jrgemignani commented on PR #2408: URL: https://github.com/apache/age/pull/2408#issuecomment-4330728606
@sfc-gh-dachristensen I'm going to reject and close this PR as it isn't necessary - Below is from Opus 4.7, but I have also reviewed the work. Additionally, it doesn't follow our coding standards: all blocks are always wrapped with braces. While not all of our code is this way, originally, all new code is. ## Summary **Verdict: the PR is misdiagnosed and the patch is broken. Should be rejected as written.** The PR claims integer-overflow → heap-buffer-overflow via palloc size-multiplication in `agtype_util.c`. After checking each cited site against the source, the conclusion is: 1. **The vulnerabilities described are not reachable** — pre-existing guards block them. 2. **The patch as posted does not compile.** 3. **Some checks the patch adds are dead code.** 4. **Several sites the description mentions are not actually patched in the diff.** 5. **Where the patch is correct, it is hardening, not a fix.** -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
