Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1qjp0h-00CEbg-3z for pgsql-committers@arkaria.postgresql.org; Fri, 22 Sep 2023 22:52:31 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.94.2) (envelope-from ) id 1qjp0f-008ApH-Na for pgsql-committers@arkaria.postgresql.org; Fri, 22 Sep 2023 22:52:29 +0000 Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29]) by malur.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1qjp0f-008Aoy-FR for pgsql-committers@lists.postgresql.org; Fri, 22 Sep 2023 22:52:29 +0000 Received: from mahout.postgresql.org ([2001:4800:3e1:1::227]) by magus.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1qjp0c-0070X5-B3 for pgsql-committers@lists.postgresql.org; Fri, 22 Sep 2023 22:52:28 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=postgresql.org; s=20171124; h=Date:Message-Id:Subject:To:From:MIME-Version: Content-Type:Sender:Reply-To:Cc:Content-Transfer-Encoding:Content-ID: Content-Description:In-Reply-To:References; bh=7NxJleQACGk2426QkiH4mV50zT2H8qhDnSw6f0qIBVw=; b=aQEsGyrQ9wD/HBNO4cQgcyC+rz O36PpU6rPE4Jfmq/nEzmN4V+CnRldDjImd8j9tfiwB4/pD4SffCmMGAidggF6NPXIvhKMtRbmE+f8 DiXsfDLLRbyCQCQdDHYLAWKwIqTBro7YsI3B3JG9FdDTE21HxB7wmdFuFScVxNpaLW4c2RsltVHdw px7/9rgC4j63WXNwszGEN5LLAJ0DUhQTbU5beQwi6T7IYTi9Zs8RPTMC+S6HRWkregOCBRCTGOp3N iBH7d0mlc1plhY4FlnFhTzoV+1YKliZwLKTZeWH4JpGsvu4LK29wpqRZOBhzcC8RtFsnbWiv7RZj+ 7N9YvIJw==; Received: from gemulon.postgresql.org ([2001:4800:3e1:1::198]) by mahout.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1qjp0b-0003H2-35 for pgsql-committers@lists.postgresql.org; Fri, 22 Sep 2023 22:52:25 +0000 Received: from localhost ([127.0.0.1] helo=gemulon.postgresql.org) by gemulon.postgresql.org with esmtp (Exim 4.94.2) (envelope-from ) id 1qjp0a-005NZL-9r for pgsql-committers@lists.postgresql.org; Fri, 22 Sep 2023 22:52:24 +0000 Content-Type: multipart/mixed; boundary="===============8990414918511417118==" MIME-Version: 1.0 From: Thomas Munro To: pgsql-committers@lists.postgresql.org Subject: pgsql: Don't trust unvalidated xl_tot_len. X-Auto-Response-Suppress: All Auto-Submitted: auto-generated Message-Id: Date: Fri, 22 Sep 2023 22:52:24 +0000 List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Archived-At: Precedence: bulk --===============8990414918511417118== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 RG9uJ3QgdHJ1c3QgdW52YWxpZGF0ZWQgeGxfdG90X2xlbi4KCnhsX3RvdF9sZW4gY29tZXMgZmly c3QgaW4gYSBXQUwgcmVjb3JkLiAgVXN1YWxseSB3ZSBkb24ndCB0cnVzdCBpdCB0byBiZQp0aGUg dHJ1ZSBsZW5ndGggdW50aWwgd2UndmUgdmFsaWRhdGVkIHRoZSByZWNvcmQgaGVhZGVyLiAgSWYg dGhlIHJlY29yZApoZWFkZXIgd2FzIHNwbGl0IGFjcm9zcyB0d28gcGFnZXMsIHByZXZpb3VzbHkg d2Ugd291bGRuJ3QgZG8gdGhlCnZhbGlkYXRpb24gdW50aWwgYWZ0ZXIgd2UnZCBhbHJlYWR5IHRy aWVkIHRvIGFsbG9jYXRlIGVub3VnaCBtZW1vcnkgdG8KaG9sZCB0aGUgcmVjb3JkLCB3aGljaCB3 YXMgYmFkIGJlY2F1c2UgaXQgbWlnaHQgYWN0dWFsbHkgYmUgZ2FyYmFnZQpieXRlcyBmcm9tIGEg cmVjeWNsZWQgV0FMIGZpbGUsIHNvIHdlIGNvdWxkIHRyeSB0byBhbGxvY2F0ZSBhIGxvdCBvZgpt ZW1vcnkuICBSZWxlYXNlIDE1IG1hZGUgaXQgd29yc2UuCgpTaW5jZSA3MGI0ZjgyYTRiNSwgd2Un ZCBhdCBsZWFzdCBnZW5lcmF0ZSBhbiBlbmQtb2YtV0FMIGNvbmRpdGlvbiBpZiB0aGUKZ2FyYmFn ZSA0IGJ5dGUgdmFsdWUgaGFwcGVuZWQgdG8gYmUgPiAxR0IsIGJ1dCB3ZSdkIHN0aWxsIHRyeSB0 bwphbGxvY2F0ZSB1cCB0byAxR0Igb2YgbWVtb3J5IGJvZ3VzbHkgb3RoZXJ3aXNlLiAgVGhhdCB3 YXMgYW4KaW1wcm92ZW1lbnQsIGJ1dCB1bmZvcnR1bmF0ZWx5IHJlbGVhc2UgMTUgdHJpZXMgdG8g YWxsb2NhdGUgYW5vdGhlcgpvYmplY3QgYmVmb3JlIHRoYXQsIHNvIHlvdSBjb3VsZCBnZXQgYSBG QVRBTCBlcnJvciBhbmQgcmVjb3ZlcnkgY291bGQKZmFpbC4KCldlIGNhbiBmaXggYm90aCB2YXJp YW50cyBvZiB0aGUgcHJvYmxlbSBtb3JlIGZ1bmRhbWVudGFsbHkgdXNpbmcKcHJlLWV4aXN0aW5n IHBhZ2UtbGV2ZWwgdmFsaWRhdGlvbiwgaWYgd2UganVzdCByZS1vcmRlciBzb21lIGxvZ2ljLgoK VGhlIG5ldyBvcmRlciBvZiBvcGVyYXRpb25zIGluIHRoZSBzcGxpdC1oZWFkZXIgY2FzZSBkZWZl cnMgYWxsIG1lbW9yeQphbGxvY2F0aW9uIGJhc2VkIG9uIHhsX3RvdF9sZW4gdW50aWwgd2UndmUg cmVhZCB0aGUgZm9sbG93aW5nIHBhZ2UuICBBdAp0aGF0IHBvaW50IHdlIGtub3cgdGhhdCBpdHMg Zmlyc3QgZmV3IGJ5dGVzIGFyZSBub3QgcmVjeWNsZWQgZGF0YSwgYnkKY2hlY2tpbmcgaXRzIHhs cF9wYWdlYWRkciwgYW5kIHRoYXQgaXRzIHhscF9yZW1fbGVuIGFncmVlcyB3aXRoCnhsX3RvdF9s ZW4gb24gdGhlIHByZWNlZGluZyBwYWdlLiAgVGhhdCBpcyBzdHJvbmcgZXZpZGVuY2UgdGhhdAp4 bF90b3RfbGVuIHdhcyB0cnVseSB0aGUgc3RhcnQgb2YgYSByZWNvcmQgdGhhdCB3YXMgbG9nZ2Vk