Horton

Re: Insufficient memory access checks in pglz_decompress

Flavien GUEDEZ <flav.pg@oopacity.net>

View thread View on postgr.es
From: Flavien GUEDEZ <flav.pg@oopacity.net>
To: pgsql-bugs@lists.postgresql.org
Date: 2023-10-19T07:05:17Z
Lists: pgsql-bugs 
Le 19/10/2023 à 02:48, Tom Lane a écrit :
> I thought of another thing we should change: it's better to perform
> the test as "off > (dp - dest)" than the way you formulated it.
> "dp - dest" is certainly computable, since it's the number of bytes
> we've written to the output buffer so far.  But "dp - off" could,
> with bad luck and a buffer near the start of memory, wrap around
> to look like it's after "dest".
>
> Pushed with that change and a little fiddling with the comment.
> Thanks for the report!
>
> 			regards, tom lane
Thank you for the details !
Best,
Flavien

Commits

  1. Improve pglz_decompress's defenses against corrupt compressed data.