Re: Insufficient memory access checks in pglz_decompress

Tom Lane <tgl@sss.pgh.pa.us>

From: Tom Lane <tgl@sss.pgh.pa.us>
To: Flavien GUEDEZ <flav.pg@oopacity.net>
Cc: pgsql-bugs@lists.postgresql.org
Date: 2023-10-19T00:48:03Z
Lists: pgsql-bugs
Flavien GUEDEZ <flav.pg@oopacity.net> writes:
> Thanks for your feedback, you are definitely right, I did not notice 
> that (dp - off) was staying the same in the while loop.
> Here is another much smaller patch.

I thought of another thing we should change: it's better to perform
the test as "off > (dp - dest)" than the way you formulated it.
"dp - dest" is certainly computable, since it's the number of bytes
we've written to the output buffer so far.  But "dp - off" could,
with bad luck and a buffer near the start of memory, wrap around
to look like it's after "dest".

Pushed with that change and a little fiddling with the comment.
Thanks for the report!

			regards, tom lane



Commits

  1. Improve pglz_decompress's defenses against corrupt compressed data.