From 39b17e850b49f1d1e429f6f165747c2d91e66db0 Mon Sep 17 00:00:00 2001 From: sunliqiang Date: Fri, 31 Jul 2026 14:08:12 +0800 Subject: [PATCH] Remove no-op isc_info_svc_dump_pool_info handler This SPB item has never worked - items pointer is not advanced after the copy, causing an infinite loop. The handler also reads a network-supplied length without checking it against the SPB buffer boundary. Remove both occurrences in Service::query() and Service::query2(). Per maintainers' feedback, dead code is better deleted than fixed. --- src/jrd/svc.cpp | 23 ----------------------- 1 file changed, 23 deletions(-) diff --git a/src/jrd/svc.cpp b/src/jrd/svc.cpp index 7a254527763..88d42ddd573 100644 --- a/src/jrd/svc.cpp +++ b/src/jrd/svc.cpp @@ -1250,18 +1250,6 @@ ISC_STATUS Service::query2(thread_db* /*tdbb*/, } break; - case isc_info_svc_dump_pool_info: - { - char fname[MAXPATHLEN]; - size_t length2 = gds__vax_integer(items, sizeof(USHORT)); - if (length2 >= sizeof(fname)) - length2 = sizeof(fname) - 1; // truncation - items += sizeof(USHORT); - strncpy(fname, (const char*) items, length2); - fname[length2] = 0; - break; - } - case isc_info_svc_get_config: // TODO: iterate through all integer-based config values // and return them to the client @@ -1704,17 +1692,6 @@ void Service::query(USHORT send_item_length, // need_admin_privs(status, "isc_info_svc_get_env"); break; - case isc_info_svc_dump_pool_info: - { - char fname[MAXPATHLEN]; - size_t length2 = gds__vax_integer(items, sizeof(USHORT)); - if (length2 >= sizeof(fname)) - length2 = sizeof(fname) - 1; // truncation - items += sizeof(USHORT); - memcpy(fname, items, length2); - fname[length2] = 0; - break; - } /* case isc_info_svc_get_config: // TODO: iterate through all integer-based config values