Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1qjp0t-00CEcK-7E for pgsql-committers@arkaria.postgresql.org; Fri, 22 Sep 2023 22:52:43 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.94.2) (envelope-from ) id 1qjp0r-008BHO-Q6 for pgsql-committers@arkaria.postgresql.org; Fri, 22 Sep 2023 22:52:41 +0000 Received: from makus.postgresql.org ([2001:4800:3e1:1::229]) by malur.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1qjp0r-008BGl-HC for pgsql-committers@lists.postgresql.org; Fri, 22 Sep 2023 22:52:41 +0000 Received: from mahout.postgresql.org ([2001:4800:3e1:1::227]) by makus.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1qjp0o-0066Ms-OC for pgsql-committers@lists.postgresql.org; Fri, 22 Sep 2023 22:52:40 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=postgresql.org; s=20171124; h=Date:Message-Id:Subject:To:From:MIME-Version: Content-Type:Sender:Reply-To:Cc:Content-Transfer-Encoding:Content-ID: Content-Description:In-Reply-To:References; bh=D0iZ2tFXUNXRSiEBnmIq7/0fMxWKzO5CTEkOEWvGJvo=; b=EkzmWIDhtsa5oDqGoTyRgDdJaQ zOojU1yWMnf/79q91oOyB6O6MQPF8RfrMZJyfjDgiskMHF4bXeFXMPIMsXTU9NUN7IZG1vPEJiGf2 1lgwFAE4Lasx+GtC8sq82/C5brhavaLLtntzK/VAI2oLbyp3uHkztxB2pNGfYTRrrQ/iq356C0Gq8 0kAYSYoiV+EdJbovlZVF+dJTSdro94v9r0aayl3mltrxk7geTR6xSSNWflDm3xjiUhyLxR/pERGA3 Uy0ZgZAochiV8X5NpELYikajRNWuuJZKV6BTAYHXKsTcxH8Xkrif0vx85aZhwzBzLwSveHKyOAqRH aXY0gJZw==; Received: from gemulon.postgresql.org ([2001:4800:3e1:1::198]) by mahout.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1qjp0o-0003HE-E6 for pgsql-committers@lists.postgresql.org; Fri, 22 Sep 2023 22:52:38 +0000 Received: from localhost ([127.0.0.1] helo=gemulon.postgresql.org) by gemulon.postgresql.org with esmtp (Exim 4.94.2) (envelope-from ) id 1qjp0n-005NaL-LA for pgsql-committers@lists.postgresql.org; Fri, 22 Sep 2023 22:52:38 +0000 Content-Type: multipart/mixed; boundary="===============6929641236589071273==" MIME-Version: 1.0 From: Thomas Munro To: pgsql-committers@lists.postgresql.org Subject: pgsql: Don't trust unvalidated xl_tot_len. X-Auto-Response-Suppress: All Auto-Submitted: