Feature/review pgsql native backend protocol

deps/libscram/src/scram.c

@@ -502,21 +502,34 @@ char *build_client_first_message(ScramState *scram_state)
 		goto failed;
 	scram_state->client_nonce[encoded_len] = '\0';
 
-	len = 8 + strlen(scram_state->client_nonce) + 1;
-	result = malloc(len);
-	if (result == NULL)
-		goto failed;
-	if (scram_state->client_cbind_input != NULL) {
-		/* Channel-bound client: gs2 cbind flag 'p' with tls-server-end-point
-		 * type. The PostgreSQL convention is an empty SCRAM username (the
-		 * real username travels in the StartupMessage), so the header is
-		 * "p=tls-server-end-point,,". */
-		snprintf(result, len, "p=tls-server-end-point,,n=,r=%s", scram_state->client_nonce);
-	} else {
-		snprintf(result, len, "n,,n=,r=%s", scram_state->client_nonce);
-	}
+	/* gs2 header: "n,," for plain SCRAM, "p=tls-server-end-point,," when the
+	 * caller installed a channel-binding input (SCRAM-SHA-256-PLUS). Its length
+	 * drives BOTH the allocation and the offset used to derive
+	 * client_first_message_bare, so the two cannot disagree.
+	 *
+	 * Previously the buffer was sized for the 8-char plain prefix "n,,n=,r=",
+	 * which silently truncated the 29-char channel-bound message, and the bare
+	 * message was taken as "result + 3", which skipped only 3 of the 24 header
+	 * bytes and corrupted the AuthMessage the client proof is computed over.
+	 *
+	 * The PostgreSQL convention is an empty SCRAM username (the real username
+	 * travels in the StartupMessage), hence "n=".
+	 */
+	{
+		const char *gs2 = (scram_state->client_cbind_input != NULL)
+					? "p=tls-server-end-point,," : "n,,";
+		const size_t gs2_len = strlen(gs2);
+
+		/* gs2 + "n=,r=" (5) + nonce + NUL. For the plain header this is
+		 * 3 + 5 + nonce + 1, identical to the previous 8 + nonce + 1. */
+		len = gs2_len + 5 + strlen(scram_state->client_nonce) + 1;
+		result = malloc(len);
+		if (result == NULL)
+			goto failed;
+		snprintf(result, len, "%sn=,r=%s", gs2, scram_state->client_nonce);
 
-	scram_state->client_first_message_bare = strdup(result + 3);
+		scram_state->client_first_message_bare = strdup(result + gs2_len);
+	}
 	if (scram_state->client_first_message_bare == NULL)
 		goto failed;
 
@@ -545,9 +558,11 @@ char *build_client_final_message(ScramState *scram_state,
 
 	if (scram_state->client_cbind_input != NULL) {
 		/* Channel-bound client: c=base64(gs2-header || cbind-data).
-		 * 86 bytes buffer = 22 (header) + 64 (max digest we accept) = 86;
-		 * base64-encoded = 116 chars max. The full prefix
-		 * "c=<b64>,r=<server_nonce>" easily fits in 512. */
+		 * The gs2 header "p=tls-server-end-point,," is 24 bytes, so the
+		 * cbind input is at most 24 + 64 (max digest we accept) = 88 bytes;
+		 * base64-encoded = 4*ceil(88/3) = 120 chars, 121 with the NUL that
+		 * is written below -- so b64[128] has 7 bytes of headroom. The full
+		 * prefix "c=<b64>,r=<server_nonce>" easily fits in 512. */
 		char b64[128];
 		int blen = pg_b64_encode(scram_state->client_cbind_input,
 					 scram_state->client_cbind_input_len,