From 83d16f3c22b4909975df3f122e2fd3c6315d482c Mon Sep 17 00:00:00 2001 From: Rahim Kanji Date: Sun, 1 Mar 2026 19:12:53 +0500 Subject: [PATCH] Fix buffer handling in PostgreSQL admin session handler Improve error handling in admin_session_handler when processing PostgreSQL query packets: * Fix potential underflow in query_length calculation when handling very small packets (< 2 bytes) * Fix NULL pointer dereference in strcasecmp when query_no_space is not initialized due to early packet validation failures --- lib/Admin_Handler.cpp | 20 +++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-) diff --git a/lib/Admin_Handler.cpp b/lib/Admin_Handler.cpp index d0c48bda4..58185f634 100644 --- a/lib/Admin_Handler.cpp +++ b/lib/Admin_Handler.cpp @@ -2875,6 +2875,15 @@ void admin_session_handler(S* sess, void *_pa, PtrSize_t *pkt) { } query_length = hdr.data.size; + + // Validate minimum query size (need at least 1 byte + null terminator) + if (query_length < 2 || hdr.data.ptr == NULL) { + proxy_warning("Query too short: %u bytes\n", query_length); + SPA->send_error_msg_to_client(sess, "Malformed query packet"); + run_query = false; + goto __run_query; + } + query = (char*)l_alloc(query_length); memcpy(query, (char*)hdr.data.ptr, query_length - 1); } else { @@ -4712,7 +4721,7 @@ __run_query: pthread_mutex_unlock(&pa->sql_query_global_mutex); } else { // The admin module may have already been freed in case of "PROXYSQL STOP" - if (strcasecmp(query_no_space, "PROXYSQL STOP") == 0) { + if (query_no_space && strcasecmp(query_no_space, "PROXYSQL STOP") == 0) { // Command is "PROXYSQL STOP" if (admin_nostart_ && __sync_fetch_and_add((uint8_t*)&GloVars.global.nostart, 0)) { pthread_mutex_unlock(&pa->sql_query_global_mutex); @@ -4721,8 +4730,13 @@ __run_query: pthread_mutex_unlock(&pa->sql_query_global_mutex); } } - l_free(pkt->size-sizeof(mysql_hdr),query_no_space); // it is always freed here - l_free(query_length,query); + + if (query_no_space) { + l_free(query_length, query_no_space); + } + if (query) { + l_free(query_length, query); + } } // Explicitly instantiate the required template class and member functions