Re: BUG #16694: Server hangs in 100% CPU loop when decompressing a specific TOAST Postgis linestring

Andrey Borodin <x4mmm@yandex-team.ru> writes:
> I'm not sure protection from corrupt input is complete within pglz. We
> still do not protect from matches with offsets before source data.

Yeah, I was wondering about that.  Not quite sure it's worth adding
cycles to defend against though.  I don't buy the "security" aspect,
since there's no plausible route for an attacker to inject corrupted
compressed data unless they already have full access to the database.
The "maybe core dump" argument is a bit stronger, but not very much so.

            regards, tom lane