public inbox for [email protected]
help / color / mirror / Atom feedpgpool: Reject sub-minimum ErrorResponse length in read_kind_from_backe
6+ messages / 1 participants
[nested] [flat]
* pgpool: Reject sub-minimum ErrorResponse length in read_kind_from_backe
@ 2026-07-07 22:13 Tatsuo Ishii <[email protected]>
0 siblings, 0 replies; 6+ messages in thread
From: Tatsuo Ishii @ 2026-07-07 22:13 UTC (permalink / raw)
To: [email protected]
Reject sub-minimum ErrorResponse length in read_kind_from_backend.
read_kind_from_backend() handles a backend ErrorResponse on the V3
path by reading the 4-byte length field, palloc'ing a buffer sized at
ntohl(len), and immediately memcpy()ing all 4 bytes of the
network-order length back into that buffer. When a backend (malicious,
buggy, or speaking a non-V3 dialect that has slipped past earlier
checks) sends a length below 4 ― i.e. in {0,1,2,3} ― the palloc
chunk is smaller than sizeof(len) and the memcpy overruns the heap
allocation. The follow-up `len -= 4` then underflows to a huge
unsigned value, which the subsequent `repalloc(unread_p, sizeof(len) +
len)` may wrap, and pool_read2() is asked for a colossal payload ―
all on top of an already-corrupted heap.
Reject any ntohl(len) below sizeof(len) up front with ereport(ERROR,
...). The error path is the existing longjmp-based one used by every
other malformed-input check in this function, so the connection is
torn down cleanly without touching unread_p.
Reported-by: Emond Papegaaij <[email protected]>
Reported-by: Claude code
Author: Tatsuo Ishii <[email protected]>
Reviewed-by: Bo Peng <[email protected]>
Reviewed-by: Koshino Taiki <[email protected]>
Discussion: https://www.postgresql.org/message-id/20260626.153227.1428186004607098961.ishii%40postgresql.org
Backpatch-through: v4.3
Branch
------
V4_3_STABLE
Details
-------
https://git.postgresql.org/gitweb?p=pgpool2.git;a=commitdiff;h=7cb48aec60ec2826cf3416a83e763683935f1...
Modified Files
--------------
src/protocol/pool_process_query.c | 4 ++++
1 file changed, 4 insertions(+)
^ permalink raw reply [nested|flat] 6+ messages in thread
* pgpool: Reject sub-minimum ErrorResponse length in read_kind_from_backe
@ 2026-07-07 22:13 Tatsuo Ishii <[email protected]>
0 siblings, 0 replies; 6+ messages in thread
From: Tatsuo Ishii @ 2026-07-07 22:13 UTC (permalink / raw)
To: [email protected]
Reject sub-minimum ErrorResponse length in read_kind_from_backend.
read_kind_from_backend() handles a backend ErrorResponse on the V3
path by reading the 4-byte length field, palloc'ing a buffer sized at
ntohl(len), and immediately memcpy()ing all 4 bytes of the
network-order length back into that buffer. When a backend (malicious,
buggy, or speaking a non-V3 dialect that has slipped past earlier
checks) sends a length below 4 ― i.e. in {0,1,2,3} ― the palloc
chunk is smaller than sizeof(len) and the memcpy overruns the heap
allocation. The follow-up `len -= 4` then underflows to a huge
unsigned value, which the subsequent `repalloc(unread_p, sizeof(len) +
len)` may wrap, and pool_read2() is asked for a colossal payload ―
all on top of an already-corrupted heap.
Reject any ntohl(len) below sizeof(len) up front with ereport(ERROR,
...). The error path is the existing longjmp-based one used by every
other malformed-input check in this function, so the connection is
torn down cleanly without touching unread_p.
Reported-by: Emond Papegaaij <[email protected]>
Reported-by: Claude code
Author: Tatsuo Ishii <[email protected]>
Reviewed-by: Bo Peng <[email protected]>
Reviewed-by: Koshino Taiki <[email protected]>
Discussion: https://www.postgresql.org/message-id/20260626.153227.1428186004607098961.ishii%40postgresql.org
Backpatch-through: v4.3
Branch
------
V4_4_STABLE
Details
-------
https://git.postgresql.org/gitweb?p=pgpool2.git;a=commitdiff;h=6eac437891b809dfe095a6c4d04d618f501e1...
