Fix buffer overflow error in show pool_status.

"show pool_status", "pgpool show" and pcp_pool_status could cause a
buffer overflow error. If backend_flag is set to "ALWAYS_PRIMARY",
pool_flag_to_str(), which is responsible to produce printable format
of backend_flag, wrote data past to the end of static buffer.

Author: Tatsuo Ishii <ishii@postgresql.org>
Reported-by: zam bak <zam6ak@gmail.com>
Reviewed-by: Bo Peng <pengbo@sraoss.co.jp>
Discussion: https://www.postgresql.org/message-id/20251202.140205.427777414210613577.ishii%40postgresql.org
Backpatch-through: v4.3

diff --git a/src/config/pool_config.l b/src/config/pool_config.l
index b681e8a38661474782f829e0b5e7a285338a7899..542a0c0c4ee651822ee3478d84fad4d74c645e77 100644 (file)
--- a/src/config/pool_config.l
+++ b/src/config/pool_config.l
@@ -6,7 +6,7 @@
  * pgpool: a language independent connection pool server for PostgreSQL
  * written by Tatsuo Ishii
  *
- * Copyright (c) 2003-2024     PgPool Global Development Group
+ * Copyright (c) 2003-2025     PgPool Global Development Group
  *
  * Permission to use, copy, modify, and distribute this software and
  * its documentation for any purpose and without fee is hereby
@@ -643,7 +643,7 @@ char *pool_flag_to_str(unsigned short flag)
                if (*buf == '\0')
                        snprintf(buf, sizeof(buf), "ALWAYS_PRIMARY");
                else
-                       snprintf(buf+strlen(buf), sizeof(buf), "|ALWAYS_PRIMARY");
+                       strncat(buf, "|ALWAYS_PRIMARY", 16);
        }
 
        return buf;

diff --git a/src/config/pool_config_variables.c b/src/config/pool_config_variables.c
index f6d992a0ec837de1fdae922633d70559e85cd503..07c067e1f2059566b9eadcbd0e292ba0b2ba1121 100644 (file)
--- a/src/config/pool_config_variables.c
+++ b/src/config/pool_config_variables.c
@@ -4,7 +4,7 @@
  * pgpool: a language independent connection pool server for PostgreSQL
  * written by Tatsuo Ishii
  *
- * Copyright (c) 2003-2023     PgPool Global Development Group
+ * Copyright (c) 2003-2025     PgPool Global Development Group
  *
  * Permission to use, copy, modify, and distribute this software and
  * its documentation for any purpose and without fee is hereby
@@ -4510,7 +4510,7 @@ BackendFlagsShowFunc(int index)
                if (*buffer == '\0')
                        snprintf(buffer, sizeof(buffer), "ALWAYS_PRIMARY");
                else
-                       snprintf(buffer+strlen(buffer), sizeof(buffer), "|ALWAYS_PRIMARY");
+                       strncat(buffer, "|ALWAYS_PRIMARY", 16);
        }
        return buffer;
 }