agora inbox for pgpool-committers@postgresql.org  
help / color / mirror / Atom feed
pgpool: Fix unsigned underflow in inject_cached_message
6+ messages / 2 participants
[nested] [flat]

* pgpool: Fix unsigned underflow in inject_cached_message
@ 2026-09-16 07:33  Taiki Koshino <koshio@sraoss.co.jp>
  0 siblings, 0 replies; 6+ messages in thread

From: Taiki Koshino @ 2026-09-16 07:33 UTC (permalink / raw)
  To: pgpool-committers@lists.postgresql.org

Fix unsigned underflow in inject_cached_message

This patch modifies the packet length validation in inject_cached_message to prevent
a session crash caused by an unsigned integer underflow.

Previously, the logic determined whether to process a query cache message by checking
if the packet length minus its header size was greater than zero(if ((ntohl(len) - sizeof(len)) > 0)).

However, this evaluation method introduced a critical vulnerability under unsigned arithmetic rules.

When a corrupt packet with a payload length shorter than the header size is processed,
the subtraction underflows into a massive positive integer,
bypassing the guard and forcing a fatal memory allocation failure that terminates the session.
In our local test environment, injecting a short packet successfully reproduced this exact behavior,
causing a memory context allocation crash.

The updated logic changes the condition to a direct comparison
before subtraction(if (ntohl(len) > (uint32) sizeof(len))),
ensuring that invalid short packets are securely blocked and the session remains stable,
which proves the fix is highly valid.

Reported-by: Emond Papegaaij <emond.papegaaij@gmail.com>
Reported-by: Claude code
Author: Taiki Koshino <koshino@sraoss.co.jp>
Discussion: https://www.postgresql.org/message-id/TY4PR01MB17374089B6E89C4B9F44817B094C22%40TY4PR01MB17374.jpnpr...
Backpatch-through: v4.3

Branch
------
master

Details
-------
https://git.postgresql.org/gitweb?p=pgpool2.git;a=commitdiff;h=570fccdd677efb866a449c1b159aafbe960a5...

Modified Files
--------------
src/query_cache/pool_memqcache.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)



^ permalink  raw  reply  [nested|flat] 6+ messages in thread

* pgpool: Fix unsigned underflow in inject_cached_message
@ 2026-09-16 07:33  Taiki Koshino <koshio@sraoss.co.jp>
  0 siblings, 0 replies; 6+ messages in thread

From: Taiki Koshino @ 2026-09-16 07:33 UTC (permalink / raw)
  To: pgpool-committers@lists.postgresql.org

Fix unsigned underflow in inject_cached_message

This patch modifies the packet length validation in inject_cached_message to prevent
a session crash caused by an unsigned integer underflow.

Previously, the logic determined whether to process a query cache message by checking
if the packet length minus its header size was greater than zero(if ((ntohl(len) - sizeof(len)) > 0)).

However, this evaluation method introduced a critical vulnerability under unsigned arithmetic rules.

When a corrupt packet with a payload length shorter than the header size is processed,
the subtraction underflows into a massive positive integer,
bypassing the guard and forcing a fatal memory allocation failure that terminates the session.
In our local test environment, injecting a short packet successfully reproduced this exact behavior,
causing a memory context allocation crash.

The updated logic changes the condition to a direct comparison
before subtraction(if (ntohl(len) > (uint32) sizeof(len))),
ensuring that invalid short packets are securely blocked and the session remains stable,
which proves the fix is highly valid.

Reported-by: Emond Papegaaij <emond.papegaaij@gmail.com>
Reported-by: Claude code
Author: Taiki Koshino <koshino@sraoss.co.jp>
Discussion: https://www.postgresql.org/message-id/TY4PR01MB17374089B6E89C4B9F44817B094C22%40TY4PR01MB17374.jpnpr...
Backpatch-through: v4.3

Branch
------
V4_7_STABLE

Details
-------
https://git.postgresql.org/gitweb?p=pgpool2.git;a=commitdiff;h=a1a45ec3fbceb9e9c802c70ea0580e83f667d...

Modified Files
--------------
src/query_cache/pool_memqcache.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)



^ permalink  raw  reply  [nested|flat] 6+ messages in thread

* pgpool: Fix unsigned underflow in inject_cached_message
@ 2026-09-16 07:37  Taiki Koshino <koshino@sraoss.co.jp>
  0 siblings, 0 replies; 6+ messages in thread

From: Taiki Koshino @ 2026-09-16 07:37 UTC (permalink / raw)
  To: pgpool-committers@lists.postgresql.org

Fix unsigned underflow in inject_cached_message

This patch modifies the packet length validation in inject_cached_message to prevent
a session crash caused by an unsigned integer underflow.

