Security: Bind.Decode negative parameter length bypass (CWE-129)

[athuljayaram]

Summary

Bind.Decode in pgproto3/bind.go contains an incomplete bounds check that allows a server-controlled negative parameter length (other than the null sentinel -1) to bypass validation and cause an immediate client-side panic.

• File: pgproto3/bind.go
• Affected version: v5.8.0
• CWE: CWE-129 — Improper Validation of Array Index
• CVSS 3.1: 7.5 High — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Vulnerable Code

The parameter length is correctly read as a signed integer:

msgSize := int(int32(binary.BigEndian.Uint32(src[rp:])))

The null sentinel check (msgSize == -1) is correct. However, the bounds check that follows is:

if len(src[rp:]) < msgSize {
    return &invalidMessageFormatErr{...}
}

len() always returns a non-negative value. When msgSize is any negative value other than -1, the comparison is always false and the guard is bypassed entirely. Execution reaches:

dst.Parameters[i] = src[rp : rp+msgSize]

A negative slice upper bound causes an immediate, unrecoverable runtime panic:

panic: runtime error: slice bounds out of range [:-13619142]

Root Cause

The identical guard is already present in DataRow.Decode in the same package but was not applied to Bind.Decode:

// DataRow.Decode — correct:
} else if valueLen < 0 {
    return &invalidMessageFormatErr{messageType: "DataRow"}
}

Fix

Add a single additional condition to the existing bounds check:

- if len(src[rp:]) < msgSize {
+ if msgSize < 0 || len(src[rp:]) < msgSize {
      return &invalidMessageFormatErr{messageType: "Bind"}
  }

Impact

A malicious or compromised PostgreSQL server can crash any pgx/v5 client process by sending a Bind message with a parameter length field set to any negative value other than -1 (e.g. 0xFFFFEB7A → int32 = -5254). No authentication is required — only the ability to route the client to an attacker-controlled endpoint.

Reference

https://securityinfinity.com/research/pgx-v5-bind-decode-negative-parameter-length-bypass

[jackc]

Thanks for the report. Fixed now.

One clarification though, Bind is a Frontend message. That is, it is a message sent by the client not the server. Bind.Decode is unreachable when using pgx as a driver as pgx sends them but never receives them. Where it is reachable is when using the pgproto3 package directly for purposes such as simulating a server or acting as a proxy.