Re: Insufficient memory access checks in pglz_decompress
Tom Lane <tgl@sss.pgh.pa.us>
From: Tom Lane <tgl@sss.pgh.pa.us>
To: Flavien GUEDEZ <flav.pg@oopacity.net>
Cc: pgsql-bugs@lists.postgresql.org
Date: 2023-10-19T00:48:03Z
Lists: pgsql-bugs
Flavien GUEDEZ <flav.pg@oopacity.net> writes: > Thanks for your feedback, you are definitely right, I did not notice > that (dp - off) was staying the same in the while loop. > Here is another much smaller patch. I thought of another thing we should change: it's better to perform the test as "off > (dp - dest)" than the way you formulated it. "dp - dest" is certainly computable, since it's the number of bytes we've written to the output buffer so far. But "dp - off" could, with bad luck and a buffer near the start of memory, wrap around to look like it's after "dest". Pushed with that change and a little fiddling with the comment. Thanks for the report! regards, tom lane
Commits
-
Improve pglz_decompress's defenses against corrupt compressed data.
- 9b103f861ea9 17.0 landed
- cfa4eba02c87 16.1 landed
- 985ac5ce292a 15.5 landed
- 817669ea27c4 13.13 landed
- 2c63dc0356b3 14.10 landed