Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1w8Kmw-000Qvc-2J for pgsql-committers@arkaria.postgresql.org; Thu, 02 Apr 2026 16:20:59 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.96) (envelope-from ) id 1w8Kmu-006s0u-1g for pgsql-committers@arkaria.postgresql.org; Thu, 02 Apr 2026 16:20:56 +0000 Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29]) by malur.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1w8Kmu-006s0m-11 for pgsql-committers@lists.postgresql.org; Thu, 02 Apr 2026 16:20:56 +0000 Received: from mahout.postgresql.org ([2001:4800:3e1:1::227]) by magus.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.98.2) (envelope-from ) id 1w8Kms-00000000E9C-0Ba1 for pgsql-committers@lists.postgresql.org; Thu, 02 Apr 2026 16:20:56 +0000 Received: from gemulon.postgresql.org ([2001:4800:3e1:1::198]) by mahout.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1w8Kmp-000aE1-3D for pgsql-committers@lists.postgresql.org; Thu, 02 Apr 2026 16:20:52 +0000 Received: from localhost ([127.0.0.1] helo=gemulon.postgresql.org) by gemulon.postgresql.org with esmtp (Exim 4.96) (envelope-from ) id 1w8Kmo-002dDQ-2S for pgsql-committers@lists.postgresql.org; Thu, 02 Apr 2026 16:20:51 +0000 Content-Type: multipart/mixed; boundary="===============2549264341066600601==" MIME-Version: 1.0 From: Tom Lane To: pgsql-committers@lists.postgresql.org Subject: pgsql: Harden astreamer tar parsing logic against archives it can't han X-Auto-Response-Suppress: All Auto-Submitted: auto-generated Message-Id: Date: Thu, 02 Apr 2026 16:20:51 +0000 List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Archived-At: Precedence: bulk --===============2549264341066600601== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 SGFyZGVuIGFzdHJlYW1lciB0YXIgcGFyc2luZyBsb2dpYyBhZ2FpbnN0IGFyY2hpdmVzIGl0IGNh bid0IGhhbmRsZS4KClByZXZpb3VzbHksIHRoZXJlIHdhcyBlc3NlbnRpYWxseSBubyB2ZXJpZmlj YXRpb24gaW4gdGhpcyBjb2RlIHRoYXQKdGhlIGlucHV0IGlzIGEgdGFyIGZpbGUgYXQgYWxsLCBs ZXQgYWxvbmUgdGhhdCBpdCBmaXRzIGludG8gdGhlCnN1YnNldCBvZiB2YWxpZCB0YXIgZmlsZXMg dGhhdCB3ZSBjYW4gaGFuZGxlLiAgVGhpcyB3YXMgZXhwb3NlZCBieQp0aGUgZGlzY292ZXJ5IHRo YXQgd2UgY291bGRuJ3QgaGFuZGxlIGZpbGVzIHRoYXQgRnJlZUJTRCdzIHRhcgptYWtlcywgYmVj YXVzZSBpdCdzIGZhaXJseSBhZ2dyZXNzaXZlIGFib3V0IGNvbnZlcnRpbmcgc3BhcnNlIFdBTApm aWxlcyBpbnRvIHNwYXJzZSB0YXIgZW50cmllcy4gIFRvIGZpeDoKCiogQmFpbCBvdXQgaWYgd2Ug ZmluZCBhIHBheCBleHRlbnNpb24gaGVhZGVyLiAgVGhpcyBjb3ZlcnMgdGhlCnNwYXJzZS1maWxl IGNhc2UsIGFuZCBhbHNvIHByb3RlY3RzIHVzIGFnYWluc3Qgc2NlbmFyaW9zIHdoZXJlCnRoZSBw YXggaGVhZGVyIGNoYW5nZXMgb3RoZXIgZmlsZSBwcm9wZXJ0aWVzIHRoYXQgd2UgY2FyZSBhYm91 dC4KKEV2ZW50dWFsbHkgd2UgbWF5IGV4dGVuZCB0aGUgbG9naWMgdG8gYWN0dWFsbHkgaGFuZGxl IHN1Y2gKaGVhZGVycywgYnV0IHRoYXQgd29uJ3QgaGFwcGVuIGluIHRpbWUgZm9yIHYxOS4pCgoq