Previously, the logic determined whether to process a query cache message by checking
if the packet length minus its header size was greater than zero(if ((ntohl(len) - sizeof(len)) > 0)).

However, this evaluation method introduced a critical vulnerability under unsigned arithmetic rules.

When a corrupt packet with a payload length shorter than the header size is processed,
the subtraction underflows into a massive positive integer,
bypassing the guard and forcing a fatal memory allocation failure that terminates the session.
In our local test environment, injecting a short packet successfully reproduced this exact behavior,
causing a memory context allocation crash.

The updated logic changes the condition to a direct comparison
before subtraction(if (ntohl(len) > (uint32) sizeof(len))),
ensuring that invalid short packets are securely blocked and the session remains stable,
which proves the fix is highly valid.

Reported-by: Emond Papegaaij <emond.papegaaij@gmail.com>
Reported-by: Claude code
Author: Taiki Koshino <koshino@sraoss.co.jp>
Discussion: https://www.postgresql.org/message-id/TY4PR01MB17374089B6E89C4B9F44817B094C22%40TY4PR01MB17374.jpnpr...
Backpatch-through: v4.3

Branch
------
V4_6_STABLE

Details
-------
https://git.postgresql.org/gitweb?p=pgpool2.git;a=commitdiff;h=464784ac259c018127e7ad861f0e953b1fa9a...

Modified Files
--------------
src/query_cache/pool_memqcache.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)



^ permalink  raw  reply  [nested|flat] 6+ messages in thread

* pgpool: Fix unsigned underflow in inject_cached_message
@ 2026-09-16 07:39  Taiki Koshino <koshino@sraoss.co.jp>
  0 siblings, 0 replies; 6+ messages in thread

From: Taiki Koshino @ 2026-09-16 07:39 UTC (permalink / raw)
  To: pgpool-committers@lists.postgresql.org

Fix unsigned underflow in inject_cached_message

This patch modifies the packet length validation in inject_cached_message to prevent
a session crash caused by an unsigned integer underflow.

Previously, the logic determined whether to process a query cache message by checking
if the packet length minus its header size was greater than zero(if ((ntohl(len) - sizeof(len)) > 0)).

However, this evaluation method introduced a critical vulnerability under unsigned arithmetic rules.

When a corrupt packet with a payload length shorter than the header size is processed,
the subtraction underflows into a massive positive integer,
bypassing the guard and forcing a fatal memory allocation failure that terminates the session.
In our local test environment, injecting a short packet successfully reproduced this exact behavior,
causing a memory context allocation crash.

The updated logic changes the condition to a direct comparison
before subtraction(if (ntohl(len) > (uint32) sizeof(len))),
ensuring that invalid short packets are securely blocked and the session remains stable,
which proves the fix is highly valid.

Reported-by: Emond Papegaaij <emond.papegaaij@gmail.com>
Reported-by: Claude code
Author: Taiki Koshino <koshino@sraoss.co.jp>
Discussion: https://www.postgresql.org/message-id/TY4PR01MB17374089B6E89C4B9F44817B094C22%40TY4PR01MB17374.jpnpr...
Backpatch-through: v4.3

Branch
------
V4_5_STABLE

Details
-------
https://git.postgresql.org/gitweb?p=pgpool2.git;a=commitdiff;h=f0fcec001daaf5948629162cb674dde750ba8...

Modified Files
--------------
src/query_cache/pool_memqcache.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)



^ permalink  raw  reply  [nested|flat] 6+ messages in thread

* pgpool: Fix unsigned underflow in inject_cached_message
@ 2026-09-16 07:40  Taiki Koshino <koshino@sraoss.co.jp>
  0 siblings, 0 replies; 6+ messages in thread

From: Taiki Koshino @ 2026-09-16 07:40 UTC (permalink / raw)
  To: pgpool-committers@lists.postgresql.org

Fix unsigned underflow in inject_cached_message

This patch modifies the packet length validation in inject_cached_message to prevent
a session crash caused by an unsigned integer underflow.