auto-generated Message-Id: Date: Fri, 22 Sep 2023 22:52:38 +0000 List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Archived-At: Precedence: bulk --===============6929641236589071273== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 RG9uJ3QgdHJ1c3QgdW52YWxpZGF0ZWQgeGxfdG90X2xlbi4KCnhsX3RvdF9sZW4gY29tZXMgZmly c3QgaW4gYSBXQUwgcmVjb3JkLiAgVXN1YWxseSB3ZSBkb24ndCB0cnVzdCBpdCB0byBiZQp0aGUg dHJ1ZSBsZW5ndGggdW50aWwgd2UndmUgdmFsaWRhdGVkIHRoZSByZWNvcmQgaGVhZGVyLiAgSWYg dGhlIHJlY29yZApoZWFkZXIgd2FzIHNwbGl0IGFjcm9zcyB0d28gcGFnZXMsIHByZXZpb3VzbHkg d2Ugd291bGRuJ3QgZG8gdGhlCnZhbGlkYXRpb24gdW50aWwgYWZ0ZXIgd2UnZCBhbHJlYWR5IHRy aWVkIHRvIGFsbG9jYXRlIGVub3VnaCBtZW1vcnkgdG8KaG9sZCB0aGUgcmVjb3JkLCB3aGljaCB3 YXMgYmFkIGJlY2F1c2UgaXQgbWlnaHQgYWN0dWFsbHkgYmUgZ2FyYmFnZQpieXRlcyBmcm9tIGEg cmVjeWNsZWQgV0FMIGZpbGUsIHNvIHdlIGNvdWxkIHRyeSB0byBhbGxvY2F0ZSBhIGxvdCBvZgpt ZW1vcnkuICBSZWxlYXNlIDE1IG1hZGUgaXQgd29yc2UuCgpTaW5jZSA3MGI0ZjgyYTRiNSwgd2Un ZCBhdCBsZWFzdCBnZW5lcmF0ZSBhbiBlbmQtb2YtV0FMIGNvbmRpdGlvbiBpZiB0aGUKZ2FyYmFn ZSA0IGJ5dGUgdmFsdWUgaGFwcGVuZWQgdG8gYmUgPiAxR0IsIGJ1dCB3ZSdkIHN0aWxsIHRyeSB0 bwphbGxvY2F0ZSB1cCB0byAxR0Igb2YgbWVtb3J5IGJvZ3VzbHkgb3RoZXJ3aXNlLiAgVGhhdCB3 YXMgYW4KaW1wcm92ZW1lbnQsIGJ1dCB1bmZvcnR1bmF0ZWx5IHJlbGVhc2UgMTUgdHJpZXMgdG8g YWxsb2NhdGUgYW5vdGhlcgpvYmplY3QgYmVmb3JlIHRoYXQsIHNvIHlvdSBjb3VsZCBnZXQgYSBG QVRBTCBlcnJvciBhbmQgcmVjb3ZlcnkgY291bGQKZmFpbC4KCldlIGNhbiBmaXggYm90aCB2YXJp YW50cyBvZiB0aGUgcHJvYmxlbSBtb3JlIGZ1bmRhbWVudGFsbHkgdXNpbmcKcHJlLWV4aXN0aW5n IHBhZ2UtbGV2ZWwgdmFsaWRhdGlvbiwgaWYgd2UganVzdCByZS1vcmRlciBzb21lIGxvZ2ljLgoK VGhlIG5ldyBvcmRlciBvZiBvcGVyYXRpb25zIGluIHRoZSBzcGxpdC1oZWFkZXIgY2FzZSBkZWZl cnMgYWxsIG1lbW9yeQphbGxvY2F0aW9uIGJhc2VkIG9uIHhsX3RvdF9sZW4gdW50aWwgd2UndmUg cmVhZCB0aGUgZm9sbG93aW5nIHBhZ2UuICBBdAp0aGF0IHBvaW50IHdlIGtub3cgdGhhdCBpdHMg Zmlyc3QgZmV3IGJ5dGVzIGFyZSBub3QgcmVjeWNsZWQgZGF0YSwgYnkKY2hlY2tpbmcgaXRzIHhs cF9wYWdlYWRkciwgYW5kIHRoYXQgaXRzIHhscF9yZW1fbGVuIGFncmVlcyB3aXRoCnhsX3RvdF9s ZW4gb24gdGhlIHByZWNlZGluZyBwYWdlLiAgVGhhdCBpcyBzdHJvbmcgZXZpZGVuY2UgdGhhdAp4 bF90b3RfbGVuIHdhcyB0cnVseSB0aGUgc3RhcnQgb2YgYSByZWNvcmQgdGhhdCB3YXMgbG9nZ2Vk