database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2026-10-23 13:29:09 +03:00
Code Activity

Reject too many arguments in CREATE TRIGGER

Browse Source 
The number of trigger arguments is stored as a smallint, but there was
no check that the number of arguments fits with the catalog data type.
This could result in an invalid negative value being stored once one
defined more than INT16_MAX arguments, with an overflowed value stored
in the catalogs.

Looking at other catalogs that store a number of arguments, we have
similar protections already in place (aggregates, functions, etc.).

Reported-by: Xingwang Xiang <v3rdant.xiang@gmail.com>
Author: Kyotaro Horiguchi <horikyota.ntt@gmail.com>
Discussion: https://postgr.es/m/19627-5b72a57e332e2b3f@postgresql.org
Backpatch-through: 14
This commit is contained in:
Michael Paquier
2026-08-20 09:38:32 +09:00
parent bf25c5f832
commit 4027fb60b9
1 changed files with 8 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
src/backend/commands/trigger.c
View File

@@ -885,9 +885,16 @@ CreateTriggerFiringOn(CreateTrigStmt *stmt, const char *queryString,
{
ListCell *le;
char *args;
int16 nargs = list_length(stmt->args);
int nargs = list_length(stmt->args);
int len = 0;
Assert(nargs >= 0);
if (nargs > PG_INT16_MAX)
ereport(ERROR,
errcode(ERRCODE_TOO_MANY_ARGUMENTS),
errmsg("triggers cannot have more than %d arguments",
PG_INT16_MAX));
foreach(le, stmt->args)
{
char *ar = strVal(lfirst(le));