Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1w8KoO-000Qwo-34 for pgsql-committers@arkaria.postgresql.org; Thu, 02 Apr 2026 16:22:29 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.96) (envelope-from ) id 1w8KoN-006srB-2d for pgsql-committers@arkaria.postgresql.org; Thu, 02 Apr 2026 16:22:28 +0000 Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29]) by malur.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1w8Kmu-006s3m-3D for pgsql-committers@lists.postgresql.org; Thu, 02 Apr 2026 16:20:57 +0000 Received: from mahout.postgresql.org ([2001:4800:3e1:1::227]) by magus.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.98.2) (envelope-from ) id 1w8Kmr-00000000E9B-1K04 for pgsql-committers@lists.postgresql.org; Thu, 02 Apr 2026 16:20:57 +0000 Received: from gemulon.postgresql.org ([2001:4800:3e1:1::198]) by mahout.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1w8Kmp-000aE2-2w for pgsql-committers@lists.postgresql.org; Thu, 02 Apr 2026 16:20:52 +0000 Received: from localhost ([127.0.0.1] helo=gemulon.postgresql.org) by gemulon.postgresql.org with esmtp (Exim 4.96) (envelope-from ) id 1w8Kmo-002dDS-2n for pgsql-committers@lists.postgresql.org; Thu, 02 Apr 2026 16:20:51 +0000 Content-Type: multipart/mixed; boundary="===============4076739854788562185==" MIME-Version: 1.0 From: Tom Lane To: pgsql-committers@lists.postgresql.org Subject: pgsql: Harden astreamer tar parsing logic against archives it can't han X-Auto-Response-Suppress: All Auto-Submitted: auto-generated Message-Id: Date: Thu, 02 Apr 2026 16:20:51 +0000 List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Archived-At: Precedence: bulk --===============4076739854788562185== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 SGFyZGVuIGFzdHJlYW1lciB0YXIgcGFyc2luZyBsb2dpYyBhZ2FpbnN0IGFyY2hpdmVzIGl0IGNh bid0IGhhbmRsZS4KClByZXZpb3VzbHksIHRoZXJlIHdhcyBlc3NlbnRpYWxseSBubyB2ZXJpZmlj YXRpb24gaW4gdGhpcyBjb2RlIHRoYXQKdGhlIGlucHV0IGlzIGEgdGFyIGZpbGUgYXQgYWxsLCBs ZXQgYWxvbmUgdGhhdCBpdCBmaXRzIGludG8gdGhlCnN1YnNldCBvZiB2YWxpZCB0YXIgZmlsZXMg dGhhdCB3ZSBjYW4gaGFuZGxlLiAgVGhpcyB3YXMgZXhwb3NlZCBieQp0aGUgZGlzY292ZXJ5IHRo YXQgd2UgY291bGRuJ3QgaGFuZGxlIGZpbGVzIHRoYXQgRnJlZUJTRCdzIHRhcgptYWtlcywgYmVj YXVzZSBpdCdzIGZhaXJseSBhZ2dyZXNzaXZlIGFib3V0IGNvbnZlcnRpbmcgc3BhcnNlIFdBTApm aWxlcyBpbnRvIHNwYXJzZSB0YXIgZW50cmllcy4gIFRvIGZpeDoKCiogQmFpbCBvdXQgaWYgd2Ug ZmluZCBhIHBheCBleHRlbnNpb24gaGVhZGVyLiAgVGhpcyBjb3ZlcnMgdGhlCnNwYXJzZS1maWxl IGNhc2UsIGFuZCBhbHNvIHByb3RlY3RzIHVzIGFnYWluc3Qgc2NlbmFyaW9zIHdoZXJlCnRoZSBw YXggaGVhZGVyIGNoYW5nZXMgb3RoZXIgZmlsZSBwcm9wZXJ0aWVzIHRoYXQgd2UgY2FyZSBhYm91 dC4KKEV2ZW50dWFsbHkgd2UgbWF5IGV4dGVuZCB0aGUgbG9naWMgdG8gYWN0dWFsbHkgaGFuZGxl IHN1Y2gKaGVhZGVycywgYnV0IHRoYXQgd29uJ3QgaGFwcGVuIGluIHRpbWUgZm9yIHYxOS4pCgoq