[PATCH] contrib/xml2: guard against signed integer overflow in parse_params - Mailing list pgsql-hackers

From Varik Matevosyan
Subject [PATCH] contrib/xml2: guard against signed integer overflow in parse_params
Date
Msg-id CA+bBooj48K08uKpAKyciPRdbOJ_5qCqz9nr2m2wzr8E5s102Hw@mail.gmail.com
Whole thread
Responses Re: [PATCH] contrib/xml2: guard against signed integer overflow in parse_params
List pgsql-hackers
Hi,

Small robustness fix for contrib/xml2/parse_params. The doubling
of max_params relies on signed-integer overflow wrapping to a value
that AllocSizeIsValid then rejects, which is both UB and incidental
safety.

The overflow is unreachable in current builds (text input is bounded
by MaxAllocSize, which limits nparams below the doubling threshold),
but the fix is small and matches the explicit overflow-checking
idiom used elsewhere in the tree.

Patch attached against current master.

Regards,
Varik

Attachment

pgsql-hackers by date:

Previous
From: Jim Jones
Date:
Subject: Re: ALTER TABLE: warn when actions do not recurse to partitions
Next
From: Amit Kapila
Date:
Subject: Re: Proposal: Conflict log history table for Logical Replication