pgpool: Fix unsigned underflow in inject_cached_message

Fix unsigned underflow in inject_cached_message

This patch modifies the packet length validation in inject_cached_message to prevent
a session crash caused by an unsigned integer underflow.

Previously, the logic determined whether to process a query cache message by checking
if the packet length minus its header size was greater than zero(if ((ntohl(len) - sizeof(len)) > 0)).

However, this evaluation method introduced a critical vulnerability under unsigned arithmetic rules.

When a corrupt packet with a payload length shorter than the header size is processed,
the subtraction underflows into a massive positive integer,
bypassing the guard and forcing a fatal memory allocation failure that terminates the session.
In our local test environment, injecting a short packet successfully reproduced this exact behavior,
causing a memory context allocation crash.

The updated logic changes the condition to a direct comparison
before subtraction(if (ntohl(len) > (uint32) sizeof(len))),
ensuring that invalid short packets are securely blocked and the session remains stable,
which proves the fix is highly valid.

Reported-by: Emond Papegaaij <emond(dot)papegaaij(at)gmail(dot)com>
Reported-by: Claude code
Author: Taiki Koshino <koshino(at)sraoss(dot)co(dot)jp>
Discussion: https://www.postgresql.org/message-id/TY4PR01MB17374089B6E89C4B9F44817B094C22%40TY4PR01MB17374.jpnprd01.prod.outlook.com
Backpatch-through: v4.3

Branch
------
V4_6_STABLE

Details
-------
https://git.postgresql.org/gitweb?p=pgpool2.git;a=commitdiff;h=464784ac259c018127e7ad861f0e953b1fa9a3b6

Modified Files
--------------
src/query_cache/pool_memqcache.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)