Re: Found a buffer-overflow defect in asynchronous database connection API PQconnectPoll

Thanks a lot

> On 23-Jun-2021, at 11:33 PM, Tom Lane <tgl@sss.pgh.pa.us> wrote:
> 
> I wrote:
>> Hmph.  I can't reproduce this on RHEL8: so far as I can tell, the string
>> is physically null-terminated, and clang's address sanitizer doesn't
>> complain either.  Still, given the vagueness of the spec for
>> gss_display_status, it seems wise to not assume that every GSS
>> implementation acts the same.
> 
> I've committed fixes to make our code rely on the returned length
> field instead.  Hopefully that won't expose any new bugs in other
> GSS implementations :-(
> 
>             regards, tom lane