database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2026-10-23 13:29:09 +03:00
Code Activity

Replace fixed-size, too-short array with a palloc'd one.

Browse Source 
MatchNamedCall's arggiven array was declared FUNC_MAX_ARGS long,
but we may actually use up to pronallargs elements, and that can
be more than FUNC_MAX_ARGS if the function has OUT arguments
(cf. ProcedureCreate).  Convert it to a palloc'd array.

Reported-by: Zheng Yu <zheng@depthfirst.com>
Reported-by: ylwangtju <ylwangtju@qq.com>
Author: Tom Lane <tgl@sss.pgh.pa.us>
Reviewed-by: Michael Paquier <michael@paquier.xyz>
Reviewed-by: Masahiko Sawada <sawada.mshk@gmail.com>
Backpatch-through: 14
Security: CVE-2026-14679
This commit is contained in:
Tom Lane
2026-08-10 06:37:48 -07:00
committed by Noah Misch
parent 8f0c3d2feb
commit 7bd56f7a3b
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
src/backend/catalog/namespace.c
View File

@@ -1625,7 +1625,7 @@ MatchNamedCall(HeapTuple proctup, int nargs, List *argnames,
Oid *p_argtypes;
char **p_argnames;
char *p_argmodes;
bool arggiven[FUNC_MAX_ARGS];
bool *arggiven;
bool arg_filled_twice = false;
bool isnull;
int ap; /* call args position */
@@ -1650,8 +1650,8 @@ MatchNamedCall(HeapTuple proctup, int nargs, List *argnames,
Assert(include_out_arguments ? (pronargs == pronallargs) : (pronargs <= pronallargs));
/* initialize state for matching */
*argnumbers = (int *) palloc(pronargs * sizeof(int));
memset(arggiven, false, pronargs * sizeof(bool));
*argnumbers = palloc_array(int, pronargs);
arggiven = palloc0_array(bool, pronallargs);
/* there are numposargs positional args before the named args */
for (ap = 0; ap < numposargs; ap++)