From 591ed4beea42e0982d5fbb0aaae1abf27ad8b099 Mon Sep 17 00:00:00 2001 From: Jelte Fennema-Nio Date: Wed, 25 Jun 2025 08:54:15 +0200 Subject: [PATCH v1 2/2] libpq: Disallow cancel keys longer than 256 bytes The protocol documentation states that the maximum length of a cancel key is 256 bytes. This starts checking for that limit in libpq. Otherwise third party backend implementations will probably start using more bytes anyway. --- src/interfaces/libpq/fe-protocol3.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/interfaces/libpq/fe-protocol3.c b/src/interfaces/libpq/fe-protocol3.c index beb1c889aad..fc34fb52766 100644 --- a/src/interfaces/libpq/fe-protocol3.c +++ b/src/interfaces/libpq/fe-protocol3.c @@ -1546,6 +1546,12 @@ getBackendKeyData(PGconn *conn, int msgLength) cancel_key_len = 5 + msgLength - (conn->inCursor - conn->inStart); + if (cancel_key_len > 256) + { + libpq_append_conn_error(conn, "received invalid BackendKeyData message: cancel key length %d exceeds maximum of 256 bytes", cancel_key_len); + return EOF; + } + conn->be_cancel_key = malloc(cancel_key_len); if (conn->be_cancel_key == NULL) { -- 2.43.0