Feedback-ID: i0fe9450f:Fastmail
Date: Thu, 23 Oct 2025 09:29:19 +0900
From: Michael Paquier <michael@paquier.xyz>
To: Tom Lane <tgl@sss.pgh.pa.us>
Cc: Daniel Gustafsson <daniel@yesql.se>, 13952878799@163.com,
	pgsql-bugs@lists.postgresql.org
Subject: Re: BUG #19092: scram_free() will free on address which was not
 malloc()-ed in pg_scram_mech
Message-ID: <aPl235F3k3ZDeAfj@paquier.xyz>
References: <19092-b06adfd70ddcd2ab@postgresql.org>
 <64F1394B-E765-4291-91CF-E6CFE019D195@yesql.se>
 <494078.1761059179@sss.pgh.pa.us>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="FknIUppCDToqiW0G"
Content-Disposition: inline
In-Reply-To: <494078.1761059179@sss.pgh.pa.us>
Archived-At: 
 <https://www.postgresql.org/message-id/aPl235F3k3ZDeAfj%40paquier.xyz>
Precedence: bulk


--FknIUppCDToqiW0G
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

On Tue, Oct 21, 2025 at 11:06:19AM -0400, Tom Lane wrote:
> We'd really need to see a concrete example to decide whether this is
> a PG bug or user error.  I think the SASL stuff is sufficiently poorly
> tested that it could be a previously-unknown PG bug, but it's not clear.

[ .. double-checking the code .. ]

FWIW, I doubt that this is something we need to worry about and I
suspect that there is no action item here.  dblink and WAL receivers
do their stuff so as the main backend code does not link with libpq,
and I doubt that we'd ever want to enter in the territory where
FRONTEND becomes a thing in libpq.

Of course, I may prove wrong.

> So: test case, please.

Yes.
--
Michael

--FknIUppCDToqiW0G
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEEG72nH6vTowiyblFKnvQgOdbyQH0FAmj5dt8ACgkQnvQgOdby
QH1+Yg//ZR6apGkntUof9VxQ7+8X7M0Spv1AinC8dG/Wd5EuE4E7EwVzDpmab5+D
qXnkhyIUlT0VSfaCo3tdHDaalVBaEGK3b2+QrzzEqd1q2H4rM0lEmsb37OhoXMz+
diIcnzEzmRDS/eKZukUNiWEUzkoD/nv2Uuf8ko0P5GyLb3Zy2Bc9KGtw8C8nphyu
oGC+c0wbFBF9+V9o6uTMq0z0/quAYlJCWyoCu//RcGLMKMC8JJjxLlMe+76F2WzT
HYBQ/Pp+SeHD3DPExiHmXPhVQ9gMsr/MSfWr9gjbd+M0FDR7mZgFe+xZtk2qYBUR
O1pzyF0Fy+ZiUkNJy3FDao0HWCCAUp0ARjRNAd8ru3G/ipkVbwLZ7UNQrS7ftU5f
PF46pyvk2BiddD1k6KjeWAVYl0Wbw/vHoZAXp5oWHV3E6/5SvTBWTTNAaCkAo8WU
riKqqNgAfSPnGoMDabEi9zn96ikfLH62Vqp5D8RJ05U4BpbSunvMqnlaghO8s5bw
ZfnJKvvtS+3BqGOBMvLi4oDWLTAV+HKv6pC27rp0Cb41lDntPyvinmcRPuO3jKfw
eul0p4GMJCC/NFuSbFPfsOPVCwOTuiiWJhXNAygJRw5AFYoU846jW9BRkU7hw2J3
uENHCiykhF+sj/5zEPKKrQkLtWc8KhvuoDTJzj3EmupSBg+B3Ts=
=rgc8
-----END PGP SIGNATURE-----

--FknIUppCDToqiW0G--