Re: BUG #19702: decode() accepts Base64 payload after terminal padding

From: Daniel Gustafsson <daniel(at)yesql(dot)se>
To: Masahiko Sawada <sawada(dot)mshk(at)gmail(dot)com>
Cc: shihao zhong <zhong950419(at)gmail(dot)com>, imchifan(at)163(dot)com, pgsql-bugs(at)lists(dot)postgresql(dot)org
Subject: Re: BUG #19702: decode() accepts Base64 payload after terminal padding
Date: 2026-11-13 00:00:07
Message-ID: 4DB88D8C-D404-490B-88E7-AFBF43C69254@yesql.se
Views: Whole Thread | Raw Message | Download mbox | Resend email
Thread:
Lists: pgsql-bugs

> On 10 Nov 2026, at 10:23, Daniel Gustafsson <daniel(at)yesql(dot)se> wrote:
>> On 9 Nov 2026, at 23:43, Masahiko Sawada <sawada(dot)mshk(at)gmail(dot)com> wrote:

>> While I agree that we don't backpatch it to v18 or older, I think it
>> (or at least the base64url part) should go into v19 as well. v19 is
>> still in RC and base64url is new in v19, so there are no existing
>> users relying on the current behavior, and it would be better to make
>> base64url and base32hex consistent before the release.
>
> That's a good point, I'll prepare a backpatch for 19 for the relevant portions.

The attached is a patch against master for the full fix, and a cut-down version
fixing just base64url for v19, I thinmk that's what we can do for 19 at this
point. What do you think about this one?

--
Daniel Gustafsson

Attachment Content-Type Size
v19-2-0001-Reject-invalid-base64-encoded-values-with-data.patch application/octet-stream 4.8 KB
v2-0001-Reject-invalid-base64-encoded-values-with-data-af.patch application/octet-stream 7.7 KB

In response to

Browse pgsql-bugs by date

  From Date Subject
Previous Message Manu 2026-11-12 23:00:40 Re: BUG #19602: Vuln46: citext split_part silently returns NULL for a zero field position instead of raising core sp