Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1qjp08-00CEaA-23 for pgsql-committers@arkaria.postgresql.org; Fri, 22 Sep 2023 22:51:56 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.94.2) (envelope-from ) id 1qjp06-0089uV-Dc for pgsql-committers@arkaria.postgresql.org; Fri, 22 Sep 2023 22:51:54 +0000 Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29]) by malur.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1qjp05-0089uI-UM for pgsql-committers@lists.postgresql.org; Fri, 22 Sep 2023 22:51:54 +0000 Received: from mahout.postgresql.org ([2001:4800:3e1:1::227]) by magus.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1qjozy-0070Wa-83 for pgsql-committers@lists.postgresql.org; Fri, 22 Sep 2023 22:51:53 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=postgresql.org; s=20171124; h=Date:Message-Id:Subject:To:From:MIME-Version: Content-Type:Sender:Reply-To:Cc:Content-Transfer-Encoding:Content-ID: Content-Description:In-Reply-To:References; bh=Fiv4L1lintPnaYl749wBImWnAv+TKfCCtclZtGPxlCA=; b=siRlHnHxlqedsSKlpLTlXIxCWt xGkEacVThLM1h5LQ41TJG4CiUhbbgocDTjQXfrX7/5E+gf7joFn+EQzBjLo8LRxrGrWrS2hdg1+ex GvErbiIMVg997UOrEC7Z+8e4nrR90RgiInK09WnJo7PtlfPxXYivjHGC0kk7zNRjcS9PqLcQSXlUa bEtGSzBfOxNFp1RSKMgEobjISfCcF1NPIE6k5PtvDzQB3O+cNIUB4GtANe2t2Aizpxg5fXrWnjXK3 QVNMM0FUZ1Aga+lpCIzELppyRPV/vvWXvbI/OUw8B8olI+JTbWwyfQkhlIdb7vAyV9fPPIR0cK7Ex +Yh9cEBg==; Received: from gemulon.postgresql.org ([2001:4800:3e1:1::198]) by mahout.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1qjozw-0003Fx-TB for pgsql-committers@lists.postgresql.org; Fri, 22 Sep 2023 22:51:44 +0000 Received: from localhost ([127.0.0.1] helo=gemulon.postgresql.org) by gemulon.postgresql.org with esmtp (Exim 4.94.2) (envelope-from ) id 1qjozv-005NY4-Rr for pgsql-committers@lists.postgresql.org; Fri, 22 Sep 2023 22:51:44 +0000 Content-Type: multipart/mixed; boundary="===============1548457350314774698==" MIME-Version: 1.0 From: Thomas Munro To: pgsql-committers@lists.postgresql.org Subject: pgsql: Don't trust unvalidated xl_tot_len. X-Auto-Response-Suppress: All Auto-Submitted: auto-generated Message-Id: Date: Fri, 22 Sep 2023 22:51:44 +0000 List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Archived-At: Precedence: bulk --===============1548457350314774698== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 RG9uJ3QgdHJ1c3QgdW52YWxpZGF0ZWQgeGxfdG90X2xlbi4KCnhsX3RvdF9sZW4gY29tZXMgZmly c3QgaW4gYSBXQUwgcmVjb3JkLiAgVXN1YWxseSB3ZSBkb24ndCB0cnVzdCBpdCB0byBiZQp0aGUg dHJ1ZSBsZW5ndGggdW50aWwgd2UndmUgdmFsaWRhdGVkIHRoZSByZWNvcmQgaGVhZGVyLiAgSWYg dGhlIHJlY29yZApoZWFkZXIgd2FzIHNwbGl0IGFjcm9zcyB0d28gcGFnZXMsIHByZXZpb3VzbHkg d2Ugd291bGRuJ3QgZG8gdGhlCnZhbGlkYXRpb24gdW50aWwgYWZ0ZXIgd2UnZCBhbHJlYWR5IHRy aWVkIHRvIGFsbG9jYXRlIGVub3VnaCBtZW1vcnkgdG8KaG9sZCB0aGUgcmVjb3JkLCB3aGljaCB3 YXMgYmFkIGJlY2F1c2UgaXQgbWlnaHQgYWN0dWFsbHkgYmUgZ2FyYmFnZQpieXRlcyBmcm9tIGEg cmVjeWNsZWQgV0FMIGZpbGUsIHNvIHdlIGNvdWxkIHRyeSB0byBhbGxvY2F0ZSBhIGxvdCBvZgpt ZW1vcnkuICBSZWxlYXNlIDE1IG1hZGUgaXQgd29yc2UuCgpTaW5jZSA3MGI0ZjgyYTRiNSwgd2Un ZCBhdCBsZWFzdCBnZW5lcmF0ZSBhbiBlbmQtb2YtV0FMIGNvbmRpdGlvbiBpZiB0aGUKZ2FyYmFn ZSA0IGJ5dGUgdmFsdWUgaGFwcGVuZWQgdG8gYmUgPiAxR0IsIGJ1dCB3ZSdkIHN0aWxsIHRyeSB0 bwphbGxvY2F0ZSB1cCB0byAxR0Igb2YgbWVtb3J5IGJvZ3VzbHkgb3RoZXJ3aXNlLiAgVGhhdCB3 YXMgYW4KaW1wcm92ZW1lbnQsIGJ1dCB1bmZvcnR1bmF0ZWx5IHJlbGVhc2UgMTUgdHJpZXMgdG8g YWxsb2NhdGUgYW5vdGhlcgpvYmplY3QgYmVmb3JlIHRoYXQsIHNvIHlvdSBjb3VsZCBnZXQgYSBG QVRBTCBlcnJvciBhbmQgcmVjb3ZlcnkgY291bGQKZmFpbC4KCldlIGNhbiBmaXggYm90aCB2YXJp YW50cyBvZiB0aGUgcHJvYmxlbSBtb3JlIGZ1bmRhbWVudGFsbHkgdXNpbmcKcHJlLWV4aXN0aW5n IHBhZ2UtbGV2ZWwgdmFsaWRhdGlvbiwgaWYgd2UganVzdCByZS1vcmRlciBzb21lIGxvZ2ljLgoK VGhlIG5ldyBvcmRlciBvZiBvcGVyYXRpb25zIGluIHRoZSBzcGxpdC1oZWFkZXIgY2FzZSBkZWZl cnMgYWxsIG1lbW9yeQphbGxvY2F0aW9uIGJhc2VkIG9uIHhsX3RvdF9sZW4gdW50aWwgd2UndmUg cmVhZCB0aGUgZm9sbG93aW5nIHBhZ2UuICBBdAp0aGF0IHBvaW50IHdlIGtub3cgdGhhdCBpdHMg Zmlyc3QgZmV3IGJ5dGVzIGFyZSBub3QgcmVjeWNsZWQgZGF0YSwgYnkKY2hlY2tpbmcgaXRzIHhs cF9wYWdlYWRkciwgYW5kIHRoYXQgaXRzIHhscF9yZW1fbGVuIGFncmVlcyB3aXRoCnhsX3RvdF9s ZW4gb24gdGhlIHByZWNlZGluZyBwYWdlLiAgVGhhdCBpcyBzdHJvbmcgZXZpZGVuY2UgdGhhdAp4 bF90b3RfbGVuIHdhcyB0cnVseSB0aGUgc3RhcnQgb2YgYSByZWNvcmQgdGhhdCB3YXMgbG9nZ2Vk LgoKVGhpcyBwcm9ibGVtIHdhcyBtb3N0IGxpa2VseSB0byBvY2N1ciBvbiBhIHN0YW5kYnksIGJl