Re: Fix out-of-bounds in the function GetCommandTagName

From: Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us>
To: David Rowley <dgrowleyml(at)gmail(dot)com>
Cc: Ranier Vilela <ranier(dot)vf(at)gmail(dot)com>, Pg Hackers <pgsql-hackers(at)postgresql(dot)org>
Subject: Re: Fix out-of-bounds in the function GetCommandTagName
Date: 2024-05-13 17:38:16
Message-ID: 767885.1715621896@sss.pgh.pa.us
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-hackers

David Rowley <dgrowleyml(at)gmail(dot)com> writes:
> I've added a CF entry under your name for this:
> https://commitfest.postgresql.org/48/4927/

> If it was code new to PG17 I'd be inclined to go ahead with it now,
> but it does not seem to align with making the release mode stable.
> I'd bet others will feel differently about that. Delaying seems a
> better default choice at least.

The security team's Coverity instance has started to show this
complaint now too. So I'm going to go ahead and push this change
in HEAD. It's probably unwise to change it in stable branches,
since there's at least a small chance some external code is using
COMMAND_TAG_NEXTTAG for the same purpose tag_behavior[] does.
But we aren't anywhere near declaring v17's API stable, so
I'd rather fix the issue than dismiss it in HEAD.

regards, tom lane

In response to

Responses

Browse pgsql-hackers by date

  From Date Subject
Next Message Jelte Fennema-Nio 2024-05-13 17:41:58 Re: Direct SSL connection with ALPN and HBA rules
Previous Message Tom Lane 2024-05-13 17:14:35 Re: Allowing additional commas between columns, and at the end of the SELECT clause