Feedback-ID: i0fe9450f:Fastmail
Date: Mon, 11 May 2026 15:35:50 +0900
From: Michael Paquier <michael@paquier.xyz>
To: Postgres hackers <pgsql-hackers@lists.postgresql.org>
Cc: Andrew Dunstan <andrew@dunslane.net>
Subject: Plug-in coverage hole for pglz_decompress()
Message-ID: <agF4xkIdRcrCIprs@paquier.xyz>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="fIcYR/S1JVdRCjOT"
Content-Disposition: inline
Archived-At: 
 <https://www.postgresql.org/message-id/agF4xkIdRcrCIprs%40paquier.xyz>
Precedence: bulk


--fIcYR/S1JVdRCjOT
Content-Type: multipart/mixed; boundary="svOz4+RxsXW240wN"
Content-Disposition: inline


--svOz4+RxsXW240wN
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

Hi all,
(Andrew in CC, in case.)

While doing a post-commit review of 67d318e70402, I have noticed the
following coverage hole in pglz_decompress(), where a failure of this
check is not covered, see also [1]:
    if (unlikely(off == 0 ||
                 off > (dp - (unsigned char *) dest)))
        return -1;

This can be triggered easily with the two following sequences in the
regression tests:
SELECT test_pglz_decompress('\x011001'::bytea, 1024, true);
SELECT test_pglz_decompress('\x010300'::bytea, 1024, true);

It's unfortunately too late for this round of minor releases, but I'd
like to fix this hole once the next minor versions are tagged, down to
v14.  If there are any objections or comments, feel free.  Mea culpa.

Thanks,

[1]: https://coverage.postgresql.org/src/common/pg_lzcompress.c.gcov.html
--
Michael

--svOz4+RxsXW240wN
Content-Type: text/plain; charset=us-ascii
Content-Disposition: attachment;
	filename=0001-Add-more-tests-for-corrupted-data-in-pglz_decompress.patch
Content-Transfer-Encoding: quoted-printable

=46rom 4a63b443e241e98df27489ac04291822f4a56bc5 Mon Sep 17 00:00:00 2001
=46rom: Michael Paquier <michael@paquier.xyz>
Date: Mon, 11 May 2026 15:21:30 +0900
Subject: [PATCH] Add more tests for corrupted data in pglz_decompress()

Two cases fixed by 2b5ba2a0a141 were not covered, emulating corrupted
data:
- Set control bit with a valid 2-byte match tag where offset is 0.
- Set control bit with a valid 2-byte match tag where offset exceeds
output written.

Oversight in 67d318e70402.

Backpatch-through: 14
---
 src/test/regress/expected/compression_pglz.out | 12 ++++++++++++
 src/test/regress/sql/compression_pglz.sql      | 10 ++++++++++
 2 files changed, 22 insertions(+)

diff --git a/src/test/regress/expected/compression_pglz.out b/src/test/regr=
ess/expected/compression_pglz.out
index 0ef49d425068..066a3317c65d 100644
--- a/src/test/regress/expected/compression_pglz.out
+++ b/src/test/regress/expected/compression_pglz.out
@@ -60,6 +60,18 @@ SELECT test_pglz_decompress('\x010f01'::bytea, 1024, fal=
se);
 ERROR:  pglz_decompress failed
 SELECT test_pglz_decompress('\x010f01'::bytea, 1024, true);
 ERROR:  pglz_decompress failed
+-- Corrupted compressed data.  Set control bit with a valid 2-byte match
+-- tag where offset exceeds output written.
+SELECT test_pglz_decompress('\x011001'::bytea, 1024, false);
+ERROR:  pglz_decompress failed
+SELECT test_pglz_decompress('\x011001'::bytea, 1024, true);
+ERROR:  pglz_decompress failed
+-- Corrupted compressed data.  Set control bit with a valid 2-byte match
+-- tag where offset is 0.
+SELECT test_pglz_decompress('\x010300'::bytea, 1024, false);
+ERROR:  pglz_decompress failed
+SELECT test_pglz_decompress('\x010300'::bytea, 1024, true);
+ERROR:  pglz_decompress failed
 -- Clean up
 DROP FUNCTION test_pglz_compress;
 DROP FUNCTION test_pglz_decompress;
diff --git a/src/test/regress/sql/compression_pglz.sql b/src/test/regress/s=
ql/compression_pglz.sql
index a44af02afb7b..dbd37f7d4eb2 100644
--- a/src/test/regress/sql/compression_pglz.sql
+++ b/src/test/regress/sql/compression_pglz.sql
@@ -48,6 +48,16 @@ SELECT test_pglz_decompress('\x01ff'::bytea, 1024, true);
 SELECT test_pglz_decompress('\x010f01'::bytea, 1024, false);
 SELECT test_pglz_decompress('\x010f01'::bytea, 1024, true);
=20
+-- Corrupted compressed data.  Set control bit with a valid 2-byte match
+-- tag where offset exceeds output written.
+SELECT test_pglz_decompress('\x011001'::bytea, 1024, false);
+SELECT test_pglz_decompress('\x011001'::bytea, 1024, true);
+
+-- Corrupted compressed data.  Set control bit with a valid 2-byte match
+-- tag where offset is 0.
+SELECT test_pglz_decompress('\x010300'::bytea, 1024, false);
+SELECT test_pglz_decompress('\x010300'::bytea, 1024, true);
+
 -- Clean up
 DROP FUNCTION test_pglz_compress;
 DROP FUNCTION test_pglz_decompress;
--=20
2.54.0


--svOz4+RxsXW240wN--

--fIcYR/S1JVdRCjOT
Content-Type: application/pgp-signature; name=signature.asc

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEG72nH6vTowiyblFKnvQgOdbyQH0FAmoBeMYACgkQnvQgOdby
QH11Jg/7B92DaWTWITiLC6eJBqtclEsrHcIPIdFS/Psedon2LQ5sFcMG7MoJJkfG
i+IJtLiFGnrz7f4k7Q74idu86A4iN6ksp1BGwjGV649hlMvxtOp1aeezD+hGJO4B
1gdraurowpl/rWPj0+58wNzjKYhaAsecj93AtMQGsi4+RJIX400hXp1AuEjfx/so
EoZNQz3eUwFo+oDqcaXDgTQuc3dpC5QxDiXvu2jG+XV4DyTBs6p0gwDlYGgrTTvw
ghltMSTuBHaT8yBcAFwb1TrMsX922VHiL1mavkdYU6quf8UrUjO1hdGosfoUTHpk
CGOV0uFQbPnVxxVBt06tNlu4HJITLaJIvpFBeLfmaUR5AdjVKgQZDdUXWAvj/q/B
TBZkkutIds1iOg5J2G7Cx0gYReAs1raKS7lC8uVTNZ2nUPVRolw+/oYFz/7kNg1E
cHOs+Omp0KMprsm6Kg8Tcqntzw5rHReKp6OzAKTKuNxtZxTSxTNYkTun6MsEFAnJ
Xy4Wj7dVgeUoC3jI7gvAYWn3aRnmFlbypAgdgHRdjDerNcpIamwSBoXLrfrxbIj9
CucXsOKXeQ+2oXvGPMGxBpRIGOCOxXgpSrKHO3ceD/06bYhjGPtkHTdd2yZa5v3I
Q4nJpErIAO7p7uiL+im+cm/u3WX6fPaGXB1simzyA0WWk8ZWr6Y=
=YwwB
-----END PGP SIGNATURE-----

--fIcYR/S1JVdRCjOT--