IEJlIG1vcmUgd2FyeSBhYm91dCB0YXIgZmlsZSB0eXBlIGNvZGVzIGluIGdlbmVyYWw6IGRvIG5v dCBhc3N1bWUKdGhhdCBhbnl0aGluZyB0aGF0J3MgbmVpdGhlciBhIGRpcmVjdG9yeSBub3IgYSBz eW1saW5rIG11c3QgYmUgYQpyZWd1bGFyIGZpbGUuICBJbnN0ZWFkLCB3ZSBqdXN0IGlnbm9yZSBl bnRyaWVzIHRoYXQgYXJlIG5vbmUgb2YgdGhlCnRocmVlIHN1cHBvcnRlZCB0eXBlcy4KCiogQXBw bHkgcGdfZHVtcCdzIGlzVmFsaWRUYXJIZWFkZXIgdG8gdmVyaWZ5IHRoYXQgYSBwdXJwb3J0ZWQK aGVhZGVyIGJsb2NrIGlzIGFjdHVhbGx5IGluIHRhciBmb3JtYXQuICBUbyBtYWtlIHRoaXMgcG9z c2libGUsCm1vdmUgaXNWYWxpZFRhckhlYWRlciBpbnRvIHNyYy9wb3J0L3Rhci5jLCB3aGljaCBp cyBwcm9iYWJseSB3aGVyZQppdCBzaG91bGQgaGF2ZSBiZWVuIHNpbmNlIHRoYXQgZmlsZSB3YXMg Y3JlYXRlZC4KCkkgYWxzbyB0b29rIHRoZSBvcHBvcnR1bml0eSB0byBjb25zdC1pZnkgdGhlIGFy Z3VtZW50cyBvZgppc1ZhbGlkVGFySGVhZGVyIGFuZCB0YXJDaGVja3N1bSwgYW5kIHRvIHVzZSBz eW1ib2xzIG5vdCBoYXJkLXdpcmVkCmNvbnN0YW50cyBpbnNpZGUgdGFyQ2hlY2tzdW0uCgpCYWNr LXBhdGNoIHRvIHYxOCBidXQgbm90IGZ1cnRoZXIuICBBbHRob3VnaCB0aGlzIGNvZGUgZXhpc3Rz IGluc2lkZQpwZ19iYXNlYmFja3VwIGluIG9sZGVyIGJyYW5jaGVzLCBpdCdzIG5vdCByZWFsbHkg ZXhwb3NlZCBpbiB0aGF0CnVzYWdlIHRvIHRhciBmaWxlcyB0aGF0IHdlcmVuJ3QgZ2VuZXJhdGVk IGJ5IG91ciBvd24gY29kZSwgc28gaXQKZG9lc24ndCBzZWVtIHdvcnRoIGJhY2stcG9ydGluZyB0 aGVzZSBjaGFuZ2VzIGFjcm9zcyAzYzkwNTY5ODEKYW5kIGY4MGIwOWJhYy4gIEkgZGlkIGNob29z ZSB0byBpbmNsdWRlIGEgYmFjay1wYXRjaCBvZiA1ODY4MzcyYmIKaW50byB2MTggdGhvdWdoLCB0 byBtaW5pbWl6ZSBjb3NtZXRpYyBkaWZmZXJlbmNlcyBiZXR3ZWVuIHRoZXNlCnR3byBicmFuY2hl cy4KCkF1dGhvcjogVG9tIExhbmUgPHRnbEBzc3MucGdoLnBhLnVzPgpSZXZpZXdlZC1ieTogVGhv bWFzIE11bnJvIDx0aG9tYXMubXVucm9AZ21haWwuY29tPgpEaXNjdXNzaW9uOiBodHRwczovL3Bv c3Rnci5lcy9tLzMwNDk0NjAuMTc3NTA2Nzk0MEBzc3MucGdoLnBhLnVzPgpCYWNrcGF0Y2gtdGhy b3VnaDogMTgKCkJyYW5jaAotLS0tLS0KUkVMXzE4X1NUQUJMRQoKRGV0YWlscwotLS0tLS0tCmh0 dHBzOi8vZ2l0LnBvc3RncmVzcWwub3JnL3BnL2NvbW1pdGRpZmYvNjk4ZWFlN2RiN2FiOTgwMDc0 NjM2YWQ0NzQ4NWQzYzJkYTYwNzM4NwoKTW9kaWZpZWQgRmlsZXMKLS0tLS0tLS0tLS0tLS0Kc3Jj L2Jpbi9wZ19iYXNlYmFja3VwL2FzdHJlYW1lcl9pbmplY3QuYyAgIHwgIDMgKy0Kc3JjL2Jpbi9w Z19kdW1wL3BnX2JhY2t1cF9hcmNoaXZlci5jICAgICAgIHwgIDMgKy0Kc3JjL2Jpbi9wZ19kdW1w L3BnX2JhY2t1cF9hcmNoaXZlci5oICAgICAgIHwgIDIgLS0Kc3JjL2Jpbi9wZ19kdW1wL3BnX2Jh Y2t1cF90YXIuYyAgICAgICAgICAgIHwgMjUgLS0tLS0tLS0tLS0tLS0Kc3JjL2Jpbi9wZ192ZXJp ZnliYWNrdXAvYXN0cmVhbWVyX3ZlcmlmeS5jIHwgIDIgKy0Kc3JjL2ZlX3V0aWxzL2FzdHJlYW1l cl9maWxlLmMgICAgICAgICAgICAgIHwgMTIgKysrLS0tLQpzcmMvZmVfdXRpbHMvYXN0cmVhbWVy X3Rhci5jICAgICAgICAgICAgICAgfCA1MiArKysrKysrKysrKysrKysrKysrKysrKy0tLS0tLS0K c3JjL2luY2x1ZGUvZmVfdXRpbHMvYXN0cmVhbWVyLmggICAgICAgICAgIHwgIDQgKystCnNyYy9p bmNsdWRlL3BndGFyLmggICAgICAgICAgICAgICAgICAgICAgICB8ICA3ICsrKy0Kc3JjL3BvcnQv dGFyLmMgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHwgMzcgKysrKysrKysrKysrKysrKysr LS0tCjEwIGZpbGVzIGNoYW5nZWQsIDk0IGluc2VydGlvbnMoKyksIDUzIGRlbGV0aW9ucygtKQoK --===============4076739854788562185==--