Re: Fix unsigned underflow in inject_cached_message

Thank you for reviewing the patch.
I have prepared an updated patch with the Discussion: field filled in.
Taiki Koshino<koshino(at)sraoss(dot)co(dot)jp>
SRA OSS K.K.
TEL: 03-5979-2701 FAX: 03-5979-2702
URL: https://www.sraoss.co.jp/

________________________________
差出人: Tatsuo Ishii <ishii(at)postgresql(dot)org>
送信日時: 2026年8月17日 15:18
宛先: Koshino Taiki <koshino(at)sraoss(dot)co(dot)jp>
CC: pgpool-hackers(at)lists(dot)postgresql(dot)org <pgpool-hackers(at)lists(dot)postgresql(dot)org>; emond(dot)papegaaij(at)gmail(dot)com <emond(dot)papegaaij(at)gmail(dot)com>
件名: Re: Fix unsigned underflow in inject_cached_message

> I have reviewed the patch(011-inject-cached-message-underflow) from Emond.
> It has also passed all regression tests.
>
> This patch modifies the packet length validation in inject_cached_message to prevent
> a session crash caused by an unsigned integer underflow.
>
> Previously, the logic determined whether to process a query cache message by checking
> if the packet length minus its header size was greater than zero(if ((ntohl(len) - sizeof(len)) > 0)).
>
> However, this evaluation method introduced a critical vulnerability under unsigned arithmetic rules.
>
> When a corrupt packet with a payload length shorter than the header size is processed,
> the subtraction underflows into a massive positive integer,
> bypassing the guard and forcing a fatal memory allocation failure that terminates the session.
> In our local test environment, injecting a short packet successfully reproduced this exact behavior,
> causing a memory context allocation crash.
>
> The updated logic changes the condition to a direct comparison
> before subtraction(if (ntohl(len) > (uint32) sizeof(len))),
> ensuring that invalid short packets are securely blocked and the session remains stable,
> which proves the fix is highly valid.
>
> Thank you Emond.

I have looked into the patch. It looks good to me.

Regards,
--
Tatsuo Ishii
SRA OSS K.K.
English: http://www.sraoss.co.jp/index_en/
Japanese:http://www.sraoss.co.jp