agora inbox for pgpool-committers@postgresql.orghelp / color / mirror / Atom feed
pgpool: Fix unsigned underflow in inject_cached_message 6+ messages / 2 participants [nested] [flat]
* pgpool: Fix unsigned underflow in inject_cached_message @ 2026-09-16 07:33 Taiki Koshino <koshio@sraoss.co.jp> 0 siblings, 0 replies; 6+ messages in thread From: Taiki Koshino @ 2026-09-16 07:33 UTC (permalink / raw) To: pgpool-committers@lists.postgresql.org Fix unsigned underflow in inject_cached_message This patch modifies the packet length validation in inject_cached_message to prevent a session crash caused by an unsigned integer underflow. Previously, the logic determined whether to process a query cache message by checking if the packet length minus its header size was greater than zero(if ((ntohl(len) - sizeof(len)) > 0)). However, this evaluation method introduced a critical vulnerability under unsigned arithmetic rules. When a corrupt packet with a payload length shorter than the header size is processed, the subtraction underflows into a massive positive integer, bypassing the guard and forcing a fatal memory allocation failure that terminates the session. In our local test environment, injecting a short packet successfully reproduced this exact behavior, causing a memory context allocation crash. The updated logic changes the condition to a direct comparison before subtraction(if (ntohl(len) > (uint32) sizeof(len))), ensuring that invalid short packets are securely blocked and the session remains stable, which proves the fix is highly valid. Reported-by: Emond Papegaaij <emond.papegaaij@gmail.com> Reported-by: Claude code Author: Taiki Koshino <koshino@sraoss.co.jp> Discussion: https://www.postgresql.org/message-id/TY4PR01MB17374089B6E89C4B9F44817B094C22%40TY4PR01MB17374.jpnpr... Backpatch-through: v4.3 Branch ------ master Details ------- https://git.postgresql.org/gitweb?p=pgpool2.git;a=commitdiff;h=570fccdd677efb866a449c1b159aafbe960a5... Modified Files -------------- src/query_cache/pool_memqcache.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) ^ permalink raw reply [nested|flat] 6+ messages in thread
* pgpool: Fix unsigned underflow in inject_cached_message @ 2026-09-16 07:33 Taiki Koshino <koshio@sraoss.co.jp> 0 siblings, 0 replies; 6+ messages in thread From: Taiki Koshino @ 2026-09-16 07:33 UTC (permalink / raw) To: pgpool-committers@lists.postgresql.org Fix unsigned underflow in inject_cached_message This patch modifies the packet length validation in inject_cached_message to prevent a session crash caused by an unsigned integer underflow. Previously, the logic determined whether to process a query cache message by checking if the packet length minus its header size was greater than zero(if ((ntohl(len) - sizeof(len)) > 0)). However, this evaluation method introduced a critical vulnerability under unsigned arithmetic rules. When a corrupt packet with a payload length shorter than the header size is processed, the subtraction underflows into a massive positive integer, bypassing the guard and forcing a fatal memory allocation failure that terminates the session. In our local test environment, injecting a short packet successfully reproduced this exact behavior, causing a memory context allocation crash. The updated logic changes the condition to a direct comparison before subtraction(if (ntohl(len) > (uint32) sizeof(len))), ensuring that invalid short packets are securely blocked and the session remains stable, which proves the fix is highly valid. Reported-by: Emond Papegaaij <emond.papegaaij@gmail.com> Reported-by: Claude code Author: Taiki Koshino <koshino@sraoss.co.jp> Discussion: https://www.postgresql.org/message-id/TY4PR01MB17374089B6E89C4B9F44817B094C22%40TY4PR01MB17374.jpnpr... Backpatch-through: v4.3 Branch ------ V4_7_STABLE Details ------- https://git.postgresql.org/gitweb?p=pgpool2.git;a=commitdiff;h=a1a45ec3fbceb9e9c802c70ea0580e83f667d... Modified Files -------------- src/query_cache/pool_memqcache.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) ^ permalink raw reply [nested|flat] 6+ messages in thread
