pqexpbuffer.c. While a client-side failure doesn't seem like a security issue, it's still a bug.
Attach a file by drag & drop or click to upload