From 0ebf896f44d2a930c7e3722621e319a3d923c830 Mon Sep 17 00:00:00 2001 From: Tom Lane Date: Mon, 10 Aug 2026 06:38:17 -0700 Subject: [PATCH] Be more wary about constant's datatype in scalarineqsel(). The special case here for estimating conditions involving a ctid column failed to check that the RHS constant is of type tid. While that'd always be true for the built-in operators that reference this selectivity estimator, a maliciously constructed operator could provide a user-controlled Datum value that would get interpreted as an ItemPointer pointer. That at least risks SIGSEGV, and perhaps with a bit of sweat it could be used for server memory disclosure. Reported-by: Hcamael Author: Tom Lane Reviewed-by: Noah Misch Backpatch-through: 14 Security: CVE-2026-14668 --- src/backend/utils/adt/selfuncs.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/backend/utils/adt/selfuncs.c b/src/backend/utils/adt/selfuncs.c index 2c1daefc0c0..ee9965c6021 100644 --- a/src/backend/utils/adt/selfuncs.c +++ b/src/backend/utils/adt/selfuncs.c @@ -597,7 +597,8 @@ scalarineqsel(PlannerInfo *root, Oid operator, bool isgt, bool iseq, * make an estimate based on comparing the constant to the table size. */ if (vardata->var && IsA(vardata->var, Var) && - ((Var *) vardata->var)->varattno == SelfItemPointerAttributeNumber) + ((Var *) vardata->var)->varattno == SelfItemPointerAttributeNumber && + consttype == TIDOID) { ItemPointer itemptr; double block;