database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2026-10-23 13:29:09 +03:00
Code Activity

Be more wary about constant's datatype in scalarineqsel().

Browse Source 
The special case here for estimating conditions involving a ctid
column failed to check that the RHS constant is of type tid.
While that'd always be true for the built-in operators that
reference this selectivity estimator, a maliciously constructed
operator could provide a user-controlled Datum value that would
get interpreted as an ItemPointer pointer.  That at least risks
SIGSEGV, and perhaps with a bit of sweat it could be used for
server memory disclosure.

Reported-by: Hcamael <baiyjrh@gmail.com>
Author: Tom Lane <tgl@sss.pgh.pa.us>
Reviewed-by: Noah Misch <noah@leadboat.com>
Backpatch-through: 14
Security: CVE-2026-14668
This commit is contained in:
Tom Lane
2026-08-10 06:38:23 -07:00
committed by Noah Misch
parent 477a6bdb08
commit 591192e2ec
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
src/backend/utils/adt/selfuncs.c
View File

@@ -596,7 +596,8 @@ scalarineqsel(PlannerInfo *root, Oid operator, bool isgt, bool iseq,
* make an estimate based on comparing the constant to the table size.
*/
if (vardata->var && IsA(vardata->var, Var) &&
((Var *) vardata->var)->varattno == SelfItemPointerAttributeNumber)
((Var *) vardata->var)->varattno == SelfItemPointerAttributeNumber &&
consttype == TIDOID)
{
ItemPointer itemptr;
double block;