pgpool: Reject negative read length in pool_read2.

Reject negative read length in pool_read2.

pool_read2() allocates buf2 sized to cp->len + len, consumes that many
bytes from the pending buffer, then loops reading from the socket
while len > 0. When len is zero or negative the loop never executes a
fresh read and the function falls straight through to "return
cp->buf2", handing the caller a pointer to whatever the previous
pool_read2() invocation happened to leave in the per-connection
buffer.

Callers compute len from on-the-wire length fields, e.g.
len = ntohl(hdr) - sizeof(hdr);
and several do so without bounds-checking. A backend that ships a
malformed message with a length smaller than the header (or a
negative value once cast to int32) drives pool_read2() into the
stale-buffer path. The stale bytes are then forwarded to the
frontend as ParameterStatus / ErrorResponse / etc. payloads,
leaking whatever the previous reply contained on this same
backend connection.

Add a guard at the top of pool_read2() that logs and returns NULL when
len < 0, before any buffer setup runs.

When len == 0, just retuns cp->buf2, rather than returning NULL to not
break existing callers relying on the behavior.

Reported-by: Emond Papegaaij <emond(dot)papegaaij(at)gmail(dot)com>
Reported-by: Claude code
Author: Tatsuo Ishii <ishii(at)postgresql(dot)org>
Discussion: https://github.com/pgpool/pgpool2/issues/168
Backpatch-through: v4.3

Branch
------
V4_7_STABLE

Details
-------
https://git.postgresql.org/gitweb?p=pgpool2.git;a=commitdiff;h=71487bb1c66adc36484f1a6e57eb7ee570c3cf11

Modified Files
--------------
src/utils/pool_stream.c | 17 +++++++++++++----
1 file changed, 13 insertions(+), 4 deletions(-)