pgbouncer / pgbouncer

lightweight connection pooler for PostgreSQL
https://www.pgbouncer.org/
Other
2.97k stars 450 forks source link

The pointer was unsafely used after null checking #1159

Open ProjectMutilation opened 1 month ago

ProjectMutilation commented 1 month ago

src/proto.c - bool send_startup_packet()

    client = first_socket(&pool->waiting_client_list);
    if (client && client->replication) {
        server->replication = client->replication;
                ...
       }
    if (server->replication) {
        client->link = server; // client was dereferenced if server->replication isn't NULL initially

Maybe I'm wrong and server-> replication is always NULL at the input

JelteF commented 1 month ago

I don't think this is a problem, because server->replication can only be set to a non-zero value if client is non-null. But I agree that is not super obvious. I think this would benefit from a comment, or an explicit check. Feel free to create a PR for that.