ClientInfo::read deserializes initial_address from the native TCP protocol
and constructs Poco::Net::SocketAddress directly from that string. When the
port part is non-numeric (or out of the 0..65535 range), Poco resolves it
via getservbyname(), a non-reentrant libc function that base/harmful replaces
with __builtin_trap() in debug and sanitizer builds. The result is a hard,
uncatchable SIGILL (Received signal 4) rather than a recoverable error.

ClientInfo::write always serializes the address as a numeric "host:port" via
SocketAddress::toString(), so valid streams never hit the getservbyname()
branch. A corrupted or desynchronized native-protocol stream can, however,
feed an arbitrary string here (for example TCPHandler::processUnexpectedQuery
-> skipData when a Data packet is mis-parsed under stress with random query
fuzzing and fault injection), turning untrusted input into a server crash.

Validate that the port substring is numeric and within range before handing
the string to Poco, locating the port exactly as Poco::Net::SocketAddress
does (UNIX path, "[ipv6]:port", and "host:port" first-colon split). Malformed
input now raises a catchable INCORRECT_DATA exception and never reaches
getservbyname(). Legitimate numeric addresses still parse, including IPv6.

Surfaced by the Stress test (amd_asan_ubsan) on an unrelated PR
(STID 1781-3414); pre-existing on master and not specific to any PR.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

The first version of the fix only validated the port, so a non-IP host
plus a numeric port (e.g. "host:9000", or ":9000") still passed and was
handed to Poco::Net::SocketAddress(String). That constructor calls
DNS::hostByName() for a non-IP host (and gethostbyname() on the
non-getaddrinfo branch), reaching the same base/harmful-trapped resolver
family the port check was meant to avoid.

ClientInfo::write only ever emits an IP literal plus a numeric port, so
parse the host substring here too (unbracketing [ipv6]:port), require
Poco::Net::IPAddress::tryParse, and construct SocketAddress(ip, port)
directly. Malformed values like "host:9000" and ":9000" are now rejected
as INCORRECT_DATA and never reach any resolver. Extends the round-trip
unit test and adds a non-IP-host rejection test.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

…mmar

The new gtest fed ReadBufferFromString a temporary String returned by
makeClientInfoPrefix(). ReadBufferFromString is non-owning (it derives from
ReadBufferFromMemory and keeps only a pointer to the source bytes), so the
temporary was destroyed at the end of the statement and ClientInfo::read then
read freed memory via readNBytes. Non-sanitizer builds happened to pass, but
asan/tsan reported a heap-use-after-free and msan a use-of-uninitialized-value.
Use ReadBufferFromOwnString, which owns its backing string, for the cases that
pass a temporary. The production ClientInfo::read path was never affected: its
string_views point into the named local initial_address_string.

Also update the initial_address row in NativeProtocol.md: the SIGILL fix
narrowed the accepted wire value to an IP literal plus a numeric port (or a
UNIX socket path), with hostnames and service names no longer resolved, so the
spec must document the accepted grammar instead of the generic host:port form.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

A leading-'/' wire value made Poco build a UNIX_LOCAL SocketAddress, which
escaped the new IP-endpoint validation in makeSocketAddressFromWire. But
LocalSocketAddressImpl::host()/port() throw InvalidAccessException, and every
consumer of initial_address calls them unconditionally
(QueryLogElement::appendClientInfo at QueryLog.cpp, Session::authenticate in
interserver mode). So a corrupted/desynced stream carrying initial_address
like "/tmp/ch.sock" would pass ClientInfo::read and then throw downstream,
violating this PR's contract that non-generated wire values are rejected at
read with INCORRECT_DATA.

ClientInfo::write only ever serializes an IP literal plus a numeric port
(SocketAddress::toString of an IP endpoint), so the UNIX-local form is never
legitimate on the wire. Reject host_and_port.front() == '/' with INCORRECT_DATA
and drop the UNIX socket path branch from the NativeProtocol.md grammar.

Add a gtest case proving "/tmp/ch.sock", "/" and a longer socket path are
rejected with INCORRECT_DATA instead of parsed into a UNIX_LOCAL address.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

…o::read

The wire-address validation added in this PR rejected any non-"ip:port"
initial_address with INCORRECT_DATA for every query kind. That moved the
native-protocol compatibility boundary: a third-party client that sent a
generic host:port (e.g. localhost:9000) for an INITIAL_QUERY was rejected,
even though the server overwrites initial_address with the real peer address
in Session::makeQueryContextImpl, so the wire value is never consumed for
initial queries.

Only a SECONDARY_QUERY keeps and uses the wire initial_address (system.query_log,
StorageSystemProcesses, interserver authenticate). Make validation strict only
for that case: makeSocketAddressFromWire becomes the non-throwing,
non-resolving tryParseIpEndpointFromWire, and read() rejects an unparseable
address only for SECONDARY_QUERY, otherwise falls back to the default endpoint.
The SIGILL guard is unchanged: the parser never calls Poco's resolver, so no
query kind can reach the trapped getservbyname()/DNS family.

Extend the gtest with an INITIAL_QUERY lenient case and a SECONDARY_QUERY valid
round-trip, and reconcile the initial_address row in NativeProtocol.md.