LgoKVGhpcyBwcm9ibGVtIHdhcyBtb3N0IGxpa2VseSB0byBvY2N1ciBvbiBhIHN0YW5kYnksIGJl Y2F1c2UKd2FscmVjZWl2ZXIuYyByZWN5Y2xlcyBXQUwgZmlsZXMgd2l0aG91dCB6ZXJvaW5nIG91 dCB0cmFpbGluZyByZWdpb25zIG9mCmVhY2ggcGFnZS4gIFdlIGNvdWxkIGZpeCB0aGF0IHRvbywg YnV0IHRoYXQgd291bGRuJ3QgcHJvdGVjdCB1cyBmcm9tCnJhcmUgY3Jhc2ggc2NlbmFyaW9zIHdo ZXJlIHRoZSB0cmFpbGluZyB6ZXJvZXMgZG9uJ3QgbWFrZSBpdCB0byBkaXNrLgoKV2l0aCByZWxp YWJsZSB4bF90b3RfbGVuIHZhbGlkYXRpb24gaW4gcGxhY2UsIHRoZSBhbmNpZW50IHBvbGljeSBv Zgpjb25zaWRlcmluZyBtYWxsb2MgZmFpbHVyZSB0byBpbmRpY2F0ZSBjb3JydXB0aW9uIGF0IGVu ZC1vZi1XQUwgc2VlbXMKcXVpdGUgc3VycHJpc2luZywgYnV0IGNoYW5naW5nIHRoYXQgaXMgbGVm dCBmb3IgbGF0ZXIgd29yay4KCkFsc28gaW5jbHVkZWQgaXMgYSBuZXcgVEFQIHRlc3QgdG8gZXhl cmNpc2UgdmFyaW91cyBjYXNlcyBvZiBlbmQtb2YtV0FMCmRldGVjdGlvbiBieSB3cml0aW5nIGNv bnRyaXZlZCBkYXRhIGludG8gdGhlIFdBTCBmcm9tIFBlcmwuCgpCYWNrLXBhdGNoIHRvIDEyLiAg V2UgZGVjaWRlZCBub3QgdG8gcHV0IHRoaXMgY2hhbmdlIGludG8gdGhlIGZpbmFsCnJlbGVhc2Ug b2YgMTEuCgpBdXRob3I6IFRob21hcyBNdW5ybyA8dGhvbWFzLm11bnJvQGdtYWlsLmNvbT4KQXV0 aG9yOiBNaWNoYWVsIFBhcXVpZXIgPG1pY2hhZWxAcGFxdWllci54eXo+ClJlcG9ydGVkLWJ5OiBB bGV4YW5kZXIgTGFraGluIDxleGNsdXNpb25AZ21haWwuY29tPgpSZXZpZXdlZC1ieTogTm9haCBN aXNjaCA8bm9haEBsZWFkYm9hdC5jb20+ICh0aGUgaWRlYSwgbm90IHRoZSBjb2RlKQpSZXZpZXdl ZC1ieTogTWljaGFlbCBQYXF1aWVyIDxtaWNoYWVsQHBhcXVpZXIueHl6PgpSZXZpZXdlZC1ieTog U2VyZ2VpIEtvcm5pbG92IDxza0B6c3J2Lm9yZz4KUmV2aWV3ZWQtYnk6IEFsZXhhbmRlciBMYWto aW4gPGV4Y2x1c2lvbkBnbWFpbC5jb20+CkRpc2N1c3Npb246IGh0dHBzOi8vcG9zdGdyLmVzL20v MTc5MjgtYWE5MjQxNmE3MGZmNDRhMiU0MHBvc3RncmVzcWwub3JnCgpCcmFuY2gKLS0tLS0tClJF TF8xNV9TVEFCTEUKCkRldGFpbHMKLS0tLS0tLQpodHRwczovL2dpdC5wb3N0Z3Jlc3FsLm9yZy9w Zy9jb21taXRkaWZmL2Y0ZDE1MmVkZDhmMzU1ZTk2YjMwZDRiYmY5YzZhOWNiN2EyMGMzOGYKCk1v ZGlmaWVkIEZpbGVzCi0tLS0tLS0tLS0tLS0tCnNyYy9iYWNrZW5kL2FjY2Vzcy90cmFuc2FtL3hs b2dyZWFkZXIuYyB8IDEyMyArKysrKy0tLS0Kc3JjL3Rlc3QvcGVybC9Qb3N0Z3JlU1FML1Rlc3Qv VXRpbHMucG0gIHwgIDQxICsrKwpzcmMvdGVzdC9yZWNvdmVyeS90LzAzOV9lbmRfb2Zfd2FsLnBs ICAgfCA0NjAgKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysKMyBmaWxlcyBjaGFuZ2Vk LCA1NjggaW5zZXJ0aW9ucygrKSwgNTYgZGVsZXRpb25zKC0pCgo= --===============8990414918511417118==--