From d6fd1c3683ecf17af8eeee658294bf779841282d Mon Sep 17 00:00:00 2001 From: Taiki Koshino Date: Tue, 8 Sep 2026 15:48:05 +0900 Subject: [PATCH v1] Fix response buffer pointer advancement in do_error_execute_command The response body is copied len bytes, but the buffer pointer was advanced by sizeof(len). When a zero-length response body was received, the pointer advanced by four bytes even though no body was copied, causing subsequent saved responses to be corrupted. Advance the pointer by len in both protocol v2 and v3 paths. Author: Taiki Koshino Backpatch-through: v4.3 --- src/protocol/pool_process_query.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/protocol/pool_process_query.c b/src/protocol/pool_process_query.c index 202afa2a3..47ca55c85 100644 --- a/src/protocol/pool_process_query.c +++ b/src/protocol/pool_process_query.c @@ -1826,7 +1826,7 @@ do_error_execute_command(POOL_CONNECTION_POOL *backend, int node_id, int major) } memcpy(p, string, len); - p += sizeof(len); + p += len; } } else @@ -1847,7 +1847,7 @@ do_error_execute_command(POOL_CONNECTION_POOL *backend, int node_id, int major) errdetail("not enough space in buffer"))); } memcpy(p, string, len); - p += sizeof(len); + p += len; } } } while (kind != 'E'); -- 2.52.0