Return errors instead of panicking on malformed binary records

The binary record header carries a signed int32 field count read
straight off the wire, and RecordCodec.DecodeValue used it to size the
value slice. Three index panics followed from trusting it:

- A negative count reached make([]any, count) and panicked with
  "makeslice: len out of range". An oversized count requested an
  allocation unrelated to the data actually present.
- A count that understated the number of fields on the wire ran
  values[i] past the end of the presized slice.
- A source with more fields than the destination CompositeFields has
  slots indexed past the end of that slice. This one needs no malformed
  input at all: scanning "select row('foo'::text, 42::int4)" into a
  one-element CompositeFields panicked against a stock server.

Validate the count in NewCompositeBinaryScanner the way
MultirangeCodec.decodeBinary validates its element count, bounding it
against the bytes available (each field needs at least 8 for its OID and
length prefix). Append the values actually scanned rather than indexing
into a presized slice, and report a field count mismatch against
CompositeFields as an error from both the record and composite scan
plans.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: jackc

pgtype/composite.go

@@ -139,14 +139,17 @@ func (plan *scanPlanBinaryCompositeToCompositeIndexScanner) Scan(src []byte, tar
 	scanner := NewCompositeBinaryScanner(plan.m, src)
 	for i, field := range plan.cc.Fields {
 		if scanner.Next() {
-			fieldTarget := targetScanner.ScanIndex(i)
+			fieldTarget, err := compositeFieldTarget(targetScanner, i)
+			if err != nil {
+				return err
+			}
 			if fieldTarget != nil {
 				fieldPlan := plan.m.PlanScan(field.Type.OID, BinaryFormatCode, fieldTarget)
 				if fieldPlan == nil {
 					return fmt.Errorf("unable to encode %v into OID %d in binary format", field, field.Type.OID)
 				}
 
-				err := fieldPlan.Scan(scanner.Bytes(), fieldTarget)
+				err = fieldPlan.Scan(scanner.Bytes(), fieldTarget)
 				if err != nil {
 					return err
 				}
@@ -297,6 +300,15 @@ func NewCompositeBinaryScanner(m *Map, src []byte) *CompositeBinaryScanner {
 	fieldCount := int32(binary.BigEndian.Uint32(src[rp:]))
 	rp += 4
 
+	if fieldCount < 0 {
+		return &CompositeBinaryScanner{err: fmt.Errorf("Record field count %d is negative", fieldCount)}
+	}
+
+	// Each field requires at least 8 bytes: 4 for the OID and 4 for the length prefix.
+	if int(fieldCount) > len(src[rp:])/8 {
+		return &CompositeBinaryScanner{err: fmt.Errorf("Record field count %d exceeds available data", fieldCount)}
+	}
+
 	return &CompositeBinaryScanner{
 		m:          m,
 		rp:         rp,
@@ -344,6 +356,17 @@ func (cfs *CompositeBinaryScanner) FieldCount() int {
 	return int(cfs.fieldCount)
 }
 
+// compositeFieldTarget returns the scan target for field i. CompositeFields is
+// a slice, so indexing past its end would panic. A source with more fields than
+// the destination is a mismatch that must be reported as an error.
+func compositeFieldTarget(targetScanner CompositeIndexScanner, i int) (any, error) {
+	if cf, ok := targetScanner.(CompositeFields); ok && i >= len(cf) {
+		return nil, fmt.Errorf("cannot scan composite field %d into CompositeFields of length %d", i, len(cf))
+	}
+
+	return targetScanner.ScanIndex(i), nil
+}
+
 // Bytes returns the bytes of the field most recently read by Scan().
 func (cfs *CompositeBinaryScanner) Bytes() []byte {
 	return cfs.fieldBytes

pgtype/record_codec.go

@@ -48,14 +48,17 @@ func (plan *scanPlanBinaryRecordToCompositeIndexScanner) Scan(src []byte, target
 
 	scanner := NewCompositeBinaryScanner(plan.m, src)
 	for i := 0; scanner.Next(); i++ {
-		fieldTarget := targetScanner.ScanIndex(i)
+		fieldTarget, err := compositeFieldTarget(targetScanner, i)
+		if err != nil {
+			return err
+		}
 		if fieldTarget != nil {
 			fieldPlan := plan.m.PlanScan(scanner.OID(), BinaryFormatCode, fieldTarget)
 			if fieldPlan == nil {
 				return fmt.Errorf("unable to scan OID %d in binary format into %v", scanner.OID(), fieldTarget)
 			}
 
