Re: pgxml bug (crash) in xslt_proc.c

Mark Simonetti <marks@opalsoftware.co.uk> writes:
> I think I've found a bug in xslt_proc.c in the pgxml contrib module that
> I've also fixed.  It is a serious bug as it crashes the entire database
> backend.  Do I just describe it here, or is there somewhere else to
> report that, or is there a way for me to submit the actual bug fix?

If you want you can report it to pgsql-security at postgresql.org
instead of the regular bugs list.  We'd probably only treat it as
a security issue if the bug seems exploitable for more than a mere
crash (eg, if it could lead to privilege escalation or arbitrary
code execution).  If you're not sure about the possible consequences
probably best to let the -security list see it first.

Whichever way you report it, please include your proposed fix along
with the bug report.

            regards, tom lane