LgoKVGhpcyBwcm9ibGVtIHdhcyBtb3N0IGxpa2VseSB0byBvY2N1ciBvbiBhIHN0YW5kYnksIGJl Y2F1c2UKd2FscmVjZWl2ZXIuYyByZWN5Y2xlcyBXQUwgZmlsZXMgd2l0aG91dCB6ZXJvaW5nIG91 dCB0cmFpbGluZyByZWdpb25zIG9mCmVhY2ggcGFnZS4gIFdlIGNvdWxkIGZpeCB0aGF0IHRvbywg YnV0IGl0IHdvdWxkbid0IHByb3RlY3QgdXMgZnJvbSByYXJlCmNyYXNoIHNjZW5hcmlvcyB3aGVy ZSB0aGUgdHJhaWxpbmcgemVyb2VzIGRvbid0IG1ha2UgaXQgdG8gZGlzay4KCldpdGggcmVsaWFi bGUgeGxfdG90X2xlbiB2YWxpZGF0aW9uIGluIHBsYWNlLCB0aGUgYW5jaWVudCBwb2xpY3kgb2YK Y29uc2lkZXJpbmcgbWFsbG9jIGZhaWx1cmUgdG8gaW5kaWNhdGUgY29ycnVwdGlvbiBhdCBlbmQt b2YtV0FMIHNlZW1zCnF1aXRlIHN1cnByaXNpbmcsIGJ1dCBjaGFuZ2luZyB0aGF0IGlzIGxlZnQg Zm9yIGxhdGVyIHdvcmsuCgpBbHNvIGluY2x1ZGVkIGlzIGEgbmV3IFRBUCB0ZXN0IHRvIGV4ZXJj aXNlIHZhcmlvdXMgY2FzZXMgb2YgZW5kLW9mLVdBTApkZXRlY3Rpb24gYnkgd3JpdGluZyBjb250 cml2ZWQgZGF0YSBpbnRvIHRoZSBXQUwgZnJvbSBQZXJsLgoKQmFjay1wYXRjaCB0byAxMi4gIFdl IGRlY2lkZWQgbm90IHRvIHB1dCB0aGlzIGNoYW5nZSBpbnRvIHRoZSBmaW5hbApyZWxlYXNlIG9m IDExLgoKQXV0aG9yOiBUaG9tYXMgTXVucm8gPHRob21hcy5tdW5yb0BnbWFpbC5jb20+CkF1dGhv cjogTWljaGFlbCBQYXF1aWVyIDxtaWNoYWVsQHBhcXVpZXIueHl6PgpSZXBvcnRlZC1ieTogQWxl eGFuZGVyIExha2hpbiA8ZXhjbHVzaW9uQGdtYWlsLmNvbT4KUmV2aWV3ZWQtYnk6IE5vYWggTWlz Y2ggPG5vYWhAbGVhZGJvYXQuY29tPiAodGhlIGlkZWEsIG5vdCB0aGUgY29kZSkKUmV2aWV3ZWQt Ynk6IE1pY2hhZWwgUGFxdWllciA8bWljaGFlbEBwYXF1aWVyLnh5ej4KUmV2aWV3ZWQtYnk6IFNl cmdlaSBLb3JuaWxvdiA8c2tAenNydi5vcmc+ClJldmlld2VkLWJ5OiBBbGV4YW5kZXIgTGFraGlu IDxleGNsdXNpb25AZ21haWwuY29tPgpEaXNjdXNzaW9uOiBodHRwczovL3Bvc3Rnci5lcy9tLzE3 OTI4LWFhOTI0MTZhNzBmZjQ0YTIlNDBwb3N0Z3Jlc3FsLm9yZwoKQnJhbmNoCi0tLS0tLQpSRUxf MTRfU1RBQkxFCgpEZXRhaWxzCi0tLS0tLS0KaHR0cHM6Ly9naXQucG9zdGdyZXNxbC5vcmcvcGcv Y29tbWl0ZGlmZi8zY2UzYjUzZDc2YTNkN2RhMmNhZDllNWE3M2I1NTc0YWU1ZTViMmEyCgpNb2Rp ZmllZCBGaWxlcwotLS0tLS0tLS0tLS0tLQpzcmMvYmFja2VuZC9hY2Nlc3MvdHJhbnNhbS94bG9n cmVhZGVyLmMgfCAgNzUgKysrLS0Kc3JjL3Rlc3QvcGVybC9UZXN0TGliLnBtICAgICAgICAgICAg ICAgIHwgIDQxICsrKwpzcmMvdGVzdC9yZWNvdmVyeS90LzAzOV9lbmRfb2Zfd2FsLnBsICAgfCA0 NjYgKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysKMyBmaWxlcyBjaGFuZ2VkLCA1NDQg aW5zZXJ0aW9ucygrKSwgMzggZGVsZXRpb25zKC0pCgo= --===============6929641236589071273==--