Received: from malur.postgresql.org ([2a02:16a8:dc51::56]) by arkaria.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA384:256) (Exim 4.89) (envelope-from ) id 1fd1N1-0003dj-UV for pgsql-hackers@arkaria.postgresql.org; Tue, 10 Jul 2018 22:44:32 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.89) (envelope-from ) id 1fd1Mz-0002RM-6c for pgsql-hackers@arkaria.postgresql.org; Tue, 10 Jul 2018 22:44:29 +0000 Received: from makus.postgresql.org ([2001:4800:1501:1::229]) by malur.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA384:256) (Exim 4.89) (envelope-from ) id 1fd1My-0002RF-Fo for pgsql-hackers@lists.postgresql.org; Tue, 10 Jul 2018 22:44:28 +0000 Received: from mail-qk0-x242.google.com ([2607:f8b0:400d:c09::242]) by makus.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.89) (envelope-from ) id 1fd1Mu-0000KY-US for pgsql-hackers@lists.postgresql.org; Tue, 10 Jul 2018 22:44:27 +0000 Received: by mail-qk0-x242.google.com with SMTP id u21-v6so12512578qku.2 for ; Tue, 10 Jul 2018 15:44:24 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=2ndquadrant-com.20150623.gappssmtp.com; s=20150623; h=date:from:to:cc:subject:message-id:mime-version:content-disposition :content-transfer-encoding:in-reply-to:user-agent; bh=XdU0L1x8RFeXQtSRF3KhK6VQHTr4Rp0MROEnU1ULF8s=; b=XvY5gjVvMUit1nofU2MB6sdIO/sB5JA54MYSaKAk61UZ75lyuTGSTXExC0LMeX9rGe LlG/KBTLYqygrbnJOtMf7JKCN+iyExHFe2E+wSHYIvZM0r9N9gj19KooK9BpxsBXyB6q XLyIVXdw3HTjSMEKlc4IdiP8PJmSeRBdvV4AVNJ9VKTm0x+XQYmJZeR+yjGWoHRMkyCQ tOQtZmDmUantaBKY85nK103N0I55rP3OJz8dpPV+scDstRtsOTwptyfPvIK43R1Qeijx lF+bYm38QH/lRHXVNubv4hdnbt7fIqR77tMYpOJOkz2oEYZxnyadO8TyC+qtZdPdGlav O1hw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:from:to:cc:subject:message-id:mime-version :content-disposition:content-transfer-encoding:in-reply-to :user-agent; bh=XdU0L1x8RFeXQtSRF3KhK6VQHTr4Rp0MROEnU1ULF8s=; b=rUm6T3CGv4+efmCpvJPqaEm1Nf9ULlq1k0nD4ocKleSc9aBhvx0zwfWAlht2Zd0s6n uLqSqyDp0u2mUnLbk+ATO4QEojc9aE2Pufg3kgzvJcTEOHTaiOXJC7e/WjGSzCUJx+Or bhhEZzjPH+bjjJj1g8OwefMt+AVsqhBUAgPuIB8CRACM2QSQX5Om+URWUTzU8Sc2Ct6B 0NWErXbOEzF/5nvzG59F0YY7EHUoUj7b4SWOzrkdBxUEgixjYEoA9uZeE1A78VmThwya WgsSOInf3Rk0jdS8zMJohFQoCkogxqibES6GJNYxYk73MUiQNqYmKx+X1bQ3DC1ftdue zfHg== X-Gm-Message-State: APt69E1G2psl8ioiCZ2e4wvPfqk2ye9cnulaGvQPh1aMIctxrjob04Jj Jt4KY2pO++VvILqCmy85Wjyt9PuCgay9mQ+bgQFT1BpBNYhzd3dr5kRsW0JURpQtyhYK/GfrFSB pxjbsoAQisfKzEywH01mDaKYIzFf+mxuw2YX3V3LzC7/fJKHZ90sgSQeSb08cUo15bYtpyq/hss XwMuOrmr6jIpo= X-Google-Smtp-Source: AAOMgpfvm087/3rugDLIVdhzp31Im1Nj02Z9ybsryIBg0y24xlqo3a53a5Awoc259WtL4jHIfqxJjA== X-Received: by 2002:a37:151f:: with SMTP id f31-v6mr23064865qkh.388.1531262663536; Tue, 10 Jul 2018 15:44:23 -0700 (PDT) Received: from alvin.alvh.no-ip.org ([190.121.29.3]) by smtp.gmail.com with ESMTPSA id t27-v6sm13836301qkl.11.2018.07.10.15.44.22 (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Tue, 10 Jul 2018 15:44:23 -0700 (PDT) Received: by alvin.alvh.no-ip.org (Postfix, from userid 1000) id 6AFB0D85; Tue, 10 Jul 2018 18:44:21 -0400 (-04) Date: Tue, 10 Jul 2018 18:44:21 -0400 From: Alvaro Herrera To: Tom Lane Cc: pgsql-hackers@lists.postgresql.org Subject: Re: CVE-2017-7484-induced bugs, or, btree cmp functions are not leakproof? Message-ID: <20180710224421.lnuq3aavioc7na2r@alvherre.pgsql> MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <3876.1531261875@sss.pgh.pa.us> User-Agent: NeoMutt/20170306-137-4415bd-dirty (1.8.0) List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Precedence: bulk On 2018-Jul-10, Tom Lane wrote: > I propose to run through the system operator classes, find any for which > the comparison function isn't marked leakproof but the operators are, > and fix them. This is clearly appropriate for HEAD and maybe it's not > too late to force an initdb for v11 --- thoughts? on initdb in v11, see https://postgr.es/m/CAKJS1f9cqoSKS9JVcBKGa2mdn-24YPWc9XLzFDNsmjJMUpth1w@mail.gmail.com -- Álvaro Herrera https://www.2ndQuadrant.com/ PostgreSQL Development, 24x7 Support, Remote DBA, Training & Services