Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1qjp1D-00CEdT-EU for pgsql-committers@arkaria.postgresql.org; Fri, 22 Sep 2023 22:53:03 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.94.2) (envelope-from ) id 1qjp1B-008C86-Ul for pgsql-committers@arkaria.postgresql.org; Fri, 22 Sep 2023 22:53:01 +0000 Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29]) by malur.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1qjp1B-008C7s-M0 for pgsql-committers@lists.postgresql.org; Fri, 22 Sep 2023 22:53:01 +0000 Received: from mahout.postgresql.org ([2001:4800:3e1:1::227]) by magus.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1qjp18-0070XZ-Dz for pgsql-committers@lists.postgresql.org; Fri, 22 Sep 2023 22:53:01 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=postgresql.org; s=20171124; h=Date:Message-Id:Subject:To:From:MIME-Version: Content-Type:Sender:Reply-To:Cc:Content-Transfer-Encoding:Content-ID: Content-Description:In-Reply-To:References; bh=kqRS33RWatOX5Lszr5LxYM7LToYJJmidvaa5lomswY0=; b=4S6yUBi8t2Y4hDQiiIwVAmNfFR XGTy5DFFezDXEEz9VcJUT/xAJeAGd9EZl61uv9vtJ+tmJTOLbKQvoI9PKs30FvptY0D1WakDSHbIw oghAA3RdOBltHtdDX9WYQqPr+rMBNme+YqnaVBM6bvU0BF7Y4Mp7VL0yxLoi3pO+sfP4guje6fzYH FbaYd6jR21M8RoWfG9pI4MfZYP9DaVF/V8zeZ2EH7zBPlXdcFHS1iiFweNgvkGMYWB55TFTpf4xI0 Q+F0a6GFFAkahKefg70Y8z31ZYNTT58n419lMVzDnxH0RMR33vD6Qdb/QmoswazDHVDPKDFjYChIC ng/7DWHg==; Received: from gemulon.postgresql.org ([2001:4800:3e1:1::198]) by mahout.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1qjp17-0003IV-74 for pgsql-committers@lists.postgresql.org; Fri, 22 Sep 2023 22:52:57 +0000 Received: from localhost ([127.0.0.1] helo=gemulon.postgresql.org) by gemulon.postgresql.org with esmtp (Exim 4.94.2) (envelope-from ) id 1qjp16-005Nc5-4j for pgsql-committers@lists.postgresql.org; Fri, 22 Sep 2023 22:52:56 +0000 Content-Type: multipart/mixed; boundary="===============1612998924701944967==" MIME-Version: 1.0 From: Thomas Munro To: pgsql-committers@lists.postgresql.org Subject: pgsql: Don't trust unvalidated xl_tot_len. X-Auto-Response-Suppress: All Auto-Submitted: