agora inbox for pgpool-committers@postgresql.org
help / color / mirror / Atom feedFrom: Taiki Koshino <koshio@sraoss.co.jp>
To: pgpool-committers@lists.postgresql.org
Subject: pgpool: Fix unsigned underflow in inject_cached_message
Date: Wed, 16 Sep 2026 07:33:41 +0000
Message-ID: <E1x6k9F-0000000CKmw-1WPf@gothos.postgresql.org> (raw)
Fix unsigned underflow in inject_cached_message
This patch modifies the packet length validation in inject_cached_message to prevent
a session crash caused by an unsigned integer underflow.
Previously, the logic determined whether to process a query cache message by checking
if the packet length minus its header size was greater than zero(if ((ntohl(len) - sizeof(len)) > 0)).
However, this evaluation method introduced a critical vulnerability under unsigned arithmetic rules.
When a corrupt packet with a payload length shorter than the header size is processed,
the subtraction underflows into a massive positive integer,
bypassing the guard and forcing a fatal memory allocation failure that terminates the session.
In our local test environment, injecting a short packet successfully reproduced this exact behavior,
causing a memory context allocation crash.
The updated logic changes the condition to a direct comparison
before subtraction(if (ntohl(len) > (uint32) sizeof(len))),
ensuring that invalid short packets are securely blocked and the session remains stable,
which proves the fix is highly valid.
Reported-by: Emond Papegaaij <emond.papegaaij@gmail.com>
Reported-by: Claude code
Author: Taiki Koshino <koshino@sraoss.co.jp>
Discussion: https://www.postgresql.org/message-id/TY4PR01MB17374089B6E89C4B9F44817B094C22%40TY4PR01MB17374.jpnpr...
Backpatch-through: v4.3
Branch
------
V4_7_STABLE
Details
-------
https://git.postgresql.org/gitweb?p=pgpool2.git;a=commitdiff;h=a1a45ec3fbceb9e9c802c70ea0580e83f667d...
Modified Files
--------------
src/query_cache/pool_memqcache.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
view thread (6+ messages) latest in thread
Message-ID: <E1x6k9F-0000000CKmw-1WPf@gothos.postgresql.org>
Permalink: ../E1x6k9F-0000000CKmw-1WPf@gothos.postgresql.org/
Also on: postgresql.org/message-id/E1x6k9F-0000000CKmw-1WPf@gothos.postgresql.org
reply
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgpool-committers@postgresql.org
Cc: koshio@sraoss.co.jp, pgpool-committers@lists.postgresql.org
Subject: Re: pgpool: Fix unsigned underflow in inject_cached_message
In-Reply-To: <E1x6k9F-0000000CKmw-1WPf@gothos.postgresql.org>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox