From dd50eb9145eead17ebd62db2e43a6de7c53102c0 Mon Sep 17 00:00:00 2001 From: Michael Paquier Date: Wed, 29 Jul 2026 08:54:11 +0900 Subject: [PATCH] Use more strlcpy() in two-phase transaction code This commit replaces two calls of strcpy() and one call of strncpy() to use strlcpy(), which are patterns that static analyzers (mostly LLMs, it seems) have been complaining regarding buffer overflow risks. The existing calls are safe, here are more details for each one of them: - MarkAsPreparingGuts()'s strcpy() was guarded by MarkAsPreparing(). - PrepareRedoAdd()'s strcpy() is safe because the record-level CRC check prevents corrupted data from reaching it unless intentionally crafted. The replay code also assumes that the GID is within the allowed bounds, as WAL records are trusted. - Similarly, ParsePrepareRecord() stores its GID in a buffer bounded by GIDSIZE while trusting the length provided by the record. As a result, these changes are purely cosmetic. They adopt a more defensive coding style and should also silence some of the static analysis reports received recently. Author: Matt Suiche Discussion: https://postgr.es/m/CAGf6Lfx2kbQfcEnCi99V2i65JSWD6ij_E29F+UkY=TyMUyeG6A@mail.gmail.com --- src/backend/access/rmgrdesc/xactdesc.c | 2 +- src/backend/access/transam/twophase.c | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/src/backend/access/rmgrdesc/xactdesc.c b/src/backend/access/rmgrdesc/xactdesc.c index 4f53d3035cc..96aa6e17bd5 100644 --- a/src/backend/access/rmgrdesc/xactdesc.c +++ b/src/backend/access/rmgrdesc/xactdesc.c @@ -256,7 +256,7 @@ ParsePrepareRecord(uint8 info, xl_xact_prepare *xlrec, xl_xact_parsed_prepare *p parsed->nabortstats = xlrec->nabortstats; parsed->nmsgs = xlrec->ninvalmsgs; - strncpy(parsed->twophase_gid, bufptr, xlrec->gidlen); + strlcpy(parsed->twophase_gid, bufptr, GIDSIZE); bufptr += MAXALIGN(xlrec->gidlen); parsed->subxacts = (TransactionId *) bufptr; diff --git a/src/backend/access/transam/twophase.c b/src/backend/access/transam/twophase.c index 439e28c9987..fa3bc50ec48 100644 --- a/src/backend/access/transam/twophase.c +++ b/src/backend/access/transam/twophase.c @@ -492,7 +492,7 @@ MarkAsPreparingGuts(GlobalTransaction gxact, FullTransactionId fxid, gxact->locking_backend = MyProcNumber; gxact->valid = false; gxact->inredo = false; - strcpy(gxact->gid, gid); + strlcpy(gxact->gid, gid, GIDSIZE); /* * Remember that we have this GlobalTransaction entry locked for us. If we @@ -2597,7 +2597,7 @@ PrepareRedoAdd(FullTransactionId fxid, char *buf, gxact->valid = false; gxact->ondisk = !XLogRecPtrIsValid(start_lsn); gxact->inredo = true; /* yes, added in redo */ - strcpy(gxact->gid, gid); + strlcpy(gxact->gid, gid, GIDSIZE); /* And insert it into the active array */ Assert(TwoPhaseState->numPrepXacts < max_prepared_xacts); -- 2.47.3