Modified Files
--------------
src/protocol/pool_process_query.c | 4 ++++
1 file changed, 4 insertions(+)
^ permalink raw reply [nested|flat] 6+ messages in thread
* pgpool: Reject sub-minimum ErrorResponse length in read_kind_from_backe
@ 2026-07-07 22:14 Tatsuo Ishii <[email protected]>
0 siblings, 0 replies; 6+ messages in thread
From: Tatsuo Ishii @ 2026-07-07 22:14 UTC (permalink / raw)
To: [email protected]
Reject sub-minimum ErrorResponse length in read_kind_from_backend.
read_kind_from_backend() handles a backend ErrorResponse on the V3
path by reading the 4-byte length field, palloc'ing a buffer sized at
ntohl(len), and immediately memcpy()ing all 4 bytes of the
network-order length back into that buffer. When a backend (malicious,
buggy, or speaking a non-V3 dialect that has slipped past earlier
checks) sends a length below 4 ― i.e. in {0,1,2,3} ― the palloc
chunk is smaller than sizeof(len) and the memcpy overruns the heap
allocation. The follow-up `len -= 4` then underflows to a huge
unsigned value, which the subsequent `repalloc(unread_p, sizeof(len) +
len)` may wrap, and pool_read2() is asked for a colossal payload ―
all on top of an already-corrupted heap.
Reject any ntohl(len) below sizeof(len) up front with ereport(ERROR,
...). The error path is the existing longjmp-based one used by every
other malformed-input check in this function, so the connection is
torn down cleanly without touching unread_p.
Reported-by: Emond Papegaaij <[email protected]>
Reported-by: Claude code
Author: Tatsuo Ishii <[email protected]>
Reviewed-by: Bo Peng <[email protected]>
Reviewed-by: Koshino Taiki <[email protected]>
Discussion: https://www.postgresql.org/message-id/20260626.153227.1428186004607098961.ishii%40postgresql.org
Backpatch-through: v4.3
Branch
------
V4_5_STABLE
Details
-------
https://git.postgresql.org/gitweb?p=pgpool2.git;a=commitdiff;h=9e84817fb572c11b954be60a0bdf9cde911cd...
Modified Files
--------------
src/protocol/pool_process_query.c | 4 ++++
1 file changed, 4 insertions(+)
^ permalink raw reply [nested|flat] 6+ messages in thread
* pgpool: Reject sub-minimum ErrorResponse length in read_kind_from_backe
@ 2026-07-07 22:14 Tatsuo Ishii <[email protected]>
0 siblings, 0 replies; 6+ messages in thread
From: Tatsuo Ishii @ 2026-07-07 22:14 UTC (permalink / raw)
To: [email protected]
Reject sub-minimum ErrorResponse length in read_kind_from_backend.
read_kind_from_backend() handles a backend ErrorResponse on the V3
path by reading the 4-byte length field, palloc'ing a buffer sized at
ntohl(len), and immediately memcpy()ing all 4 bytes of the
network-order length back into that buffer. When a backend (malicious,
buggy, or speaking a non-V3 dialect that has slipped past earlier
checks) sends a length below 4 ― i.e. in {0,1,2,3} ― the palloc
chunk is smaller than sizeof(len) and the memcpy overruns the heap
allocation. The follow-up `len -= 4` then underflows to a huge
unsigned value, which the subsequent `repalloc(unread_p, sizeof(len) +
len)` may wrap, and pool_read2() is asked for a colossal payload ―
all on top of an already-corrupted heap.
Reject any ntohl(len) below sizeof(len) up front with ereport(ERROR,
...). The error path is the existing longjmp-based one used by every
other malformed-input check in this function, so the connection is
torn down cleanly without touching unread_p.
Reported-by: Emond Papegaaij <[email protected]>
Reported-by: Claude code
Author: Tatsuo Ishii <[email protected]>
Reviewed-by: Bo Peng <[email protected]>
Reviewed-by: Koshino Taiki <[email protected]>
Discussion: https://www.postgresql.org/message-id/20260626.153227.1428186004607098961.ishii%40postgresql.org
Backpatch-through: v4.3
Branch
------
V4_6_STABLE
Details
-------
https://git.postgresql.org/gitweb?p=pgpool2.git;a=commitdiff;h=244b55188000f2e6b8ac50b12b510739477ba...
Modified Files
--------------
src/protocol/pool_process_query.c | 4 ++++
1 file changed, 4 insertions(+)
^ permalink raw reply [nested|flat] 6+ messages in thread
* pgpool: Reject sub-minimum ErrorResponse length in read_kind_from_backe
@ 2026-07-07 22:14 Tatsuo Ishii <[email protected]>
0 siblings, 0 replies; 6+ messages in thread
From: Tatsuo Ishii @ 2026-07-07 22:14 UTC (permalink / raw)
To: [email protected]
Reject sub-minimum ErrorResponse length in read_kind_from_backend.
read_kind_from_backend() handles a backend ErrorResponse on the V3
path by reading the 4-byte length field, palloc'ing a buffer sized at
ntohl(len), and immediately memcpy()ing all 4 bytes of the
network-order length back into that buffer. When a backend (malicious,
buggy, or speaking a non-V3 dialect that has slipped past earlier
checks) sends a length below 4 ― i.e. in {0,1,2,3} ― the palloc
chunk is smaller than sizeof(len) and the memcpy overruns the heap
allocation. The follow-up `len -= 4` then underflows to a huge
unsigned value, which the subsequent `repalloc(unread_p, sizeof(len) +
len)` may wrap, and pool_read2() is asked for a colossal payload ―
all on top of an already-corrupted heap.
