| From: | Tatsuo Ishii <ishii(at)postgresql(dot)org> |
|---|---|
| To: | pgpool-committers(at)lists(dot)postgresql(dot)org |
| Subject: | pgpool: Fix lifecheck buffer overrun. |
| Date: | 2026-10-01 11:16:51 |
| Message-ID: | E1xCEmR-0000000Bzbh-2R1E@gothos.postgresql.org |
| Views: | Whole Thread | Raw Message | Download mbox | Resend email |
| Thread: | |
| Lists: | pgpool-committers |
Fix lifecheck buffer overrun.
load_watchdog_nodes_from_json() in wd_lifecheck.c used strcpy() to
copy WDNodeInfo.stateName to lifeCheckNode.stateName. As the size of
WDNodeInfo.stateName is WD_MAX_HOST_NAMELEN (254), while the size of
lifeCheckNode.stateName was 128, theoretically it was possible for the
strcpy() to overrun lifeCheckNode.stateName. Fortunately strings used
for WDNodeInfo.stateName are predefined as global variable
(wd_state_names in watchdog.c), and never exceeds 128 bytes at this
point. But bug is a bug.
To fix this, change the size of LifeCheckNode.stateName from 128 to
WD_MAX_HOST_NAMELEN, which aligns with WDNodeInfo.stateName.
In passing following changes are made:
- Eliminate use of strcpy() in load_watchdog_nodes_from_json(),
instead use strlcpy().
- Fix the size of WDNodeInfo.nodeName which was mistakenly defined as
WD_MAX_HOST_NAMELEN. Correct one is WD_MAX_NODE_NAMELEN.
Author: Tatsuo Ishii <ishii(at)sraoss(dot)co(dot)jp>
Backpatch-through: v4.3
Branch
------
master
Details
-------
https://git.postgresql.org/gitweb?p=pgpool2.git;a=commitdiff;h=a76292e80f388dea26893cc63eb270a6be9011c1
Modified Files
--------------
src/include/watchdog/wd_commands.h | 2 +-
src/include/watchdog/wd_lifecheck.h | 2 +-
src/watchdog/wd_lifecheck.c | 9 ++++++---
3 files changed, 8 insertions(+), 5 deletions(-)
| From | Date | Subject | |
|---|---|---|---|
| Next Message | Taiki Koshino | 2026-10-05 05:27:54 | pgpool: Report replication delay as -1 for down standby nodes |
| Previous Message | Tatsuo Ishii | 2026-10-01 11:16:46 | pgpool: Fix lifecheck buffer overrun. |