From 8c67c4cf59041a6ec2a1fa40e47b1490d75908bf Mon Sep 17 00:00:00 2001 From: Tom Lane Date: Mon, 10 Aug 2026 06:38:23 -0700 Subject: [PATCH] Replace fixed-size, too-short array with a palloc'd one. MatchNamedCall's arggiven array was declared FUNC_MAX_ARGS long, but we may actually use up to pronallargs elements, and that can be more than FUNC_MAX_ARGS if the function has OUT arguments (cf. ProcedureCreate). Convert it to a palloc'd array. Reported-by: Zheng Yu Reported-by: ylwangtju Author: Tom Lane Reviewed-by: Michael Paquier Reviewed-by: Masahiko Sawada Backpatch-through: 14 Security: CVE-2026-14679 --- src/backend/catalog/namespace.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/backend/catalog/namespace.c b/src/backend/catalog/namespace.c index e0d17eb569f..b66dc76d7a6 100644 --- a/src/backend/catalog/namespace.c +++ b/src/backend/catalog/namespace.c @@ -1352,7 +1352,7 @@ MatchNamedCall(HeapTuple proctup, int nargs, List *argnames, Oid *p_argtypes; char **p_argnames; char *p_argmodes; - bool arggiven[FUNC_MAX_ARGS]; + bool *arggiven; bool isnull; int ap; /* call args position */ int pp; /* proargs position */ @@ -1376,8 +1376,8 @@ MatchNamedCall(HeapTuple proctup, int nargs, List *argnames, Assert(include_out_arguments ? (pronargs == pronallargs) : (pronargs <= pronallargs)); /* initialize state for matching */ - *argnumbers = (int *) palloc(pronargs * sizeof(int)); - memset(arggiven, false, pronargs * sizeof(bool)); + *argnumbers = palloc_array(int, pronargs); + arggiven = palloc0_array(bool, pronallargs); /* there are numposargs positional args before the named args */ for (ap = 0; ap < numposargs; ap++)