-			err := fieldPlan.Scan(scanner.Bytes(), fieldTarget)
+			err = fieldPlan.Scan(scanner.Bytes(), fieldTarget)
 			if err != nil {
 				return err
 			}
@@ -96,8 +99,11 @@ func (RecordCodec) DecodeValue(m *Map, oid uint32, format int16, src []byte) (an
 		return string(src), nil
 	case BinaryFormatCode:
 		scanner := NewCompositeBinaryScanner(m, src)
-		values := make([]any, scanner.FieldCount())
-		for i := 0; scanner.Next(); i++ {
+		// The field count is a hint for the initial allocation only. Append the
+		// values actually present rather than indexing into a presized slice, as
+		// the source may carry more or fewer fields than the header claims.
+		values := make([]any, 0, scanner.FieldCount())
+		for scanner.Next() {
 			var v any
 			fieldPlan := m.PlanScan(scanner.OID(), BinaryFormatCode, &v)
 			if fieldPlan == nil {
@@ -109,7 +115,7 @@ func (RecordCodec) DecodeValue(m *Map, oid uint32, format int16, src []byte) (an
 				return nil, err
 			}
 
-			values[i] = v
+			values = append(values, v)
 		}
 
 		if err := scanner.Err(); err != nil {

pgtype/record_malformed_test.go

@@ -0,0 +1,172 @@
+package pgtype_test
+
+import (
+	"testing"
+
+	"github.com/jackc/pgx/v5/pgtype"
+)
+
+// int4Field builds the binary wire encoding of one non-NULL int4 record field.
+func int4Field(v byte) []byte {
+	return []byte{0x00, 0x00, 0x00, 0x17, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, v}
+}
+
+// A binary record header carries a signed int32 field count taken straight from
+// the wire. A negative count reached make([]any, count) and panicked with
+// "makeslice: len out of range", and an oversized count requested an allocation
+// unrelated to the amount of data actually present.
+func TestRecordBinaryDecodeMalformedFieldCountReturnsError(t *testing.T) {
+	m := pgtype.NewMap()
+	dt, ok := m.TypeForOID(pgtype.RecordOID)
+	if !ok {
+		t.Fatal("no type registered for record OID")
+	}
+
+	for _, tt := range []struct {
+		name string
+		src  []byte
+	}{
+		{"negative", []byte{0xff, 0xff, 0xff, 0xff}},
+		{"negative min", []byte{0x80, 0x00, 0x00, 0x00}},
+		{"oversized", []byte{0x7f, 0xff, 0xff, 0xff}},
+		{"count exceeds data", []byte{0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x17, 0xff, 0xff, 0xff, 0xff}},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			// A panic here (pre-fix) fails the test.
+			if _, err := dt.Codec.DecodeValue(m, pgtype.RecordOID, pgtype.BinaryFormatCode, tt.src); err == nil {
+				t.Errorf("DecodeValue(% x) = nil error, want an error", tt.src)
+			}
+		})
+	}
+}
+
+// A field count that understates how many fields follow must not run past the
+// end of the presized value slice.
+func TestRecordBinaryDecodeFieldCountUnderstated(t *testing.T) {
+	m := pgtype.NewMap()
+	dt, ok := m.TypeForOID(pgtype.RecordOID)
+	if !ok {
+		t.Fatal("no type registered for record OID")
+	}
+
+	for _, tt := range []struct {
+		name string
+		src  []byte
+		want int
+	}{
+		{"count 0, one field", append([]byte{0x00, 0x00, 0x00, 0x00}, int4Field(1)...), 1},
+		{"count 1, two fields", append(append([]byte{0x00, 0x00, 0x00, 0x01}, int4Field(1)...), int4Field(2)...), 2},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			// A panic here (pre-fix) fails the test.
+			v, err := dt.Codec.DecodeValue(m, pgtype.RecordOID, pgtype.BinaryFormatCode, tt.src)