* pgpool: Fix unsigned underflow in inject_cached_message @ 2026-09-16 07:37 Taiki Koshino <koshino@sraoss.co.jp> 0 siblings, 0 replies; 6+ messages in thread From: Taiki Koshino @ 2026-09-16 07:37 UTC (permalink / raw) To: pgpool-committers@lists.postgresql.org Fix unsigned underflow in inject_cached_message This patch modifies the packet length validation in inject_cached_message to prevent a session crash caused by an unsigned integer underflow. Previously, the logic determined whether to process a query cache message by checking if the packet length minus its header size was greater than zero(if ((ntohl(len) - sizeof(len)) > 0)). However, this evaluation method introduced a critical vulnerability under unsigned arithmetic rules. When a corrupt packet with a payload length shorter than the header size is processed, the subtraction underflows into a massive positive integer, bypassing the guard and forcing a fatal memory allocation failure that terminates the session. In our local test environment, injecting a short packet successfully reproduced this exact behavior, causing a memory context allocation crash. The updated logic changes the condition to a direct comparison before subtraction(if (ntohl(len) > (uint32) sizeof(len))), ensuring that invalid short packets are securely blocked and the session remains stable, which proves the fix is highly valid. Reported-by: Emond Papegaaij <emond.papegaaij@gmail.com> Reported-by: Claude code Author: Taiki Koshino <koshino@sraoss.co.jp> Discussion: https://www.postgresql.org/message-id/TY4PR01MB17374089B6E89C4B9F44817B094C22%40TY4PR01MB17374.jpnpr... Backpatch-through: v4.3 Branch ------ V4_6_STABLE Details ------- https://git.postgresql.org/gitweb?p=pgpool2.git;a=commitdiff;h=464784ac259c018127e7ad861f0e953b1fa9a... Modified Files -------------- src/query_cache/pool_memqcache.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) ^ permalink raw reply [nested|flat] 6+ messages in thread
* pgpool: Fix unsigned underflow in inject_cached_message @ 2026-09-16 07:39 Taiki Koshino <koshino@sraoss.co.jp> 0 siblings, 0 replies; 6+ messages in thread From: Taiki Koshino @ 2026-09-16 07:39 UTC (permalink / raw) To: pgpool-committers@lists.postgresql.org Fix unsigned underflow in inject_cached_message This patch modifies the packet length validation in inject_cached_message to prevent a session crash caused by an unsigned integer underflow. Previously, the logic determined whether to process a query cache message by checking if the packet length minus its header size was greater than zero(if ((ntohl(len) - sizeof(len)) > 0)). However, this evaluation method introduced a critical vulnerability under unsigned arithmetic rules. When a corrupt packet with a payload length shorter than the header size is processed, the subtraction underflows into a massive positive integer, bypassing the guard and forcing a fatal memory allocation failure that terminates the session. In our local test environment, injecting a short packet successfully reproduced this exact behavior, causing a memory context allocation crash. The updated logic changes the condition to a direct comparison before subtraction(if (ntohl(len) > (uint32) sizeof(len))), ensuring that invalid short packets are securely blocked and the session remains stable, which proves the fix is highly valid. Reported-by: Emond Papegaaij <emond.papegaaij@gmail.com> Reported-by: Claude code Author: Taiki Koshino <koshino@sraoss.co.jp> Discussion: https://www.postgresql.org/message-id/TY4PR01MB17374089B6E89C4B9F44817B094C22%40TY4PR01MB17374.jpnpr... Backpatch-through: v4.3 Branch ------ V4_5_STABLE Details ------- https://git.postgresql.org/gitweb?p=pgpool2.git;a=commitdiff;h=f0fcec001daaf5948629162cb674dde750ba8... Modified Files -------------- src/query_cache/pool_memqcache.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) ^ permalink raw reply [nested|flat] 6+ messages in thread
