Feedback-ID: i0fe9450f:Fastmail
Date: Sun, 12 Apr 2026 20:47:10 +0900
From: Michael Paquier <michael@paquier.xyz>
To: Alexander Lakhin <exclusion@gmail.com>
Cc: John Naylor <johncnaylorls@gmail.com>,
	Postgres hackers <pgsql-hackers@lists.postgresql.org>
Subject: Re: Non-compliant SASLprep implementation for ASCII characters
Message-ID: <aduGPnmDabfEKENJ@paquier.xyz>
References: <aaEJ-El2seZHeFcG@paquier.xyz>
 <CANWCAZbgyvx66qfngNvW0n+uEv3=Bak1X5GLPr4sZApuHDPV-g@mail.gmail.com>
 <abt60Gcc4drBlY1N@paquier.xyz>
 <09df9d75-13e7-45fe-89af-33fe118e797b@gmail.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="SExyRugIOR8XTpfp"
Content-Disposition: inline
In-Reply-To: <09df9d75-13e7-45fe-89af-33fe118e797b@gmail.com>
Archived-At: 
 <https://www.postgresql.org/message-id/aduGPnmDabfEKENJ%40paquier.xyz>
Precedence: bulk


--SExyRugIOR8XTpfp
Content-Type: multipart/mixed; boundary="fWquZpxsE0UPsxSZ"
Content-Disposition: inline


--fWquZpxsE0UPsxSZ
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

On Sun, Apr 12, 2026 at 09:00:00AM +0300, Alexander Lakhin wrote:
> That is, strlcpy() tries to evaluate strlen() for src, which contains only
> one byte without null terminator.

Thanks for the report.  I don't know why skink is not complaining, but
I do see the failure, and I am able to fix it with the attached.  Does
it work on your side?
--
Michael

--fWquZpxsE0UPsxSZ
Content-Type: text/plain; charset=us-ascii
Content-Disposition: attachment; filename=saslprep-test.patch
Content-Transfer-Encoding: quoted-printable

diff --git a/src/test/modules/test_saslprep/test_saslprep.c b/src/test/modu=
les/test_saslprep/test_saslprep.c
index 70ff7069bf70..121212d4fa21 100644
--- a/src/test/modules/test_saslprep/test_saslprep.c
+++ b/src/test/modules/test_saslprep/test_saslprep.c
@@ -84,7 +84,8 @@ test_saslprep(PG_FUNCTION_ARGS)
 	 * Copy the input given, to make SASLprep() act on a sanitized string.
 	 */
 	input_data =3D palloc0(src_len + 1);
-	strlcpy(input_data, src, src_len + 1);
+	memcpy(input_data, src, src_len);
+	input_data[src_len] =3D '\0';
=20
 	rc =3D pg_saslprep(input_data, &result);
 	status =3D saslprep_status_to_text(rc);

--fWquZpxsE0UPsxSZ--

--SExyRugIOR8XTpfp
Content-Type: application/pgp-signature; name=signature.asc

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEG72nH6vTowiyblFKnvQgOdbyQH0FAmnbhj4ACgkQnvQgOdby
QH1PKhAAlu9aA9GxgmSJb1oiGB1KtKLk0VwQr8rFCm52QV5BkYhwjrPETSUTs8JS
6pq8DW8QVPr+wwL8pYmnHaOSPLf/KjADwgB9dEGTa+RWlmpptdCrsVDHfaE2hAdc
MolHR1OOP+xVa+jptqOBywIn2V7EycBh5STmwbTi3mVBt4YHUP7IcIq2+BgyPFVM
4cBNh4LEvqMTCbPj5eqDW1+D4f68cQ3dztW+pfNqNzEWTEsCDv/z3lb8YDQbBT47
uGKVo10YHrEEGzoVl0q35gVIdUySO4uNEZ2SbkEEk99rEp+4Lu3EHO4uwXurFzmO
RlacJFrso0pQj8O3MUV49KaYOYP/FJMzGhqpPOmRfQQYbLVE3NPeJO8KoN0AAn7j
bvrQypgY1nQWYe8nw3JU9PUuB3+9N46dYD8pH494LephYK/xavc+ZuNIDEWTQ2X0
NdlDiLksyEjPURU9V3wpCyGEF/WXzb2/qyK7Z1eQ9FwlNOfUgA21GshpS/Jf/+S6
1/07ju6SJ9ULrduy2RUtetAgIdRDrKICDoZ4C0zFKpSk9uleDlnMujCmoLovHqY7
elGUslsL3YpEqc4bkRYC/xY8Ua66ljt+qz9Yr+vtEfTir+W69NB9aTogA03j7yLZ
PiikVBaQ/WCNCGwsfy3Sqz85BXd3ssARUMZFFJYPjag8Mp0Ejio=
=NH5R
-----END PGP SIGNATURE-----

--SExyRugIOR8XTpfp--