pgpool: Fix operator precedence in parse_wd_node_function_json NodeIdLi

Fix operator precedence in parse_wd_node_function_json NodeIdList write.

In src/watchdog/wd_json_data.c parse_wd_node_function_json(), the loop
body wrote

*node_id_set[i] = value->u.array.values[i]->u.integer;

which by C precedence parses as *(node_id_set[i]). node_id_set is an
int ** that aliases the caller's &node_id_list pointer. For i == 0 the
write happens to land on the palloc'd destination buffer; for i >= 1 the
indexing walks sizeof(int*) * i bytes past the int ** parameter into
adjacent memory, dereferences the resulting garbage pointer, and stores
a peer-controlled 32-bit integer there.

Add the missing parentheses so the subscript applies to the dereferenced
array: (*node_id_set)[i] = ...

This is almost certainly the original intent - the single-node
failover path (the common production case) hits only i == 0 and so the
bug has not been observed in normal operation. Any NodeIdList of length
two or more immediately fires the misbehaviour.

Reported-by: Emond Papegaaij <emond(dot)papegaaij(at)topicus(dot)nl>
Reported-by: Claude
Author: Bo Peng <pengbo(at)sraoss(dot)co(dot)jp>
CVE-2026-92867
Backpatch-through: v4.3

Branch
------
V4_4_STABLE

Details
-------
https://git.postgresql.org/gitweb?p=pgpool2.git;a=commitdiff;h=cf9b1fc28031757078d4aafa01a39e6a85ed8615

Modified Files
--------------
src/watchdog/wd_json_data.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)