From f60e49fe8ec38a0a461558c37d4c308c4bd2cdfc Mon Sep 17 00:00:00 2001 From: Conrad Ludgate Date: Tue, 5 Dec 2023 10:24:16 +0000 Subject: [PATCH] proxy: fix panic in startup packet (#6032) ## Problem Panic when less than 8 bytes is presented in a startup packet. ## Summary of changes We need there to be a 4 byte message code, so the expected min length is 8. --- libs/pq_proto/src/lib.rs | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/libs/pq_proto/src/lib.rs b/libs/pq_proto/src/lib.rs index 41fc206cd7..c52a21bcd3 100644 --- a/libs/pq_proto/src/lib.rs +++ b/libs/pq_proto/src/lib.rs @@ -289,10 +289,10 @@ impl FeStartupPacket { // We shouldn't advance `buf` as probably full message is not there yet, // so can't directly use Bytes::get_u32 etc. let len = (&buf[0..4]).read_u32::().unwrap() as usize; - // The proposed replacement is `!(4..=MAX_STARTUP_PACKET_LENGTH).contains(&len)` + // The proposed replacement is `!(8..=MAX_STARTUP_PACKET_LENGTH).contains(&len)` // which is less readable #[allow(clippy::manual_range_contains)] - if len < 4 || len > MAX_STARTUP_PACKET_LENGTH { + if len < 8 || len > MAX_STARTUP_PACKET_LENGTH { return Err(ProtocolError::Protocol(format!( "invalid startup packet message length {}", len @@ -975,4 +975,10 @@ mod tests { let params = make_params("foo\\ bar \\ \\\\ baz\\ lol"); assert_eq!(split_options(¶ms), ["foo bar", " \\", "baz ", "lol"]); } + + #[test] + fn parse_fe_startup_packet_regression() { + let data = [0, 0, 0, 7, 0, 0, 0, 0]; + FeStartupPacket::parse(&mut BytesMut::from_iter(data)).unwrap_err(); + } }