auto-generated Message-Id: Date: Fri, 22 Sep 2023 22:52:56 +0000 List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Archived-At: Precedence: bulk --===============1612998924701944967== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 RG9uJ3QgdHJ1c3QgdW52YWxpZGF0ZWQgeGxfdG90X2xlbi4KCnhsX3RvdF9sZW4gY29tZXMgZmly c3QgaW4gYSBXQUwgcmVjb3JkLiAgVXN1YWxseSB3ZSBkb24ndCB0cnVzdCBpdCB0byBiZQp0aGUg dHJ1ZSBsZW5ndGggdW50aWwgd2UndmUgdmFsaWRhdGVkIHRoZSByZWNvcmQgaGVhZGVyLiAgSWYg dGhlIHJlY29yZApoZWFkZXIgd2FzIHNwbGl0IGFjcm9zcyB0d28gcGFnZXMsIHByZXZpb3VzbHkg d2Ugd291bGRuJ3QgZG8gdGhlCnZhbGlkYXRpb24gdW50aWwgYWZ0ZXIgd2UnZCBhbHJlYWR5IHRy aWVkIHRvIGFsbG9jYXRlIGVub3VnaCBtZW1vcnkgdG8KaG9sZCB0aGUgcmVjb3JkLCB3aGljaCB3 YXMgYmFkIGJlY2F1c2UgaXQgbWlnaHQgYWN0dWFsbHkgYmUgZ2FyYmFnZQpieXRlcyBmcm9tIGEg cmVjeWNsZWQgV0FMIGZpbGUsIHNvIHdlIGNvdWxkIHRyeSB0byBhbGxvY2F0ZSBhIGxvdCBvZgpt ZW1vcnkuICBSZWxlYXNlIDE1IG1hZGUgaXQgd29yc2UuCgpTaW5jZSA3MGI0ZjgyYTRiNSwgd2Un ZCBhdCBsZWFzdCBnZW5lcmF0ZSBhbiBlbmQtb2YtV0FMIGNvbmRpdGlvbiBpZiB0aGUKZ2FyYmFn ZSA0IGJ5dGUgdmFsdWUgaGFwcGVuZWQgdG8gYmUgPiAxR0IsIGJ1dCB3ZSdkIHN0aWxsIHRyeSB0 bwphbGxvY2F0ZSB1cCB0byAxR0Igb2YgbWVtb3J5IGJvZ3VzbHkgb3RoZXJ3aXNlLiAgVGhhdCB3 YXMgYW4KaW1wcm92ZW1lbnQsIGJ1dCB1bmZvcnR1bmF0ZWx5IHJlbGVhc2UgMTUgdHJpZXMgdG8g YWxsb2NhdGUgYW5vdGhlcgpvYmplY3QgYmVmb3JlIHRoYXQsIHNvIHlvdSBjb3VsZCBnZXQgYSBG QVRBTCBlcnJvciBhbmQgcmVjb3ZlcnkgY291bGQKZmFpbC4KCldlIGNhbiBmaXggYm90aCB2YXJp YW50cyBvZiB0aGUgcHJvYmxlbSBtb3JlIGZ1bmRhbWVudGFsbHkgdXNpbmcKcHJlLWV4aXN0aW5n IHBhZ2UtbGV2ZWwgdmFsaWRhdGlvbiwgaWYgd2UganVzdCByZS1vcmRlciBzb21lIGxvZ2ljLgoK VGhlIG5ldyBvcmRlciBvZiBvcGVyYXRpb25zIGluIHRoZSBzcGxpdC1oZWFkZXIgY2FzZSBkZWZl cnMgYWxsIG1lbW9yeQphbGxvY2F0aW9uIGJhc2VkIG9uIHhsX3RvdF9sZW4gdW50aWwgd2UndmUg cmVhZCB0aGUgZm9sbG93aW5nIHBhZ2UuICBBdAp0aGF0IHBvaW50IHdlIGtub3cgdGhhdCBpdHMg Zmlyc3QgZmV3IGJ5dGVzIGFyZSBub3QgcmVjeWNsZWQgZGF0YSwgYnkKY2hlY2tpbmcgaXRzIHhs cF9wYWdlYWRkciwgYW5kIHRoYXQgaXRzIHhscF9yZW1fbGVuIGFncmVlcyB3aXRoCnhsX3RvdF9s ZW4gb24gdGhlIHByZWNlZGluZyBwYWdlLiAgVGhhdCBpcyBzdHJvbmcgZXZpZGVuY2UgdGhhdAp4 bF90b3RfbGVuIHdhcyB0cnVseSB0aGUgc3RhcnQgb2YgYSByZWNvcmQgdGhhdCB3YXMgbG9nZ2Vk