Re: Tightening DecodeNumberField's parsing rules

2025-05-27 Thread Robert Haas
On Tue, May 27, 2025 at 2:38 PM Tom Lane wrote: > So what I propose we do about this is to apply the attached to HEAD > and leave the back branches alone. +1. In most cases, we pride ourselves on carefully validating the input we receive and people on this list have been known to disparage other

Tightening DecodeNumberField's parsing rules

2025-05-27 Thread Tom Lane
Evgeniy Gorbanev reported to the security list that he'd found a case where timestamp_in triggered an undefined-behavior sanitizer warning, due to trying to store a float value larger than INT_MAX into an integer variable. We concluded that there's no real security issue there, it's just that the