Re: pgxml bug (crash) in xslt_proc.c

Mark Simonetti <marks(at)opalsoftware(dot)co(dot)uk> writes:
> I think I've found a bug in xslt_proc.c in the pgxml contrib module that
> I've also fixed. It is a serious bug as it crashes the entire database
> backend. Do I just describe it here, or is there somewhere else to
> report that, or is there a way for me to submit the actual bug fix?

If you want you can report it to pgsql-security at postgresql.org
instead of the regular bugs list. We'd probably only treat it as
a security issue if the bug seems exploitable for more than a mere
crash (eg, if it could lead to privilege escalation or arbitrary
code execution). If you're not sure about the possible consequences
probably best to let the -security list see it first.

Whichever way you report it, please include your proposed fix along
with the bug report.

regards, tom lane