+			if err != nil {
+				t.Fatalf("unexpected error: %v", err)
+			}
+			values, ok := v.([]any)
+			if !ok {
+				t.Fatalf("got %T, want []any", v)
+			}
+			if len(values) != tt.want {
+				t.Errorf("got %d values (%v), want %d", len(values), values, tt.want)
+			}
+		})
+	}
+}
+
+// Scanning a row with more fields than the destination CompositeFields has
+// slots indexed past the end of the slice and panicked. This needs no malformed
+// input — "select row('foo'::text, 42::int4)" into a one-element
+// CompositeFields is enough.
+func TestRecordScanUndersizedCompositeFieldsReturnsError(t *testing.T) {
+	m := pgtype.NewMap()
+
+	src := append(append([]byte{0x00, 0x00, 0x00, 0x02}, int4Field(1)...), int4Field(2)...)
+
+	var a int32
+	dst := pgtype.CompositeFields{&a}
+
+	plan := m.PlanScan(pgtype.RecordOID, pgtype.BinaryFormatCode, dst)
+	// A panic here (pre-fix) fails the test.
+	if err := plan.Scan(src, dst); err == nil {
+		t.Error("Scan into undersized CompositeFields = nil error, want an error")
+	}
+}
+
+// The composite codec reaches the same destination indexing through its own
+// scan plan.
+func TestCompositeScanUndersizedCompositeFieldsReturnsError(t *testing.T) {
+	m := pgtype.NewMap()
+	int4Type, ok := m.TypeForOID(pgtype.Int4OID)
+	if !ok {
+		t.Fatal("no type registered for int4 OID")
+	}
+
+	const compositeOID = 100000
+	m.RegisterType(&pgtype.Type{
+		Name: "test_composite",
+		OID:  compositeOID,
+		Codec: &pgtype.CompositeCodec{Fields: []pgtype.CompositeCodecField{
+			{Name: "a", Type: int4Type},
+			{Name: "b", Type: int4Type},
+		}},
+	})
+
+	src := append(append([]byte{0x00, 0x00, 0x00, 0x02}, int4Field(1)...), int4Field(2)...)
+
+	var a int32
+	dst := pgtype.CompositeFields{&a}
+
+	plan := m.PlanScan(compositeOID, pgtype.BinaryFormatCode, dst)
+	// A panic here (pre-fix) fails the test.
+	if err := plan.Scan(src, dst); err == nil {
+		t.Error("Scan into undersized CompositeFields = nil error, want an error")
+	}
+}
+
+// Well-formed records still decode after the guards were added.
+func TestRecordBinaryDecodeValid(t *testing.T) {
+	m := pgtype.NewMap()
+	dt, ok := m.TypeForOID(pgtype.RecordOID)
+	if !ok {
+		t.Fatal("no type registered for record OID")
+	}
+
+	for _, tt := range []struct {
+		name string
+		src  []byte
+		want []any
+	}{
+		{"empty", []byte{0x00, 0x00, 0x00, 0x00}, []any{}},
+		{"one field", append([]byte{0x00, 0x00, 0x00, 0x01}, int4Field(1)...), []any{int32(1)}},
+		{
+			"two fields",
+			append(append([]byte{0x00, 0x00, 0x00, 0x02}, int4Field(1)...), int4Field(2)...),
+			[]any{int32(1), int32(2)},
+		},
+		{
+			"null field",
+			[]byte{0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x17, 0xff, 0xff, 0xff, 0xff},
+			[]any{nil},
+		},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			v, err := dt.Codec.DecodeValue(m, pgtype.RecordOID, pgtype.BinaryFormatCode, tt.src)
+			if err != nil {
+				t.Fatalf("unexpected error: %v", err)
+			}
+			values, ok := v.([]any)
+			if !ok {
+				t.Fatalf("got %T, want []any", v)
+			}
+			if len(values) != len(tt.want) {
+				t.Fatalf("got %v, want %v", values, tt.want)
+			}
+			for i := range tt.want {
+				if values[i] != tt.want[i] {
+					t.Errorf("field %d: got %v, want %v", i, values[i], tt.want[i])
+				}
+			}
+		})
+	}
+}