Feedback-ID: id4a34324:Fastmail
Date: Sat, 11 Nov 2023 11:43:25 -0800
From: Andres Freund <andres@anarazel.de>
To: Thomas Munro <thomas.munro@gmail.com>
Cc: Christoph Berg <myon@debian.org>, pgsql-hackers@lists.postgresql.org,
	Michael Paquier <michael@paquier.xyz>
Subject: Re: pgsql: Don't trust unvalidated xl_tot_len.
Message-ID: <20231111194325.d44tjbsofirhqutb@alap3.anarazel.de>
References: <E1qjozv-005NY4-Rr@gemulon.postgresql.org>
 <ZU5yKecW5yMKKhtp@msg.df7cb.de>
 <ZU6jwsm4XvmAUUTN@msg.df7cb.de>
 <CA+hUKGLm3+2NZX1pEv+2Ky+MmD+nLeBxsNxKYtowepHUnbg8FQ@mail.gmail.com>
 <ZU9rQYbAenlvgpsg@msg.df7cb.de>
 <CA+hUKGJrpmenQWXhTPQ4zqcqzT7e8gKFxrQLL3-9a+Wf1zrxtQ@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: 
 <CA+hUKGJrpmenQWXhTPQ4zqcqzT7e8gKFxrQLL3-9a+Wf1zrxtQ@mail.gmail.com>
Archived-At: 
 <https://www.postgresql.org/message-id/20231111194325.d44tjbsofirhqutb%40alap3.anarazel.de>
Precedence: bulk

Hi,

On 2023-11-12 07:17:02 +1300, Thomas Munro wrote:
> On Sun, Nov 12, 2023 at 12:53 AM Christoph Berg <myon@debian.org> wrote:
> > Re: Thomas Munro
> > > In the 13 branch we see that's in the new scan_server_header()
> > > subroutine where it tries to open the header, after asking pg_config
> > > --includedir-server where it lives.  Hmm...
> >
> > It's no ok to use pg_config at test time since `make install` might
> > not have been called yet:
> >
> > https://www.postgresql.org/message-id/2023925.1644591595@sss.pgh.pa.us
> > https://www.postgresql.org/message-id/YqkV/hoi2SX91it8@paquier.xyz
> 
> [CC'ing Michael who was involved in that analysis and who also wrote
> those bits of this commit]
> 
> We don't have an installation into the final --prefix, but we have
> tmp_install, surely?

Yea, that should work and does work locally.  I guess it'd fail though, if you
somehow ran the tests with NO_TEMP_INSTALL=1 or such.


> And the tests are run with PATH set to point to
> tmp_install's bin directory.  It looks like it did actually find a
> pg_config executable because otherwise we'd have hit die "could not
> execute pg_config" and failed sooner.  So now I'm wondering if the
> pg_config it found gives the wrong answer for --includedir-server,
> because of Debian's local patches that insert a major version into
> some paths.