| From: | Daniel Gustafsson <daniel(at)yesql(dot)se> |
|---|---|
| To: | Masahiko Sawada <sawada(dot)mshk(at)gmail(dot)com> |
| Cc: | shihao zhong <zhong950419(at)gmail(dot)com>, imchifan(at)163(dot)com, pgsql-bugs(at)lists(dot)postgresql(dot)org |
| Subject: | Re: BUG #19702: decode() accepts Base64 payload after terminal padding |
| Date: | 2026-11-13 00:00:07 |
| Message-ID: | 4DB88D8C-D404-490B-88E7-AFBF43C69254@yesql.se |
| Views: | Whole Thread | Raw Message | Download mbox | Resend email |
| Thread: | |
| Lists: | pgsql-bugs |
> On 10 Nov 2026, at 10:23, Daniel Gustafsson <daniel(at)yesql(dot)se> wrote:
>> On 9 Nov 2026, at 23:43, Masahiko Sawada <sawada(dot)mshk(at)gmail(dot)com> wrote:
>> While I agree that we don't backpatch it to v18 or older, I think it
>> (or at least the base64url part) should go into v19 as well. v19 is
>> still in RC and base64url is new in v19, so there are no existing
>> users relying on the current behavior, and it would be better to make
>> base64url and base32hex consistent before the release.
>
> That's a good point, I'll prepare a backpatch for 19 for the relevant portions.
The attached is a patch against master for the full fix, and a cut-down version
fixing just base64url for v19, I thinmk that's what we can do for 19 at this
point. What do you think about this one?
--
Daniel Gustafsson
| Attachment | Content-Type | Size |
|---|---|---|
| v19-2-0001-Reject-invalid-base64-encoded-values-with-data.patch | application/octet-stream | 4.8 KB |
| v2-0001-Reject-invalid-base64-encoded-values-with-data-af.patch | application/octet-stream | 7.7 KB |
| From | Date | Subject | |
|---|---|---|---|
| Previous Message | Manu | 2026-11-12 23:00:40 | Re: BUG #19602: Vuln46: citext split_part silently returns NULL for a zero field position instead of raising core sp |