From 1af08af694815520e5642dc3a85cc010cbcf9f84 Mon Sep 17 00:00:00 2001 From: Heikki Linnakangas Date: Mon, 10 Aug 2026 06:38:18 -0700 Subject: [PATCH] Fix pg_trgm's picksplit function with all-true datums The CACHESIGN.sign field is a BITVECP, not a TRGM, so you should not use GETSIGN() on it. You don't get a compiler warning because the GETSIGN() macro includes a cast. It resulted in a bogus read beyond end of buffer, which would cause bad split decisions or a crash if you're very unlucky. Reported-by: Mehmet D. INCE Backpatch-through: 14 Security: CVE-2026-14678 --- contrib/pg_trgm/trgm_gist.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/contrib/pg_trgm/trgm_gist.c b/contrib/pg_trgm/trgm_gist.c index d89376c7dc7..bd9b9237d9c 100644 --- a/contrib/pg_trgm/trgm_gist.c +++ b/contrib/pg_trgm/trgm_gist.c @@ -900,7 +900,7 @@ gtrgm_picksplit(PG_FUNCTION_ARGS) else size_alpha = SIGLENBIT(siglen) - sizebitvec((cache[j].allistrue) ? GETSIGN(datum_l) : - GETSIGN(cache[j].sign), + cache[j].sign, siglen); } else @@ -913,7 +913,7 @@ gtrgm_picksplit(PG_FUNCTION_ARGS) else size_beta = SIGLENBIT(siglen) - sizebitvec((cache[j].allistrue) ? GETSIGN(datum_r) : - GETSIGN(cache[j].sign), + cache[j].sign, siglen); } else