Reject any ntohl(len) below sizeof(len) up front with ereport(ERROR,
...). The error path is the existing longjmp-based one used by every
other malformed-input check in this function, so the connection is
torn down cleanly without touching unread_p.
Reported-by: Emond Papegaaij <[email protected]>
Reported-by: Claude code
Author: Tatsuo Ishii <[email protected]>
Reviewed-by: Bo Peng <[email protected]>
Reviewed-by: Koshino Taiki <[email protected]>
Discussion: https://www.postgresql.org/message-id/20260626.153227.1428186004607098961.ishii%40postgresql.org
Backpatch-through: v4.3
Branch
------
V4_7_STABLE
Details
-------
https://git.postgresql.org/gitweb?p=pgpool2.git;a=commitdiff;h=f847e843002b89a254387975fa218c7cfbb54...
Modified Files
--------------
src/protocol/pool_process_query.c | 4 ++++
1 file changed, 4 insertions(+)
^ permalink raw reply [nested|flat] 6+ messages in thread
* pgpool: Reject sub-minimum ErrorResponse length in read_kind_from_backe
@ 2026-07-07 22:14 Tatsuo Ishii <[email protected]>
0 siblings, 0 replies; 6+ messages in thread
From: Tatsuo Ishii @ 2026-07-07 22:14 UTC (permalink / raw)
To: [email protected]
Reject sub-minimum ErrorResponse length in read_kind_from_backend.
read_kind_from_backend() handles a backend ErrorResponse on the V3
path by reading the 4-byte length field, palloc'ing a buffer sized at
ntohl(len), and immediately memcpy()ing all 4 bytes of the
network-order length back into that buffer. When a backend (malicious,
buggy, or speaking a non-V3 dialect that has slipped past earlier
checks) sends a length below 4 ― i.e. in {0,1,2,3} ― the palloc
chunk is smaller than sizeof(len) and the memcpy overruns the heap
allocation. The follow-up `len -= 4` then underflows to a huge
unsigned value, which the subsequent `repalloc(unread_p, sizeof(len) +
len)` may wrap, and pool_read2() is asked for a colossal payload ―
all on top of an already-corrupted heap.
Reject any ntohl(len) below sizeof(len) up front with ereport(ERROR,
...). The error path is the existing longjmp-based one used by every
other malformed-input check in this function, so the connection is
torn down cleanly without touching unread_p.
Reported-by: Emond Papegaaij <[email protected]>
Reported-by: Claude code
Author: Tatsuo Ishii <[email protected]>
Reviewed-by: Bo Peng <[email protected]>
Reviewed-by: Koshino Taiki <[email protected]>
Discussion: https://www.postgresql.org/message-id/20260626.153227.1428186004607098961.ishii%40postgresql.org
Backpatch-through: v4.3
Branch
------
master
Details
-------
https://git.postgresql.org/gitweb?p=pgpool2.git;a=commitdiff;h=912d7ce0b9d3a29a343a4b828e86fc05c0f47...
Modified Files
--------------
src/protocol/pool_process_query.c | 4 ++++
1 file changed, 4 insertions(+)
^ permalink raw reply [nested|flat] 6+ messages in thread
end of thread, other threads:[~2026-07-07 22:14 UTC | newest]
Thread overview: 6+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2026-07-07 22:13 pgpool: Reject sub-minimum ErrorResponse length in read_kind_from_backe Tatsuo Ishii <[email protected]>
2026-07-07 22:13 pgpool: Reject sub-minimum ErrorResponse length in read_kind_from_backe Tatsuo Ishii <[email protected]>
2026-07-07 22:14 pgpool: Reject sub-minimum ErrorResponse length in read_kind_from_backe Tatsuo Ishii <[email protected]>
2026-07-07 22:14 pgpool: Reject sub-minimum ErrorResponse length in read_kind_from_backe Tatsuo Ishii <[email protected]>
2026-07-07 22:14 pgpool: Reject sub-minimum ErrorResponse length in read_kind_from_backe Tatsuo Ishii <[email protected]>
2026-07-07 22:14 pgpool: Reject sub-minimum ErrorResponse length in read_kind_from_backe Tatsuo Ishii <[email protected]>
This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox