org
Cc: michael@paquier.xyz, tgl@sss.pgh.pa.us, d.koval@postgrespro.ru, pgsql-bugs@lists.postgresql.org
Subject: Re: BUG #18274: Error 'invalid XML content'
In-Reply-To: <ZaSyLnPwVpzHxDCU@paquier.xyz>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox