pgpool: Bound wd_nodes JSON array parsing in get_pool_config_from_json.

Bound wd_nodes JSON array parsing in get_pool_config_from_json.

In src/watchdog/wd_json_data.c get_pool_config_from_json(), the loop
over the peer-supplied "wd_nodes" JSON array writes into
config->wd_nodes.wd_node_info[i] using the array length declared by
the peer. The destination is a fixed-size array of MAX_WATCHDOG_NUM
(128) WdNodeInfo entries (see WdNodesConfig in src/include/pool_config.h),
but no upper bound is enforced before the loop, so a peer that ships
a wd_nodes array of length > 128 walks the loop index past the end
of the array and writes peer-controlled host/port data into adjacent
heap memory.

This is the wd_nodes half of PGP-0001 (the backend_desc half is
addressed in a sibling patch). Reject any wd_nodes array whose
declared length exceeds MAX_WATCHDOG_NUM via ereport(ERROR, ...) so
the JSON is dropped before any out-of-bounds write occurs.

Inline bound check (rather than a shared parse_peer_count helper) so
this patch is self-contained and back-portable independently of any
helper migration.

Reported-by: Emond Papegaaij <emond(dot)papegaaij(at)topicus(dot)nl>
Reported-by: Claude
Author: Bo Peng <pengbo(at)sraoss(dot)co(dot)jp>
CVE-2026-92869
Backpatch-through: v4.3

Branch
------
master

Details
-------
https://git.postgresql.org/gitweb?p=pgpool2.git;a=commitdiff;h=c4239f51280d1ccd3265eddf630542535fad54a3

Modified Files
--------------
src/watchdog/wd_json_data.c | 6 ++++++
1 file changed, 6 insertions(+)