leerho opened a new pull request, #80: URL: https://github.com/apache/datasketches-postgresql/pull/80
Moves the bundled C++ core library from 5.2.0 to 5.3.0 in `package.sh` (`CORETAG`) and the `Dockerfile` (`DATASKETCHES_CPP_VERSION`). ### Why C++ 5.3.0 fixes five vulnerabilities in sketch deserialization (https://datasketches.apache.org/docs/Community/Security.html). Three of them are in sketches this extension exposes: - CVE-2026-103501: heap buffer overflow in HLL sketch deserialization - CVE-2026-103513: out-of-bounds read and write in CPC sketch deserialization - CVE-2026-103635: out-of-bounds read in compact Theta sketch deserialization The extension deserializes these sketches from `bytea` values, inside the PostgreSQL server process. Any user who can run a query can pass a crafted value, so the released extension (1.7.0, bundling C++ 5.0.0) is affected. A 1.8.0 release built on this change would fix it. ### Dockerfile hash `DATASKETCHES_CPP_HASH` was still the value from when the Dockerfile was added in 2020. It did not match the 5.2.0 source zip (whose SHA-1 is `ee7ab0cd…`), so the Docker build's `sha1sum -c` step failed. It is now `e19d4357d938da8ce109ffbd3d47c25fc950a518`, the SHA-1 of `apache-datasketches-cpp-5.3.0-src.zip` on downloads.apache.org (it matches the signed release artifact). ### Testing The extension compiles cleanly on macOS against the 5.3.0 source release with PostgreSQL 14. I did not run the SQL tests locally; CI builds against datasketches-cpp master, which contains 5.3.0. The C++ API changes in 5.3.0 that broke the Python bindings (`update_theta_sketch::compact` and `hll_sketch::reset` gained a defaulted parameter) do not affect this code, which calls those functions directly. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
