MIME-Version: 1.0
From: Varik Matevosyan <varikmatevosyan@gmail.com>
Date: Mon, 4 May 2026 15:26:50 +0400
Message-ID: 
 <CA+bBooj48K08uKpAKyciPRdbOJ_5qCqz9nr2m2wzr8E5s102Hw@mail.gmail.com>
Subject: [PATCH] contrib/xml2: guard against signed integer overflow in
 parse_params
To: pgsql-hackers@lists.postgresql.org
Content-Type: multipart/mixed; boundary="000000000000c672990650fc3525"
Archived-At: 
 <https://www.postgresql.org/message-id/CA%2BbBooj48K08uKpAKyciPRdbOJ_5qCqz9nr2m2wzr8E5s102Hw%40mail.gmail.com>
Precedence: bulk

--000000000000c672990650fc3525
Content-Type: text/plain; charset="UTF-8"

Hi,

Small robustness fix for contrib/xml2/parse_params. The doubling
of max_params relies on signed-integer overflow wrapping to a value
that AllocSizeIsValid then rejects, which is both UB and incidental
safety.

The overflow is unreachable in current builds (text input is bounded
by MaxAllocSize, which limits nparams below the doubling threshold),
but the fix is small and matches the explicit overflow-checking
idiom used elsewhere in the tree.

Patch attached against current master.

Regards,
Varik

--000000000000c672990650fc3525
Content-Type: application/octet-stream;
	name="0001-contrib-xml2-guard-against-signed-integer-overflow-i.patch"
Content-Disposition: attachment;
	filename="0001-contrib-xml2-guard-against-signed-integer-overflow-i.patch"
Content-Transfer-Encoding: base64
Content-ID: <f_mor430t80>
X-Attachment-Id: f_mor430t80

