Skip to content

Avoid integer overflow in query parameter encoding#720

Merged
larskanis merged 1 commit into
masterfrom
DFVULN-797
Jun 5, 2026
Merged

Avoid integer overflow in query parameter encoding#720
larskanis merged 1 commit into
masterfrom
DFVULN-797

Conversation

@larskanis
Copy link
Copy Markdown
Collaborator

Many large bytea parameters wrapped the typecast buffer size, then the bytea encoder wrote past the allocation.

Fixes #719

Many large bytea parameters wrapped the typecast buffer size, then the bytea encoder wrote past the allocation.

Fixes #719
sql = big_count.times.map{|n| "$#{n+1}" }.join(",")
@conn.exec_params('select '+sql, params, 0, tm)
rescue PG::UnableToSend
# ignore "PQsendQueryParams cannot allocate memory for output buffer"
Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This happens when the host running the test doesn't have enough free memory?

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

libpq allocates 2 GB at the maximum, due to using signed int for the buffer size: https://github.com/postgres/postgres/blob/b45137f315bb49fa4f50ae9cc16fda0a49196610/src/interfaces/libpq/fe-misc.c#L301
So this test will always raise PG::UnableToSend with the current libpq implementation. The important thing here is that it doesn't crash due to memory access error.

@larskanis larskanis merged commit b9f12a6 into master Jun 5, 2026
23 of 24 checks passed
@larskanis larskanis deleted the DFVULN-797 branch June 5, 2026 16:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

DFVULN-797: Integer Overflow in Query Parameter Encoding Causes Heap Buffer Overflow

2 participants