From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Egor Ivkov Date: Tue, 22 Sep 2026 22:44:05 +0300 Subject: [PATCH v2] pg_combinebackup: make the OID range check in parse_oid() effective parse_oid() assigned the result of strtoul() to an Oid variable before range-checking it, so the value had already been truncated to 32 bits by the time "oid > PG_UINT32_MAX" was evaluated. On platforms where unsigned long is wider than 32 bits that test is dead code, and an out-of-range string is accepted as its truncated value rather than being rejected: "4294967297" is accepted as OID 1. Keep the parsed value in an unsigned long until it has been checked, and cast to Oid afterwards. Also reject up front any string that does not start with a digit between 1 and 9. strtoul() accepts leading whitespace, an explicit sign and leading zeroes, for exmaple "-1": strtoul() negates rather than reporting ERANGE, so on platforms where unsigned long is only 32 bits it survives the range check too and is accepted as OID 4294967295. Checking the first character rejects all of these regardless of the width of unsigned long. Both changes mirror parse_relfilenumber() in pg_upgrade, which handles the same problem correctly. parse_oid() is only fed directory names found under pg_tblspc, so the practical consequence is limited to pg_combinebackup treating a bogus directory name as a valid tablespace OID instead of ignoring it. Both call sites go through parse_oid(), so they remain consistent with each other. --- src/bin/pg_combinebackup/pg_combinebackup.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/src/bin/pg_combinebackup/pg_combinebackup.c b/src/bin/pg_combinebackup/pg_combinebackup.c index 254a27b125b..03cc75f5728 100644 --- a/src/bin/pg_combinebackup/pg_combinebackup.c +++ b/src/bin/pg_combinebackup/pg_combinebackup.c @@ -816,15 +816,18 @@ help(const char *progname) static bool parse_oid(char *s, Oid *result) { - Oid oid; + unsigned long oid; char *ep; + if (s[0] < '1' || s[0] > '9') + return false; + errno = 0; oid = strtoul(s, &ep, 10); if (errno != 0 || *ep != '\0' || oid < 1 || oid > PG_UINT32_MAX) return false; - *result = oid; + *result = (Oid) oid; return true; } -- 2.43.0