Feedback-ID: i0fe9450f:Fastmail
Date: Mon, 9 Jun 2025 07:27:56 +0900
From: Michael Paquier <michael@paquier.xyz>
To: Jim Jones <jim.jones@uni-muenster.de>
Cc: Tom Lane <tgl@sss.pgh.pa.us>, pgsql-bugs@lists.postgresql.org,
	maralist86@mail.ru
Subject: Re: BUG #18943: Return value of a function 'xmlBufferCreate' is
 dereferenced at xpath.c:177 without checking for NUL
Message-ID: <aEYObH2KRs_9WkB7@paquier.xyz>
References: <aEEingzOta_S_Nu7@paquier.xyz>
 <CAPLXN34Dr3Gbi+xJ6BgCeTyBJkMVe3cn7qxoADV72rC9ZHeBtQ@mail.gmail.com>
 <d2410ca0-c0dd-4f63-9e70-3d7a62a5d705@uni-muenster.de>
 <b35e2342-0f02-4365-94cf-55052ac9bda1@uni-muenster.de>
 <aEKCoNIfLxjyKY3r@paquier.xyz>
 <31f3480e-cd7d-4021-b392-87922572cc37@uni-muenster.de>
 <aETzMep2fGfB0AIp@paquier.xyz>
 <ccbc7e75-6ae7-4ec8-bff9-d6c4ce5dd42e@uni-muenster.de>
 <182094.1749397211@sss.pgh.pa.us>
 <8109cb57-0628-4a47-bbdb-81990c7ce1fb@uni-muenster.de>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="OS/K5sUVi1ua68qf"
Content-Disposition: inline
In-Reply-To: <8109cb57-0628-4a47-bbdb-81990c7ce1fb@uni-muenster.de>
Archived-At: 
 <https://www.postgresql.org/message-id/aEYObH2KRs_9WkB7%40paquier.xyz>
Precedence: bulk


--OS/K5sUVi1ua68qf
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Sun, Jun 08, 2025 at 07:00:25PM +0200, Jim Jones wrote:
> On 08.06.25 17:40, Tom Lane wrote:
>> Our risk-aversion level rises steadily over the course of a release
>> cycle, and is pretty high post beta1.  While I think the problems
>> we're trying to fix here are real, they are very low-probability
>> (I don't recall hearing any field reports traceable to this).
>> And you have to remember there is also some risk of introducing
>> new bugs.  On balance it's not a change I would back-patch, and
>> at this point v18 is pretty close to being a stable branch so
>> it's not getting fixes we wouldn't back-patch, unless that's
>> because they are in new-in-18 code.

That's something that can be measured with a kind of risk/reward
ratio.  Here is the reward for the end-user is low, as we have no
reports of the current code in the field.  The risk is in introducing
new issues.  And the code is incorrect, so we should fix it.=20

I've made similar choices in the past around the same time in the
release cycle not backpatching stuff that was an issue in backbranches
still minimal enough to not have to worry about, like 84e4570da923
(there are a few others).
--
Michael

--OS/K5sUVi1ua68qf
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEEG72nH6vTowiyblFKnvQgOdbyQH0FAmhGDmwACgkQnvQgOdby
QH1CgA//Y97rRcLRhcsgdBs2j+1KTl7u4EBzuBYkATDLSCu5RCIVFbdDhEinjJKq
uUh4fTtcGuElESCbazlrdyzZAyOvoZe0eLoScK9DxBQ6UL9nLZUI4FV7hx+8NkFq
oQ99zockREv6ZX6ltv5MoIxwqR13tViK+gfCpHTzm6diZrgXy4ox2QYCOxN78JyA
+ENkH8q2frhI1s02lW1HbxHlBibEMcQTfdS6MFpsQ6Xa9jc93Bve9P8rxuThTV8H
mJXoN+G8RP2IcVIoXYi+Q1rfd8U+mey3ww1qgLi89AJaeJ48XkfVOK8Q9KMUHh9Z
b/AsVVuWRjtkE1JGc4hwsQVA3NlhQR0oaTYVeFzypHujUFm314twnLhTudj2cwR+
VKFkim1Y9kzDzNHQM91jntCy+/caX5jhwSrq3C4xvUbo1JQ02af9G7pov8fXji5R
HMUjNAkvkuK7AQgKpgha4QKtChtohdYL+dH3EngvV9OvaSSxjllBYIWJ33ZGZkMN
OWrBSRuVmnlEFaaYsmL2WvilhZEI8r0VX2s3JzLw0/2YfSwBNRNq5xDW2aIHTUNU
DUJb1u+vvy49ZZIuckf/RuqLC5sG4P9PRRZdVr0RLu3SLdXxPQp3IscFzrvvA/Ji
ZzNimip1pTVkmc7OBHiADZAZLmf/qkZkmlKgqDcOxmsuL1KaxCU=
=OijH
-----END PGP SIGNATURE-----

--OS/K5sUVi1ua68qf--