> On Nov 11, 2026, at 14:46, Fujii Masao <[email protected]> wrote: > > On Tue, Nov 10, 2026 at 5:57 PM Chao Li <[email protected]> wrote: >> So 0002 also looks good to me. > > Both patches look good to me too. > We should backpatch them to all supported versions?
I think that would be great. > > BTW, there seem similar missing column-count checks in BaseBackup() > in pg_basebackup.c: > > - The backup start and end position results are checked for one row, > but not for at least one column, before passing column 0 to strlcpy(). > - The tablespace header is checked for rows, but not for at least > three columns, before passing column 2 to atoll(). > > Malformed responses could therefore cause NULL dereferences here too. > We should fix these separately? > I just checked BaseBackup(). There are 3 places to add the check. How about the attached fix? After adding the column count check, we need to change the original error message in form of “got %d rows and %d fields, expected %d rows and %d fields”. Best regards, -- Chao Li (Evan) HighGo Software Co., Ltd. https://www.highgo.com/
nocfbot_basebackup.diff
Description: Binary data
