Use more strlcpy() in two-phase transaction code

This commit replaces two calls of strcpy() and one call of strncpy() to
use strlcpy(), which are patterns that static analyzers (mostly LLMs, it
seems) have been complaining regarding buffer overflow risks.

The existing calls are safe, here are more details for each one of them:
- MarkAsPreparingGuts()'s strcpy() was guarded by MarkAsPreparing().
- PrepareRedoAdd()'s strcpy() is safe because the record-level CRC check
prevents corrupted data from reaching it unless intentionally
crafted.  The replay code also assumes that the GID is within the allowed
bounds, as WAL records are trusted.
- Similarly, ParsePrepareRecord() stores its GID in a buffer bounded by
GIDSIZE while trusting the length provided by the record.

As a result, these changes are purely cosmetic.  They adopt a more
defensive coding style and should also silence some of the static
analysis reports received recently.

Author: Matt Suiche <matt@tolmo.com>
Discussion: https://postgr.es/m/CAGf6Lfx2kbQfcEnCi99V2i65JSWD6ij_E29F+UkY=TyMUyeG6A@mail.gmail.com

diff --git a/src/backend/access/rmgrdesc/xactdesc.c b/src/backend/access/rmgrdesc/xactdesc.c
index 4f53d3035cc26803c49899bcf2f9948c91556f39..96aa6e17bd50ce60de0e54965363555ce2eef5cc 100644 (file)
--- a/src/backend/access/rmgrdesc/xactdesc.c
+++ b/src/backend/access/rmgrdesc/xactdesc.c
@@ -256,7 +256,7 @@ ParsePrepareRecord(uint8 info, xl_xact_prepare *xlrec, xl_xact_parsed_prepare *p
        parsed->nabortstats = xlrec->nabortstats;
        parsed->nmsgs = xlrec->ninvalmsgs;
 
-       strncpy(parsed->twophase_gid, bufptr, xlrec->gidlen);
+       strlcpy(parsed->twophase_gid, bufptr, GIDSIZE);
        bufptr += MAXALIGN(xlrec->gidlen);
 
        parsed->subxacts = (TransactionId *) bufptr;

diff --git a/src/backend/access/transam/twophase.c b/src/backend/access/transam/twophase.c
index 439e28c9987f90657dadb10d89650a477e9c1c74..fa3bc50ec483af3db4046fddfabd8eafbee360fb 100644 (file)
--- a/src/backend/access/transam/twophase.c
+++ b/src/backend/access/transam/twophase.c
@@ -492,7 +492,7 @@ MarkAsPreparingGuts(GlobalTransaction gxact, FullTransactionId fxid,
        gxact->locking_backend = MyProcNumber;
        gxact->valid = false;
        gxact->inredo = false;
-       strcpy(gxact->gid, gid);
+       strlcpy(gxact->gid, gid, GIDSIZE);
 
        /*
         * Remember that we have this GlobalTransaction entry locked for us. If we
@@ -2597,7 +2597,7 @@ PrepareRedoAdd(FullTransactionId fxid, char *buf,
        gxact->valid = false;
        gxact->ondisk = !XLogRecPtrIsValid(start_lsn);
        gxact->inredo = true;           /* yes, added in redo */
-       strcpy(gxact->gid, gid);
+       strlcpy(gxact->gid, gid, GIDSIZE);
 
        /* And insert it into the active array */
        Assert(TwoPhaseState->numPrepXacts < max_prepared_xacts);