> Neil Conway <neilc@samurai.com> writes:
> > +   /* Check for integer overflow */
> > +   if (tlen / slen != count)
> > +           elog(ERROR, "Requested buffer is too large.");
>
> What about slen == 0?

Good point -- that wouldn't cause incorrect results or a security
problem, but it would reject input that we should really accept.

Revised patch is attached.

Neil Conway