Accepting request 1247461 from server:database:postgresql

- Upgrade to 13.20:
  * Improve behavior of libpq's quoting functions:
    The changes made for CVE-2025-1094 had one serious oversight:
    PQescapeLiteral() and PQescapeIdentifier() failed to honor
    their string length parameter, instead always reading to the
    input string's trailing null. This resulted in including
    unwanted text in the output, if the caller intended to
    truncate the string via the length parameter. With very bad
    luck it could cause a crash due to reading off the end of
    memory.
    In addition, modify all these quoting functions so that when
    invalid encoding is detected, an invalid sequence is
    substituted for just the first byte of the presumed
    character, not all of it. This reduces the risk of problems
    if a calling application performs additional processing on
    the quoted string.
  * Fix small memory leak in pg_createsubscriber.
  * https://www.postgresql.org/docs/release/13.20/
  * https://www.postgresql.org/about/news/p-3018/

OBS-URL: https://build.opensuse.org/request/show/1247461
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/postgresql13?expand=0&rev=35

postgresql-13.19.tar.bz2

@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:482cce0a9f8d24c2447cfc7b2817e55f86d51afe5f7f1a85214bf93644e774ea
-size 21729020

postgresql-13.19.tar.bz2.sha256

@@ -1 +0,0 @@
-482cce0a9f8d24c2447cfc7b2817e55f86d51afe5f7f1a85214bf93644e774ea  postgresql-13.19.tar.bz2

postgresql-13.20.tar.bz2.sha256

@@ -0,0 +1 @@
+8134b685724d15e60d93bea206fbe0f14c8295e84f1cc91d5a3928163e4fb288  postgresql-13.20.tar.bz2

postgresql13.changes

@@ -1,3 +1,26 @@
+-------------------------------------------------------------------
+Tue Feb 18 11:36:44 UTC 2025 - Reinhard Max <max@suse.com>
+
+- Upgrade to 13.20:
+  * Improve behavior of libpq's quoting functions:
+    The changes made for CVE-2025-1094 had one serious oversight:
+    PQescapeLiteral() and PQescapeIdentifier() failed to honor
+    their string length parameter, instead always reading to the
+    input string's trailing null. This resulted in including
+    unwanted text in the output, if the caller intended to
+    truncate the string via the length parameter. With very bad
+    luck it could cause a crash due to reading off the end of
+    memory.
+    In addition, modify all these quoting functions so that when
+    invalid encoding is detected, an invalid sequence is
+    substituted for just the first byte of the presumed
+    character, not all of it. This reduces the risk of problems
+    if a calling application performs additional processing on
+    the quoted string.
+  * Fix small memory leak in pg_createsubscriber.
+  * https://www.postgresql.org/docs/release/13.20/
+  * https://www.postgresql.org/about/news/p-3018/
+
 -------------------------------------------------------------------
 Tue Feb 11 14:27:58 UTC 2025 - Reinhard Max <max@suse.com>
 

postgresql13.spec

@@ -16,7 +16,7 @@
 #
 
 
-%define pgversion 13.19
+%define pgversion 13.20
 %define pgmajor 13
 %define buildlibs 0
 %define tarversion %{pgversion}