RnJvbSBlZjEyMTlhN2U5NzUyNWE0MmEyMWJjMjdmOTgyZmQ5ZTJlOWEyYzMwIE1vbiBTZXAgMTcg
MDA6MDA6MDAgMjAwMQpGcm9tOiBWYXJpayBNYXRldm9zeWFuIDx2YXJpa21hdGV2b3N5YW5AZ21h
aWwuY29tPgpEYXRlOiBNb24sIDQgTWF5IDIwMjYgMTA6NTM6MDUgKzAwMDAKU3ViamVjdDogW1BB
VENIXSBjb250cmliL3htbDI6IGd1YXJkIGFnYWluc3Qgc2lnbmVkIGludGVnZXIgb3ZlcmZsb3cg
aW4KIHBhcnNlX3BhcmFtcwoKVGhlIGRvdWJsaW5nIG9mIG1heF9wYXJhbXMgaW4gcGFyc2VfcGFy
YW1zIHJlbGllcyBvbiBzaWduZWQgaW50ZWdlcgpvdmVyZmxvdyB0byB3cmFwIHRvIGEgbmVnYXRp
dmUgdmFsdWUgdGhhdCBBbGxvY1NpemVJc1ZhbGlkIHRoZW4KcmVqZWN0cywgcHJvZHVjaW5nIGEg
Y2xlYW4gZXJlcG9ydC4gVGhpcyBpcyBpbmNpZGVudGFsIHNhZmV0eToKc2lnbmVkIG92ZXJmbG93
IGlzIHVuZGVmaW5lZCBwZXIgdGhlIEMgc3RhbmRhcmQsIGFuZCB0aGUgZ3JhY2VmdWwKRVJST1Ig
ZGVwZW5kcyBvbiB0aGUgd3JhcHBlZCB2YWx1ZSBmYWxsaW5nIG91dHNpZGUgTWF4QWxsb2NTaXpl
CmFmdGVyIHByb21vdGlvbiB0byBzaXplX3QuCgpJbiBjdXJyZW50IGJ1aWxkcyB0aGUgb3ZlcmZs
b3cgaXMgdW5yZWFjaGFibGUsIHNpbmNlIHRleHQgaW5wdXQgaXMKYm91bmRlZCBieSBNYXhBbGxv
Y1NpemUgYW5kIHRoYXQgbGltaXRzIG5wYXJhbXMgYmVsb3cgdGhlIGRvdWJsaW5nCnRocmVzaG9s
ZC4gR3VhcmQgdGhlIG11bHRpcGxpY2F0aW9uIGFueXdheSwgbWF0Y2hpbmcgdGhlIGV4cGxpY2l0
Cm92ZXJmbG93LWNoZWNraW5nIGlkaW9tIHVzZWQgZWxzZXdoZXJlIGluIHRoZSB0cmVlLgotLS0K
IGNvbnRyaWIveG1sMi94c2x0X3Byb2MuYyB8IDkgKysrKysrKystCiAxIGZpbGUgY2hhbmdlZCwg
OCBpbnNlcnRpb25zKCspLCAxIGRlbGV0aW9uKC0pCgpkaWZmIC0tZ2l0IGEvY29udHJpYi94bWwy
L3hzbHRfcHJvYy5jIGIvY29udHJpYi94bWwyL3hzbHRfcHJvYy5jCmluZGV4IDhjZWI4YzQ2NDk0
Li4zOTExNjExODY2MyAxMDA2NDQKLS0tIGEvY29udHJpYi94bWwyL3hzbHRfcHJvYy5jCisrKyBi
L2NvbnRyaWIveG1sMi94c2x0X3Byb2MuYwpAQCAtNyw2ICs3LDcgQEAKICAqLwogI2luY2x1ZGUg
InBvc3RncmVzLmgiCiAKKyNpbmNsdWRlICJjb21tb24vaW50LmgiCiAjaW5jbHVkZSAiZm1nci5o
IgogI2luY2x1ZGUgInV0aWxzL2J1aWx0aW5zLmgiCiAjaW5jbHVkZSAidXRpbHMveG1sLmgiCkBA
IC0yMTYsNiArMjE3LDcgQEAgcGFyc2VfcGFyYW1zKHRleHQgKnBhcmFtc3RyKQogCWNoYXIJICAg
Kml0c2VwID0gIiwiOwogCWNvbnN0IGNoYXIgKipwYXJhbXM7CiAJaW50CQkJbWF4X3BhcmFtczsK
KwlpbnQJCQluZXdfbWF4X3BhcmFtczsKIAlpbnQJCQlucGFyYW1zOwogCiAJcHN0ciA9IHRleHRf
dG9fY3N0cmluZyhwYXJhbXN0cik7CkBAIC0yMzAsNyArMjMyLDEyIEBAIHBhcnNlX3BhcmFtcyh0
ZXh0ICpwYXJhbXN0cikKIAl7CiAJCWlmIChucGFyYW1zID49IG1heF9wYXJhbXMpCiAJCXsKLQkJ
CW1heF9wYXJhbXMgKj0gMjsKKwkJCWlmIChwZ19tdWxfczMyX292ZXJmbG93KG1heF9wYXJhbXMs
IDIsICZuZXdfbWF4X3BhcmFtcykpCisJCQkJZXJlcG9ydChFUlJPUiwKKwkJCQkJCShlcnJjb2Rl
KEVSUkNPREVfUFJPR1JBTV9MSU1JVF9FWENFRURFRCksCisJCQkJCQkgZXJybXNnKCJ0b28gbWFu
eSBYU0xUIHBhcmFtZXRlcnMiKSkpOworCisJCQltYXhfcGFyYW1zID0gbmV3X21heF9wYXJhbXM7
CiAJCQlwYXJhbXMgPSAoY29uc3QgY2hhciAqKikgcmVwYWxsb2MocGFyYW1zLAogCQkJCQkJCQkJ
CQkgIChtYXhfcGFyYW1zICsgMSkgKiBzaXplb2YoY2hhciAqKSk7CiAJCX0KLS0gCjIuNDMuMAoK
--000000000000c672990650fc3525--