From 986bd5b1b91abe12e1769508591d7c8983150e5e Mon Sep 17 00:00:00 2001
From: Ayush Tiwari <ayushtiwari.slg01@gmail.com>
Date: Wed, 5 Aug 2026 10:23:15 +0530
Subject: [PATCH] Reject out-of-range LSNs in backup manifests

parse_xlogrecptr() used sscanf() with "%X" to read each half of an LSN
into a uint32.  A half wider than 32 bits was therefore accepted with its
high-order bits silently discarded, and trailing garbage after the LSN
was ignored, because sscanf() still reported two successful conversions.
Genuinely unparseable values were rejected, so the difference went
unnoticed.

The resulting value is used to validate the WAL ranges of a backup, both
by pg_verifybackup and pg_combinebackup and, via UPLOAD_MANIFEST, by the
server when taking an incremental backup.  Those checks were therefore
performed against a location the manifest did not actually specify.

Require each half to consist of one to eight hexadecimal digits and the
whole string to be consumed, matching the rules of the pg_lsn input
function, and add tests.

Commit 355814931141 tightened the other scalar values of a manifest in
the same way, but did not touch this one.
---
 src/bin/pg_verifybackup/t/005_bad_manifest.pl | 12 +++++++++++
 src/common/parse_manifest.c                   | 21 ++++++++++++++++++-
 2 files changed, 32 insertions(+), 1 deletion(-)

diff --git a/src/bin/pg_verifybackup/t/005_bad_manifest.pl b/src/bin/pg_verifybackup/t/005_bad_manifest.pl
index bc9fe4a79d7..6a0989ea5c3 100644
--- a/src/bin/pg_verifybackup/t/005_bad_manifest.pl
+++ b/src/bin/pg_verifybackup/t/005_bad_manifest.pl
@@ -168,6 +168,18 @@ test_parse_error('could not parse start LSN', <<EOM);
 ]}
 EOM
 
+# An LSN half wider than 32 bits, or trailing garbage, must be rejected rather
+# than silently truncated.
+for my $lsn ('123456789/0', '0/123456789', 'FFFFFFFFFFFFFFFFFFFF/0',
+	'1/2garbage', '0/', '/0')
+{
+	test_parse_error('could not parse start LSN', <<EOM);
+{"PostgreSQL-Backup-Manifest-Version": 1, "WAL-Ranges": [
+    {"Timeline": 1, "Start-LSN": "$lsn", "End-LSN": "0/0"}
+]}
+EOM
+}
+
 test_parse_error('could not parse end LSN', <<EOM);
 {"PostgreSQL-Backup-Manifest-Version": 1, "WAL-Ranges": [
     {"Timeline": 1, "Start-LSN": "0/0", "End-LSN": "oops"}
diff --git a/src/common/parse_manifest.c b/src/common/parse_manifest.c
index 337cae535f4..9f8608147a7 100644
--- a/src/common/parse_manifest.c
+++ b/src/common/parse_manifest.c
@@ -933,17 +933,36 @@ hexdecode_string(uint8 *result, char *input, int nbytes)
 	return true;
 }
 
+/* Maximum number of hexadecimal digits in each half of an LSN */
+#define MAXPG_LSNCOMPONENT	8
+
 /*
  * Parse an XLogRecPtr expressed using the usual string format.
+ *
+ * Each half must consist of one to eight hexadecimal digits, and the whole
+ * input must be consumed.  We can't use sscanf() for this, because "%X" would
+ * accept a value too large for uint32 (silently keeping only its low-order
+ * bits) as well as trailing garbage.  These are the same rules that
+ * pg_lsn_in_safe() applies to the pg_lsn data type.
  */
 static bool
 parse_xlogrecptr(XLogRecPtr *result, char *input)
 {
+	size_t		len1;
+	size_t		len2;
 	uint32		hi;
 	uint32		lo;
 
-	if (sscanf(input, "%X/%08X", &hi, &lo) != 2)
+	len1 = strspn(input, "0123456789abcdefABCDEF");
+	if (len1 < 1 || len1 > MAXPG_LSNCOMPONENT || input[len1] != '/')
 		return false;
+
+	len2 = strspn(input + len1 + 1, "0123456789abcdefABCDEF");
+	if (len2 < 1 || len2 > MAXPG_LSNCOMPONENT || input[len1 + 1 + len2] != '\0')
+		return false;
+
+	hi = (uint32) strtoul(input, NULL, 16);
+	lo = (uint32) strtoul(input + len1 + 1, NULL, 16);
 	*result = ((uint64) hi) << 32 | lo;
 	return true;
 }
-- 
2.34.1