* pgpool: Fix unsigned underflow in inject_cached_message @ 2026-09-16 07:40 Taiki Koshino <koshino@sraoss.co.jp> 0 siblings, 0 replies; 6+ messages in thread From: Taiki Koshino @ 2026-09-16 07:40 UTC (permalink / raw) To: pgpool-committers@lists.postgresql.org Fix unsigned underflow in inject_cached_message This patch modifies the packet length validation in inject_cached_message to prevent a session crash caused by an unsigned integer underflow. Previously, the logic determined whether to process a query cache message by checking if the packet length minus its header size was greater than zero(if ((ntohl(len) - sizeof(len)) > 0)). However, this evaluation method introduced a critical vulnerability under unsigned arithmetic rules. When a corrupt packet with a payload length shorter than the header size is processed, the subtraction underflows into a massive positive integer, bypassing the guard and forcing a fatal memory allocation failure that terminates the session. In our local test environment, injecting a short packet successfully reproduced this exact behavior, causing a memory context allocation crash. The updated logic changes the condition to a direct comparison before subtraction(if (ntohl(len) > (uint32) sizeof(len))), ensuring that invalid short packets are securely blocked and the session remains stable, which proves the fix is highly valid. Reported-by: Emond Papegaaij <emond.papegaaij@gmail.com> Reported-by: Claude code Author: Taiki Koshino <koshino@sraoss.co.jp> Discussion: https://www.postgresql.org/message-id/TY4PR01MB17374089B6E89C4B9F44817B094C22%40TY4PR01MB17374.jpnpr... Backpatch-through: v4.3 Branch ------ V4_4_STABLE Details ------- https://git.postgresql.org/gitweb?p=pgpool2.git;a=commitdiff;h=ff83fef0c58d52262920254d43e6478d8ab34... Modified Files -------------- src/query_cache/pool_memqcache.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) ^ permalink raw reply [nested|flat] 6+ messages in thread
* pgpool: Fix unsigned underflow in inject_cached_message @ 2026-09-16 07:41 Taiki Koshino <koshino@sraoss.co.jp> 0 siblings, 0 replies; 6+ messages in thread From: Taiki Koshino @ 2026-09-16 07:41 UTC (permalink / raw) To: pgpool-committers@lists.postgresql.org Fix unsigned underflow in inject_cached_message This patch modifies the packet length validation in inject_cached_message to prevent a session crash caused by an unsigned integer underflow. Previously, the logic determined whether to process a query cache message by checking if the packet length minus its header size was greater than zero(if ((ntohl(len) - sizeof(len)) > 0)). However, this evaluation method introduced a critical vulnerability under unsigned arithmetic rules. When a corrupt packet with a payload length shorter than the header size is processed, the subtraction underflows into a massive positive integer, bypassing the guard and forcing a fatal memory allocation failure that terminates the session. In our local test environment, injecting a short packet successfully reproduced this exact behavior, causing a memory context allocation crash. The updated logic changes the condition to a direct comparison before subtraction(if (ntohl(len) > (uint32) sizeof(len))), ensuring that invalid short packets are securely blocked and the session remains stable, which proves the fix is highly valid. Reported-by: Emond Papegaaij <emond.papegaaij@gmail.com> Reported-by: Claude code Author: Taiki Koshino <koshino@sraoss.co.jp> Discussion: https://www.postgresql.org/message-id/TY4PR01MB17374089B6E89C4B9F44817B094C22%40TY4PR01MB17374.jpnpr... Backpatch-through: v4.3 Branch ------ V4_3_STABLE Details ------- https://git.postgresql.org/gitweb?p=pgpool2.git;a=commitdiff;h=ea75290a4871384b711cfd488e8e54b968958... Modified Files -------------- src/query_cache/pool_memqcache.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) ^ permalink raw reply [nested|flat] 6+ messages in thread
end of thread, other threads:[~2026-09-16 07:41 UTC | newest] Thread overview: 6+ messages (download: mbox mbox.gz follow: Atom feed) -- links below jump to the message on this page -- 2026-09-16 07:33 pgpool: Fix unsigned underflow in inject_cached_message Taiki Koshino <koshio@sraoss.co.jp> 2026-09-16 07:33 pgpool: Fix unsigned underflow in inject_cached_message Taiki Koshino <koshio@sraoss.co.jp> 2026-09-16 07:37 pgpool: Fix unsigned underflow in inject_cached_message Taiki Koshino <koshino@sraoss.co.jp> 2026-09-16 07:39 pgpool: Fix unsigned underflow in inject_cached_message Taiki Koshino <koshino@sraoss.co.jp> 2026-09-16 07:40 pgpool: Fix unsigned underflow in inject_cached_message Taiki Koshino <koshino@sraoss.co.jp> 2026-09-16 07:41 pgpool: Fix unsigned underflow in inject_cached_message Taiki Koshino <koshino@sraoss.co.jp>
This inbox is served by agora; see mirroring instructions for how to clone and mirror all data and code used for this inbox