exchange

commit 4b0b0b4b4049a06664b369e2d959964c62a6b858
parent fdcd67f0b3e0ca99d8d65ad85b2587faefe32580
Author: Christian Grothoff <grothoff@gnunet.org>
Date:   Sun, 16 Aug 2026 08:36:08 +0200

sanity-check header.dim

Diffstat:
M
src/pq/pq_result_helper.c
 | 
6
++++++

1 file changed, 6 insertions(+), 0 deletions(-)
diff --git a/src/pq/pq_result_helper.c b/src/pq/pq_result_helper.c
@@ -1227,6 +1227,12 @@ extract_array_generic (
     FAIL_IF (0 != header.has_null);
     FAIL_IF (1 != header.lbound);
     FAIL_IF (info->oid != header.oid);
+    /* Cross-check the claimed number of elements against the
+       size of the payload: each element is at least prefixed by
+       its own 32-bit length.  Without this, a corrupted row can
+       make us allocate an absurd amount of memory. */
+    FAIL_IF (header.dim >
+             ((size_t) data_sz - sizeof (header)) / sizeof (uint32_t));
   }
 
   if (NULL != info->num)