From: Tom Lane <tgl@sss.pgh.pa.us>
To: Brett Okken <brett.okken.os@gmail.com>
cc: pgsql-docs@lists.postgresql.org, Dave Cramer <davecramer@gmail.com>
Subject: Re: char 0x00
In-reply-to: 
 <CANBJVOH+SL8d7D4buSOv9=H18KLCQf2r1GC7bfUnwC4NGgF6_Q@mail.gmail.com>
References: 
 <CANBJVOH31rJxU=6wYULRyRVg6QfbgWRrFPrxUw1Ss20CR+rcBQ@mail.gmail.com>
 <11841.1585232526@sss.pgh.pa.us>
 <CANBJVOH+SL8d7D4buSOv9=H18KLCQf2r1GC7bfUnwC4NGgF6_Q@mail.gmail.com>
Comments: In-reply-to Brett Okken <brett.okken.os@gmail.com>
	message dated "Thu, 26 Mar 2020 09:28:54 -0500"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <14010.1585236112.1@sss.pgh.pa.us>
Date: Thu, 26 Mar 2020 11:21:52 -0400
Message-ID: <14011.1585236112@sss.pgh.pa.us>
Precedence: bulk

Brett Okken <brett.okken.os@gmail.com> writes:
> Using a client and server encoding of SQL_ASCII makes it possible to get
> 0x00 into a text value column when using a bind variable.

Having looked at the code again, I flat out don't believe you.
textin is certainly not going to read past a nul character,
and textrecv goes through pg_client_to_server (via pq_getmsgtext),
which AFAICS is careful in all code paths to reject nuls.

If I'm missing something, I'd really like to see a concrete example,
because this would be a bug, and it'd suggest that somebody's managed
to reopen CVE-2006-2313.  If we're missing nul rejection in some code
path, then we're probably not doing encoding validation at all.

			regards, tom lane