From e92794fb00dd5da1671dfa92c936fa544c1549d1 Mon Sep 17 00:00:00 2001 From: roman khapov Date: Thu, 29 Oct 2026 16:15:17 +0500 Subject: [PATCH v2] libpq: guard select() fallback against fds >= FD_SETSIZE On platforms without poll(2), PQsocketPoll() calls FD_SET() on the connection socket without checking the fd number first. If the socket fd is at or above FD_SETSIZE, FD_SET() writes out of bounds on such platforms. Fail cleanly with EINVAL instead. Not needed on Windows, where fd_set is a bounded array and FD_SET() checks its limits.. --- src/interfaces/libpq/fe-misc.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/src/interfaces/libpq/fe-misc.c b/src/interfaces/libpq/fe-misc.c index 73d10e5..42c59b1 100644 --- a/src/interfaces/libpq/fe-misc.c +++ b/src/interfaces/libpq/fe-misc.c @@ -1328,6 +1328,20 @@ PQsocketPoll(int sock, int forRead, int forWrite, pg_usec_time_t end_time) if (!forRead && !forWrite) return 0; + /* + * On platforms where we must use select(2), fail cleanly instead of + * overrunning the fd_set if the socket's descriptor is too large. + * Skip this on Windows: its fd_set is a bounded array, so FD_SET() + * cannot overrun. + */ +#ifndef WIN32 + if (sock >= FD_SETSIZE) + { + SOCK_ERRNO_SET(EINVAL); + return -1; + } +#endif + FD_ZERO(&input_mask); FD_ZERO(&output_mask); FD_ZERO(&except_mask); -- 2.50.1 (Apple Git-155)