LgoKVGhpcyBwcm9ibGVtIHdhcyBtb3N0IGxpa2VseSB0byBvY2N1ciBvbiBhIHN0YW5kYnksIGJl Y2F1c2UKd2FscmVjZWl2ZXIuYyByZWN5Y2xlcyBXQUwgZmlsZXMgd2l0aG91dCB6ZXJvaW5nIG91 dCB0cmFpbGluZyByZWdpb25zIG9mCmVhY2ggcGFnZS4gIFdlIGNvdWxkIGZpeCB0aGF0IHRvbywg YnV0IGl0IHdvdWxkbid0IHByb3RlY3QgdXMgZnJvbSByYXJlCmNyYXNoIHNjZW5hcmlvcyB3aGVy ZSB0aGUgdHJhaWxpbmcgemVyb2VzIGRvbid0IG1ha2UgaXQgdG8gZGlzay4KCldpdGggcmVsaWFi bGUgeGxfdG90X2xlbiB2YWxpZGF0aW9uIGluIHBsYWNlLCB0aGUgYW5jaWVudCBwb2xpY3kgb2YK Y29uc2lkZXJpbmcgbWFsbG9jIGZhaWx1cmUgdG8gaW5kaWNhdGUgY29ycnVwdGlvbiBhdCBlbmQt b2YtV0FMIHNlZW1zCnF1aXRlIHN1cnByaXNpbmcsIGJ1dCBjaGFuZ2luZyB0aGF0IGlzIGxlZnQg Zm9yIGxhdGVyIHdvcmsuCgpBbHNvIGluY2x1ZGVkIGlzIGEgbmV3IFRBUCB0ZXN0IHRvIGV4ZXJj aXNlIHZhcmlvdXMgY2FzZXMgb2YgZW5kLW9mLVdBTApkZXRlY3Rpb24gYnkgd3JpdGluZyBjb250 cml2ZWQgZGF0YSBpbnRvIHRoZSBXQUwgZnJvbSBQZXJsLgoKQmFjay1wYXRjaCB0byAxMi4gIFdl IGRlY2lkZWQgbm90IHRvIHB1dCB0aGlzIGNoYW5nZSBpbnRvIHRoZSBmaW5hbApyZWxlYXNlIG9m IDExLgoKQXV0aG9yOiBUaG9tYXMgTXVucm8gPHRob21hcy5tdW5yb0BnbWFpbC5jb20+CkF1dGhv cjogTWljaGFlbCBQYXF1aWVyIDxtaWNoYWVsQHBhcXVpZXIueHl6PgpSZXBvcnRlZC1ieTogQWxl eGFuZGVyIExha2hpbiA8ZXhjbHVzaW9uQGdtYWlsLmNvbT4KUmV2aWV3ZWQtYnk6IE5vYWggTWlz Y2ggPG5vYWhAbGVhZGJvYXQuY29tPiAodGhlIGlkZWEsIG5vdCB0aGUgY29kZSkKUmV2aWV3ZWQt Ynk6IE1pY2hhZWwgUGFxdWllciA8bWljaGFlbEBwYXF1aWVyLnh5ej4KUmV2aWV3ZWQtYnk6IFNl cmdlaSBLb3JuaWxvdiA8c2tAenNydi5vcmc+ClJldmlld2VkLWJ5OiBBbGV4YW5kZXIgTGFraGlu IDxleGNsdXNpb25AZ21haWwuY29tPgpEaXNjdXNzaW9uOiBodHRwczovL3Bvc3Rnci5lcy9tLzE3 OTI4LWFhOTI0MTZhNzBmZjQ0YTIlNDBwb3N0Z3Jlc3FsLm9yZwoKQnJhbmNoCi0tLS0tLQpSRUxf MTJfU1RBQkxFCgpEZXRhaWxzCi0tLS0tLS0KaHR0cHM6Ly9naXQucG9zdGdyZXNxbC5vcmcvcGcv Y29tbWl0ZGlmZi9lOGYzYzA2ODcxMTZlYjMxZmU3YmU3NGUwZmJkMmY1YzBmMjliYjNiCgpNb2Rp ZmllZCBGaWxlcwotLS0tLS0tLS0tLS0tLQpzcmMvYmFja2VuZC9hY2Nlc3MvdHJhbnNhbS94bG9n cmVhZGVyLmMgfCAgNzcgKysrLS0tCnNyYy90ZXN0L3BlcmwvVGVzdExpYi5wbSAgICAgICAgICAg ICAgICB8ICAzNCArKysKc3JjL3Rlc3QvcmVjb3ZlcnkvdC8wMzlfZW5kX29mX3dhbC5wbCAgIHwg NDY2ICsrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrCjMgZmlsZXMgY2hhbmdlZCwgNTM4 IGluc2VydGlvbnMoKyksIDM5IGRlbGV0aW9ucygtKQoK --===============1612998924701944967==--