src/backend/access/transam/xlog.c (2)

5443-5444: Prevent buffer overflow when composing control path

pathname is a fixed 1 KB buffer, but make_absolute_path() can return arbitrarily long strings. sprintf() will happily overrun pathname, leading to memory corruption. Use a bounded call (snprintf), and validate the result before proceeding.

-	sprintf(pathname,"%s/%s",configdir,XLOG_CONTROL_FILE);
+	if (snprintf(pathname, sizeof(pathname), "%s/%s", configdir, XLOG_CONTROL_FILE) >= sizeof(pathname))
+	{
+		fprintf(stderr, _("control file path is too long\n"));
+		return -1;
+	}

---

5455-5505: Close the descriptor and validate the ControlFileData read

When read() fails or returns a short count, the current code returns -1 without closing fd, leaking the descriptor. It also accepts short reads as success, which will propagate garbage into confile. Always close the file on every exit path and require sizeof(ControlFileData) bytes before using the contents. Apply the same fixes in both helpers.

-	len = read(fd, &confile, sizeof(ControlFileData));
-	if (len < 0)
-	{
-		fprintf(stderr, _("could not read file \"%s\": %s\n"),
-			pathname, strerror(errno));
-
-		return -1;
-	}
-	close(fd);
+	len = read(fd, &confile, sizeof(ControlFileData));
+	if (len != sizeof(ControlFileData))
+	{
+		if (len < 0)
+			fprintf(stderr, _("could not read file \"%s\": %s\n"), pathname, strerror(errno));
+		else
+			fprintf(stderr, _("could not read file \"%s\": unexpected EOF\n"), pathname);
+		close(fd);
+		return -1;
+	}
+	close(fd);

src/bin/initdb/initdb.c (1)

3695-3703: Don't free the shared username buffer
username and effective_user are aliases whenever -U isn’t supplied, so freeing the original pointer leaves effective_user dangling. We still print effective_user later (for example, in the “owned by user …” notice), which turns into a use-after-free in that common flow. Please keep the original buffer alive when effective_user is sharing it, and only release it when username owns it exclusively.

-		char *lowerusername = username;
-		username = down_character(username, strlen(username));
-		free(lowerusername);
+		bool reuse_effective = (username == effective_user);
+		char *lowered = down_character(username, strlen(username));
+
+		if (!reuse_effective)
+			pg_free(username);
+
+		username = lowered;