Adding a range check on the sequence index from the publisher.

Hi all,
(CCing Amit as the committer of this feature)

This was originally reported to pgsql-security by Anthropic OSS
program but the security team considered it as a non-vuln bug since
it's a v19-beta code, and I'm reporting here on behalf of them as it's
permitted now.

The reported problem is in sequencesync.c; the sequence
synchronization worker uses an integer that came back from the
publisher as a list subscript without checking it, and then writes
through the resulting pointer.

While it's not a problem in normal cases where the publisher is a
normal PostgreSQL, it could lead to out-of-bounds writes when the
publisher is a malicious server looking like a publisher.

Other fields that we get through get_and_validate_seq_info() could
also get the wrong value but they just show the wrong values rather
than OOB writes. So I think we need a safeguard only for seqidx.

I've attached the patch to fix it. Feedback is very welcome.

Regards,

--
Masahiko Sawada
Amazon Web Services: https://aws.amazon.com