Previously, the logic determined whether to process a query cache message by checking
if the packet length minus its header size was greater than zero(if ((ntohl(len) - sizeof(len)) > 0)).

However, this evaluation method introduced a critical vulnerability under unsigned arithmetic rules.

When a corrupt packet with a payload length shorter than the header size is processed,
the subtraction underflows into a massive positive integer,
bypassing the guard and forcing a fatal memory allocation failure that terminates the session.
In our local test environment, injecting a short packet successfully reproduced this exact behavior,
causing a memory context allocation crash.

The updated logic changes the condition to a direct comparison
before subtraction(if (ntohl(len) > (uint32) sizeof(len))),
ensuring that invalid short packets are securely blocked and the session remains stable,
which proves the fix is highly valid.

Reported-by: Emond Papegaaij <emond.papegaaij@gmail.com>
Reported-by: Claude code
Author: Taiki Koshino <koshino@sraoss.co.jp>
Discussion: https://www.postgresql.org/message-id/TY4PR01MB17374089B6E89C4B9F44817B094C22%40TY4PR01MB17374.jpnpr...
Backpatch-through: v4.3

Branch
------
V4_4_STABLE

Details
-------
https://git.postgresql.org/gitweb?p=pgpool2.git;a=commitdiff;h=ff83fef0c58d52262920254d43e6478d8ab34...

Modified Files
--------------
src/query_cache/pool_memqcache.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)



^ permalink  raw  reply  [nested|flat] 6+ messages in thread

* pgpool: Fix unsigned underflow in inject_cached_message
@ 2026-09-16 07:41  Taiki Koshino <koshino@sraoss.co.jp>
  0 siblings, 0 replies; 6+ messages in thread

From: Taiki Koshino @ 2026-09-16 07:41 UTC (permalink / raw)
  To: pgpool-committers@lists.postgresql.org

Fix unsigned underflow in inject_cached_message

This patch modifies the packet length validation in inject_cached_message to prevent
a session crash caused by an unsigned integer underflow.

Previously, the logic determined whether to process a query cache message by checking
if the packet length minus its header size was greater than zero(if ((ntohl(len) - sizeof(len)) > 0)).

However, this evaluation method introduced a critical vulnerability under unsigned arithmetic rules.

When a corrupt packet with a payload length shorter than the header size is processed,
the subtraction underflows into a massive positive integer,
bypassing the guard and forcing a fatal memory allocation failure that terminates the session.
In our local test environment, injecting a short packet successfully reproduced this exact behavior,
causing a memory context allocation crash.

The updated logic changes the condition to a direct comparison
before subtraction(if (ntohl(len) > (uint32) sizeof(len))),
ensuring that invalid short packets are securely blocked and the session remains stable,
which proves the fix is highly valid.

Reported-by: Emond Papegaaij <emond.papegaaij@gmail.com>
Reported-by: Claude code
Author: Taiki Koshino <koshino@sraoss.co.jp>
Discussion: https://www.postgresql.org/message-id/TY4PR01MB17374089B6E89C4B9F44817B094C22%40TY4PR01MB17374.jpnpr...
Backpatch-through: v4.3

Branch
------
V4_3_STABLE

Details
-------
https://git.postgresql.org/gitweb?p=pgpool2.git;a=commitdiff;h=ea75290a4871384b711cfd488e8e54b968958...

Modified Files
--------------
src/query_cache/pool_memqcache.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)



^ permalink  raw  reply  [nested|flat] 6+ messages in thread


end of thread, other threads:[~2026-09-16 07:41 UTC | newest]

Thread overview: 6+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2026-09-16 07:33 pgpool: Fix unsigned underflow in inject_cached_message Taiki Koshino <koshio@sraoss.co.jp>
2026-09-16 07:33 pgpool: Fix unsigned underflow in inject_cached_message Taiki Koshino <koshio@sraoss.co.jp>
2026-09-16 07:37 pgpool: Fix unsigned underflow in inject_cached_message Taiki Koshino <koshino@sraoss.co.jp>
2026-09-16 07:39 pgpool: Fix unsigned underflow in inject_cached_message Taiki Koshino <koshino@sraoss.co.jp>
2026-09-16 07:40 pgpool: Fix unsigned underflow in inject_cached_message Taiki Koshino <koshino@sraoss.co.jp>
2026-09-16 07:41 pgpool: Fix unsigned underflow in inject_cached_message Taiki Koshino <koshino@sraoss.co.jp>

This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox