From ba6d9ee259cdb2a6c862a4741b16194106e00a9a Mon Sep 17 00:00:00 2001 From: Fujii Masao Date: Thu, 22 Oct 2026 16:45:45 +0900 Subject: [PATCH] Use pg_parse_lsn() for IDENTIFY_SYSTEM responses in libpqwalreceiver libpqwalreceiver parses the WAL flush location returned by IDENTIFY_SYSTEM using sscanf("%X/%X") into uint32 values. This accepts overlong components and trailing characters, potentially producing a different LSN from the one supplied by the upstream server. Use pg_parse_lsn() instead, requiring one to eight hexadecimal digits per component and no trailing characters, as for pg_lsn input. Reject malformed locations with the existing protocol violation error. Suggested-by: Ayush Tiwari Author: Hayato Kuroda Reviewed-by: Jan Nidzwetzki Reviewed-by: Fujii Masao Discussion: https://postgr.es/m/tencent_C6ED19DF1759CDD37E786F7EE0B5207D0009@qq.com --- .../replication/libpqwalreceiver/libpqwalreceiver.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/src/backend/replication/libpqwalreceiver/libpqwalreceiver.c b/src/backend/replication/libpqwalreceiver/libpqwalreceiver.c index 029990d9fce..df47ae535ce 100644 --- a/src/backend/replication/libpqwalreceiver/libpqwalreceiver.c +++ b/src/backend/replication/libpqwalreceiver/libpqwalreceiver.c @@ -23,6 +23,7 @@ #include #include "common/connect.h" +#include "common/pg_parse_lsn.h" #include "funcapi.h" #include "libpq-fe.h" #include "libpq/libpq-be-fe-helpers.h" @@ -458,15 +459,11 @@ libpqrcv_identify_system(WalReceiverConn *conn, TimeLineID *primary_tli, /* Column 2 is the server's current WAL flush position */ if (server_lsn) { - uint32 hi, - lo; - - if (sscanf(PQgetvalue(res, 0, 2), "%X/%X", &hi, &lo) != 2) + if (!pg_parse_lsn(PQgetvalue(res, 0, 2), server_lsn)) ereport(ERROR, (errcode(ERRCODE_PROTOCOL_VIOLATION), errmsg("could not parse WAL location \"%s\"", PQgetvalue(res, 0, 2)))); - *server_lsn = ((uint64) hi) << 32 | lo; } PQclear(res);