pgpool2.git / summary / log / commit / refs

commit    07ade8764324012d52cfe177d2a2a2544caba29d
Author:   Taiki Koshino <koshino@sraoss.co.jp>
Date:     Sun Sep 20 03:37:43 2026 +0000

    Reject node count larger than MAX_NUM_BACKENDS in parse_wd_node_function_json.
    
    parse_wd_node_function_json() in src/watchdog/wd_json_data.c parses a
    peer-supplied NodeCount and a NodeIdList array out of a watchdog JSON
    message and palloc()s an int array of node_count entries to populate.
    The downstream consumer degenerate_backend_set_ex() in
    src/main/pool_internal_comms.c declares
    
        int node_id[MAX_NUM_BACKENDS];
    
    (128 ints, 512 bytes) on the stack and copies up to node_count entries
    into it. A peer that sets NodeCount above MAX_NUM_BACKENDS therefore
    writes past the stack buffer in the failover-command path, which is
    reachable from WD_IPC_FAILOVER_COMMAND and wd_authkey is not set.
    
    Bound node_count at the parser, before the palloc, so an out-of-range
    value is rejected via ereport(ERROR) and never reaches the downstream
    fixed-size stack array.
    
    Reported-by: Emond Papegaaij <emond.papegaaij@topicus.nl>
    Reported-by: Claude
    Author: Tatsuo Ishii <ishii@postgresql.org>
    CVE-2026-92870
    Backpatch-through: v4.3


 src/watchdog/wd_json_data.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/src/watchdog/wd_json_data.c b/src/watchdog/wd_json_data.c
index 981215bac..54d578aee 100644
--- a/src/watchdog/wd_json_data.c
+++ b/src/watchdog/wd_json_data.c
@@ -858,6 +858,13 @@ parse_wd_node_function_json(char *json_data, int data_len, char **func_name, int
 		json_value_free(root);
 		return true;
 	}
+	if (node_count > MAX_NUM_BACKENDS)
+	{
+		json_value_free(root);
+		ereport(ERROR,
+				(errmsg("watchdog NodeIdList count %d exceeds MAX_NUM_BACKENDS (%d)",
+						node_count, MAX_NUM_BACKENDS)));
+	}
 	*count = node_count;
 
 	value = json_get_value_for_key(root, "NodeIdList");


[parent: c4239f51280d]