From 4027fb60b9691f3fada876822396c8a00e697beb Mon Sep 17 00:00:00 2001 From: Michael Paquier Date: Thu, 20 Aug 2026 09:38:32 +0900 Subject: [PATCH] Reject too many arguments in CREATE TRIGGER The number of trigger arguments is stored as a smallint, but there was no check that the number of arguments fits with the catalog data type. This could result in an invalid negative value being stored once one defined more than INT16_MAX arguments, with an overflowed value stored in the catalogs. Looking at other catalogs that store a number of arguments, we have similar protections already in place (aggregates, functions, etc.). Reported-by: Xingwang Xiang Author: Kyotaro Horiguchi Discussion: https://postgr.es/m/19627-5b72a57e332e2b3f@postgresql.org Backpatch-through: 14 --- src/backend/commands/trigger.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/src/backend/commands/trigger.c b/src/backend/commands/trigger.c index 537590304e8..b393ee87ad1 100644 --- a/src/backend/commands/trigger.c +++ b/src/backend/commands/trigger.c @@ -885,9 +885,16 @@ CreateTriggerFiringOn(CreateTrigStmt *stmt, const char *queryString, { ListCell *le; char *args; - int16 nargs = list_length(stmt->args); + int nargs = list_length(stmt->args); int len = 0; + Assert(nargs >= 0); + if (nargs > PG_INT16_MAX) + ereport(ERROR, + errcode(ERRCODE_TOO_MANY_ARGUMENTS), + errmsg("triggers cannot have more than %d arguments", + PG_INT16_MAX)); + foreach(le, stmt->args) { char *ar = strVal(lfirst(le));