From 4434340b5769439cc31dbd068a8c7f336eef71ed Mon Sep 17 00:00:00 2001 From: Michael Paquier Date: Thu, 20 Aug 2026 09:38:36 +0900 Subject: [PATCH] Reject too many arguments in CREATE TRIGGER The number of trigger arguments is stored as a smallint, but there was no check that the number of arguments fits with the catalog data type. This could result in an invalid negative value being stored once one defined more than INT16_MAX arguments, with an overflowed value stored in the catalogs. Looking at other catalogs that store a number of arguments, we have similar protections already in place (aggregates, functions, etc.). Reported-by: Xingwang Xiang Author: Kyotaro Horiguchi Discussion: https://postgr.es/m/19627-5b72a57e332e2b3f@postgresql.org Backpatch-through: 14 --- src/backend/commands/trigger.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/src/backend/commands/trigger.c b/src/backend/commands/trigger.c index 784caa4678a..f2dadea5457 100644 --- a/src/backend/commands/trigger.c +++ b/src/backend/commands/trigger.c @@ -878,9 +878,16 @@ CreateTriggerFiringOn(CreateTrigStmt *stmt, const char *queryString, { ListCell *le; char *args; - int16 nargs = list_length(stmt->args); + int nargs = list_length(stmt->args); int len = 0; + Assert(nargs >= 0); + if (nargs > PG_INT16_MAX) + ereport(ERROR, + errcode(ERRCODE_TOO_MANY_ARGUMENTS), + errmsg("triggers cannot have more than %d arguments", + PG_INT16_MAX)); + foreach(le, stmt->args) { char *ar = strVal(lfirst(le));