public inbox for [email protected]  

help / color / mirror / Atom feed

From: Tatsuo Ishii <[email protected]>
To: [email protected]
Cc: Emond Papegaaij <[email protected]>
Subject: Re: Reject sub-minimum ErrorResponse length in read_kind_from_backend.
Date: Wed, 08 Jul 2026 07:19:42 +0900 (JST)
Message-ID: <[email protected]> (raw)
In-Reply-To: <[email protected]>
References: <[email protected]>

> Emond Papegaaij reported a bug in read_kind_from_backend.
> 
> read_kind_from_backend() handles a backend ErrorResponse on the V3
> path by reading the 4-byte length field, palloc'ing a buffer sized at
> ntohl(len), and immediately memcpy()ing all 4 bytes of the
> network-order length back into that buffer. When a backend (malicious,
> buggy, or speaking a non-V3 dialect that has slipped past earlier
> checks) sends a length below 4 ― i.e. in {0,1,2,3} ― the palloc
> chunk is smaller than sizeof(len) and the memcpy overruns the heap
> allocation. The follow-up `len -= 4` then underflows to a huge
> unsigned value, which the subsequent `repalloc(unread_p, sizeof(len) +
> len)` may wrap, and pool_read2() is asked for a colossal payload ―
> all on top of an already-corrupted heap.
> 
> Reject any ntohl(len) below sizeof(len) up front with ereport(ERROR,
> ...). The error path is the existing longjmp-based one used by every
> other malformed-input check in this function, so the connection is
> torn down cleanly without touching unread_p.
> 
> Patch attached.

Peng and Koshino reviewed the patch off-list and they agreed that it
looks good.  I have pushed the patch to all supported branches.

Thank you, Emond.

https://git.postgresql.org/gitweb/?p=pgpool2.git;a=commit;h=912d7ce0b9d3a29a343a4b828e86fc05c0f47755
--
Tatsuo Ishii
SRA OSS K.K.
English: http://www.sraoss.co.jp/index_en/
Japanese:http://www.sraoss.co.jp

view thread (66+ messages)

reply

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: [email protected]
  Cc: [email protected], [email protected], [email protected]
  Subject: Re: Reject sub-minimum ErrorResponse length in read_kind_from_backend.
  In-Reply-To: <[email protected]>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox