database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2026-10-23 13:29:09 +03:00
Code Activity

Fix pg_trgm's picksplit function with all-true datums

Browse Source 
The CACHESIGN.sign field is a BITVECP, not a TRGM, so you should not
use GETSIGN() on it. You don't get a compiler warning because the
GETSIGN() macro includes a cast. It resulted in a bogus read beyond
end of buffer, which would cause bad split decisions or a crash if
you're very unlucky.

Reported-by: Mehmet D. INCE <mehmet@mehmetince.net>
Backpatch-through: 14
Security: CVE-2026-14678
This commit is contained in:
Heikki Linnakangas
2026-08-10 06:38:18 -07:00
committed by Noah Misch
parent 75a03c569c
commit 1af08af694
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
contrib/pg_trgm/trgm_gist.c
View File

@@ -900,7 +900,7 @@ gtrgm_picksplit(PG_FUNCTION_ARGS)
else
size_alpha = SIGLENBIT(siglen) -
sizebitvec((cache[j].allistrue) ? GETSIGN(datum_l) :
GETSIGN(cache[j].sign),
cache[j].sign,
siglen);
}
else
@@ -913,7 +913,7 @@ gtrgm_picksplit(PG_FUNCTION_ARGS)
else
size_beta = SIGLENBIT(siglen) -
sizebitvec((cache[j].allistrue) ? GETSIGN(datum_r) :
GETSIGN(cache[j].sign),
cache[j].sign,
siglen);
}
else