Y2F1c2UKd2FscmVjZWl2ZXIuYyByZWN5Y2xlcyBXQUwgZmlsZXMgd2l0aG91dCB6ZXJvaW5nIG91 dCB0cmFpbGluZyByZWdpb25zIG9mCmVhY2ggcGFnZS4gIFdlIGNvdWxkIGZpeCB0aGF0IHRvbywg YnV0IGl0IHdvdWxkbid0IHByb3RlY3QgdXMgZnJvbSByYXJlCmNyYXNoIHNjZW5hcmlvcyB3aGVy ZSB0aGUgdHJhaWxpbmcgemVyb2VzIGRvbid0IG1ha2UgaXQgdG8gZGlzay4KCldpdGggcmVsaWFi bGUgeGxfdG90X2xlbiB2YWxpZGF0aW9uIGluIHBsYWNlLCB0aGUgYW5jaWVudCBwb2xpY3kgb2YK Y29uc2lkZXJpbmcgbWFsbG9jIGZhaWx1cmUgdG8gaW5kaWNhdGUgY29ycnVwdGlvbiBhdCBlbmQt b2YtV0FMIHNlZW1zCnF1aXRlIHN1cnByaXNpbmcsIGJ1dCBjaGFuZ2luZyB0aGF0IGlzIGxlZnQg Zm9yIGxhdGVyIHdvcmsuCgpBbHNvIGluY2x1ZGVkIGlzIGEgbmV3IFRBUCB0ZXN0IHRvIGV4ZXJj aXNlIHZhcmlvdXMgY2FzZXMgb2YgZW5kLW9mLVdBTApkZXRlY3Rpb24gYnkgd3JpdGluZyBjb250 cml2ZWQgZGF0YSBpbnRvIHRoZSBXQUwgZnJvbSBQZXJsLgoKQmFjay1wYXRjaCB0byAxMi4gIFdl IGRlY2lkZWQgbm90IHRvIHB1dCB0aGlzIGNoYW5nZSBpbnRvIHRoZSBmaW5hbApyZWxlYXNlIG9m IDExLgoKQXV0aG9yOiBUaG9tYXMgTXVucm8gPHRob21hcy5tdW5yb0BnbWFpbC5jb20+CkF1dGhv cjogTWljaGFlbCBQYXF1aWVyIDxtaWNoYWVsQHBhcXVpZXIueHl6PgpSZXBvcnRlZC1ieTogQWxl eGFuZGVyIExha2hpbiA8ZXhjbHVzaW9uQGdtYWlsLmNvbT4KUmV2aWV3ZWQtYnk6IE5vYWggTWlz Y2ggPG5vYWhAbGVhZGJvYXQuY29tPiAodGhlIGlkZWEsIG5vdCB0aGUgY29kZSkKUmV2aWV3ZWQt Ynk6IE1pY2hhZWwgUGFxdWllciA8bWljaGFlbEBwYXF1aWVyLnh5ej4KUmV2aWV3ZWQtYnk6IFNl cmdlaSBLb3JuaWxvdiA8c2tAenNydi5vcmc+ClJldmlld2VkLWJ5OiBBbGV4YW5kZXIgTGFraGlu IDxleGNsdXNpb25AZ21haWwuY29tPgpEaXNjdXNzaW9uOiBodHRwczovL3Bvc3Rnci5lcy9tLzE3 OTI4LWFhOTI0MTZhNzBmZjQ0YTIlNDBwb3N0Z3Jlc3FsLm9yZwoKQnJhbmNoCi0tLS0tLQptYXN0 ZXIKCkRldGFpbHMKLS0tLS0tLQpodHRwczovL2dpdC5wb3N0Z3Jlc3FsLm9yZy9wZy9jb21taXRk aWZmL2JhZTg2OGNhZjIyMmNhMDFjNTY5YjYxMTQ2ZmMyZTM5ODQyNzEyN2EKCk1vZGlmaWVkIEZp bGVzCi0tLS0tLS0tLS0tLS0tCnNyYy9iYWNrZW5kL2FjY2Vzcy90cmFuc2FtL3hsb2dyZWFkZXIu YyB8IDEyMyArKysrKy0tLS0Kc3JjL3Rlc3QvcGVybC9Qb3N0Z3JlU1FML1Rlc3QvVXRpbHMucG0g IHwgIDQxICsrKwpzcmMvdGVzdC9yZWNvdmVyeS9tZXNvbi5idWlsZCAgICAgICAgICAgfCAgIDEg KwpzcmMvdGVzdC9yZWNvdmVyeS90LzAzOV9lbmRfb2Zfd2FsLnBsICAgfCA0NjAgKysrKysrKysr KysrKysrKysrKysrKysrKysrKysrKysKNCBmaWxlcyBjaGFuZ2VkLCA1NjkgaW5zZXJ0aW9ucygr KSwgNTYgZGVsZXRpb25zKC0pCgo= --===============1548457350314774698==--