Fix buffer overflow error in show pool_status.

"show pool_status", "pgpool show" and pcp_pool_status could cause a
buffer overflow error. If backend_flag is set to "ALWAYS_PRIMARY",
pool_flag_to_str(), which is responsible to produce printable format
of backend_flag, wrote data past to the end of static buffer.

Author: Tatsuo Ishii <ishii@postgresql.org>
Reported-by: zam bak <zam6ak@gmail.com>
Reviewed-by: Bo Peng <pengbo@sraoss.co.jp>
Discussion: https://www.postgresql.org/message-id/20251202.140205.427777414210613577.ishii%40postgresql.org
Backpatch-through: v4.3

diff --git a/src/config/pool_config.l b/src/config/pool_config.l
index b1613029351be5a6a11cf5706b2ab169b0ee3744..a75cedb1612c14db2ba032ac8d78ec60c82c647d 100644 (file)
--- a/src/config/pool_config.l
+++ b/src/config/pool_config.l
@@ -6,7 +6,7 @@
  * pgpool: a language independent connection pool server for PostgreSQL
  * written by Tatsuo Ishii
  *
- * Copyright (c) 2003-2024     PgPool Global Development Group
+ * Copyright (c) 2003-2025     PgPool Global Development Group
  *
  * Permission to use, copy, modify, and distribute this software and
  * its documentation for any purpose and without fee is hereby
@@ -654,7 +654,7 @@ char *pool_flag_to_str(unsigned short flag)
                if (*buf == '\0')
                        snprintf(buf, sizeof(buf), "ALWAYS_PRIMARY");
                else
-                       snprintf(buf+strlen(buf), sizeof(buf), "|ALWAYS_PRIMARY");
+                       strncat(buf, "|ALWAYS_PRIMARY", 16);
        }
 
        return buf;

diff --git a/src/config/pool_config_variables.c b/src/config/pool_config_variables.c
index 5e61f02db4cf715ae239a3b2d27b2ca58067d17f..5a738fc1f2c2e6877936dd91c0c3636ae4a82fe4 100644 (file)
--- a/src/config/pool_config_variables.c
+++ b/src/config/pool_config_variables.c
@@ -4,7 +4,7 @@
  * pgpool: a language independent connection pool server for PostgreSQL
  * written by Tatsuo Ishii
  *
- * Copyright (c) 2003-2024     PgPool Global Development Group
+ * Copyright (c) 2003-2025     PgPool Global Development Group
  *
  * Permission to use, copy, modify, and distribute this software and
  * its documentation for any purpose and without fee is hereby
@@ -4541,7 +4541,7 @@ BackendFlagsShowFunc(int index)
                if (*buffer == '\0')
                        snprintf(buffer, sizeof(buffer), "ALWAYS_PRIMARY");
                else
-                       snprintf(buffer+strlen(buffer), sizeof(buffer), "|ALWAYS_PRIMARY");
+                       strncat(buffer, "|ALWAYS_PRIMARY", 16);
        }
        return buffer;
 }