From: Tom Lane <tgl@sss.pgh.pa.us>
To: Roberto =?iso-8859-1?Q?C=2E_S=E1nchez?= <roberto@debian.org>
cc: pgsql-hackers@lists.postgresql.org
Subject: Re: Request for assistance to backport CVE-2022-1552 fixes to 9.6 and
 9.4
In-reply-to: <YqDIdN1nn6wS8+tZ@connexer.com>
References: <YqDIdN1nn6wS8+tZ@connexer.com>
Comments: In-reply-to Roberto =?iso-8859-1?Q?C=2E_S=E1nchez?=
 <roberto@debian.org>
	message dated "Wed, 08 Jun 2022 12:04:04 -0400"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <1740803.1654719347.1@sss.pgh.pa.us>
Content-Transfer-Encoding: quoted-printable
Date: Wed, 08 Jun 2022 16:15:47 -0400
Message-ID: <1740804.1654719347@sss.pgh.pa.us>
Archived-At: 
 <https://www.postgresql.org/message-id/1740804.1654719347%40sss.pgh.pa.us>
Precedence: bulk

Roberto =3D?iso-8859-1?Q?C=3D2E_S=3DE1nchez?=3D <roberto@debian.org> write=
s:
> I am investigating backporting the fixes for CVE-2022-1552 to 9.6 and
> 9.4 as part of Debian LTS and Extended LTS.  I am aware that these
> releases are no longer supported upstream, but I have made an attempt at
> adapting commits ef792f7856dea2576dcd9cab92b2b05fe955696b and
> f26d5702857a9c027f84850af48b0eea0f3aa15c from the REL_10_STABLE branch.
> I would appreciate a review of the attached patches and any comments on
> things that may have been missed and/or adapted improperly.

FWIW, I would not recommend being in a huge hurry to back-port those
changes, pending the outcome of this discussion:

https://www.postgresql.org/message-id/flat/f8a4105f076544c180a87ef0c482235=
2%40stmuk.bayern.de

We're going to have to tweak that code somehow, and it's not yet
entirely clear how.

			regards, tom lane