IEJlIG1vcmUgd2FyeSBhYm91dCB0YXIgZmlsZSB0eXBlIGNvZGVzIGluIGdlbmVyYWw6IGRvIG5v dCBhc3N1bWUKdGhhdCBhbnl0aGluZyB0aGF0J3MgbmVpdGhlciBhIGRpcmVjdG9yeSBub3IgYSBz eW1saW5rIG11c3QgYmUgYQpyZWd1bGFyIGZpbGUuICBJbnN0ZWFkLCB3ZSBqdXN0IGlnbm9yZSBl bnRyaWVzIHRoYXQgYXJlIG5vbmUgb2YgdGhlCnRocmVlIHN1cHBvcnRlZCB0eXBlcy4KCiogQXBw bHkgcGdfZHVtcCdzIGlzVmFsaWRUYXJIZWFkZXIgdG8gdmVyaWZ5IHRoYXQgYSBwdXJwb3J0ZWQK aGVhZGVyIGJsb2NrIGlzIGFjdHVhbGx5IGluIHRhciBmb3JtYXQuICBUbyBtYWtlIHRoaXMgcG9z c2libGUsCm1vdmUgaXNWYWxpZFRhckhlYWRlciBpbnRvIHNyYy9wb3J0L3Rhci5jLCB3aGljaCBp cyBwcm9iYWJseSB3aGVyZQppdCBzaG91bGQgaGF2ZSBiZWVuIHNpbmNlIHRoYXQgZmlsZSB3YXMg Y3JlYXRlZC4KCkkgYWxzbyB0b29rIHRoZSBvcHBvcnR1bml0eSB0byBjb25zdC1pZnkgdGhlIGFy Z3VtZW50cyBvZgppc1ZhbGlkVGFySGVhZGVyIGFuZCB0YXJDaGVja3N1bSwgYW5kIHRvIHVzZSBz eW1ib2xzIG5vdCBoYXJkLXdpcmVkCmNvbnN0YW50cyBpbnNpZGUgdGFyQ2hlY2tzdW0uCgpCYWNr LXBhdGNoIHRvIHYxOCBidXQgbm90IGZ1cnRoZXIuICBBbHRob3VnaCB0aGlzIGNvZGUgZXhpc3Rz IGluc2lkZQpwZ19iYXNlYmFja3VwIGluIG9sZGVyIGJyYW5jaGVzLCBpdCdzIG5vdCByZWFsbHkg ZXhwb3NlZCBpbiB0aGF0CnVzYWdlIHRvIHRhciBmaWxlcyB0aGF0IHdlcmVuJ3QgZ2VuZXJhdGVk IGJ5IG91ciBvd24gY29kZSwgc28gaXQKZG9lc24ndCBzZWVtIHdvcnRoIGJhY2stcG9ydGluZyB0 aGVzZSBjaGFuZ2VzIGFjcm9zcyAzYzkwNTY5ODEKYW5kIGY4MGIwOWJhYy4gIEkgZGlkIGNob29z ZSB0byBpbmNsdWRlIGEgYmFjay1wYXRjaCBvZiA1ODY4MzcyYmIKaW50byB2MTggdGhvdWdoLCB0 byBtaW5pbWl6ZSBjb3NtZXRpYyBkaWZmZXJlbmNlcyBiZXR3ZWVuIHRoZXNlCnR3byBicmFuY2hl cy4KCkF1dGhvcjogVG9tIExhbmUgPHRnbEBzc3MucGdoLnBhLnVzPgpSZXZpZXdlZC1ieTogVGhv bWFzIE11bnJvIDx0aG9tYXMubXVucm9AZ21haWwuY29tPgpEaXNjdXNzaW9uOiBodHRwczovL3Bv c3Rnci5lcy9tLzMwNDk0NjAuMTc3NTA2Nzk0MEBzc3MucGdoLnBhLnVzPgpCYWNrcGF0Y2gtdGhy b3VnaDogMTgKCkJyYW5jaAotLS0tLS0KbWFzdGVyCgpEZXRhaWxzCi0tLS0tLS0KaHR0cHM6Ly9n aXQucG9zdGdyZXNxbC5vcmcvcGcvY29tbWl0ZGlmZi9iYzMwYzcwNGFkZDU1MThmYmQ4MzFhNWFk M2JjNDY5OTBjNDk1NGNmCgpNb2RpZmllZCBGaWxlcwotLS0tLS0tLS0tLS0tLQpzcmMvYmluL3Bn X2Jhc2ViYWNrdXAvYXN0cmVhbWVyX2luamVjdC5jICAgfCAgMyArKy0Kc3JjL2Jpbi9wZ19kdW1w L3BnX2JhY2t1cF9hcmNoaXZlci5jICAgICAgIHwgIDMgKystCnNyYy9iaW4vcGdfZHVtcC9wZ19i YWNrdXBfYXJjaGl2ZXIuaCAgICAgICB8ICAyIC0tCnNyYy9iaW4vcGdfZHVtcC9wZ19iYWNrdXBf dGFyLmMgICAgICAgICAgICB8IDI1IC0tLS0tLS0tLS0tLS0tLS0tLS0Kc3JjL2Jpbi9wZ192ZXJp ZnliYWNrdXAvYXN0cmVhbWVyX3ZlcmlmeS5jIHwgIDIgKy0Kc3JjL2Jpbi9wZ193YWxkdW1wL2Fy Y2hpdmVfd2FsZHVtcC5jICAgICAgIHwgIDIgKy0Kc3JjL2ZlX3V0aWxzL2FzdHJlYW1lcl9maWxl LmMgICAgICAgICAgICAgIHwgMTIgKysrKy0tLS0tCnNyYy9mZV91dGlscy9hc3RyZWFtZXJfdGFy LmMgICAgICAgICAgICAgICB8IDQwICsrKysrKysrKysrKysrKysrKysrKysrKy0tLS0tLQpzcmMv aW5jbHVkZS9mZV91dGlscy9hc3RyZWFtZXIuaCAgICAgICAgICAgfCAgNCArKy0Kc3JjL2luY2x1 ZGUvcGd0YXIuaCAgICAgICAgICAgICAgICAgICAgICAgIHwgIDcgKysrKystCnNyYy9wb3J0L3Rh ci5jICAgICAgICAgICAgICAgICAgICAgICAgICAgICB8IDM3ICsrKysrKysrKysrKysrKysrKysr KysrKy0tLQoxMSBmaWxlcyBjaGFuZ2VkLCA4NyBpbnNlcnRpb25zKCspLCA1MCBkZWxldGlvbnMo LSkKCg== --===============2549264341066600601==--