From 92972e815d85038ccb8574a1d7e2f2df8d148fe9 Mon Sep 17 00:00:00 2001 From: Tom Lane Date: Mon, 10 Aug 2026 06:38:04 -0700 Subject: [PATCH] Replace fixed-size, too-short array with a palloc'd one. MatchNamedCall's arggiven array was declared FUNC_MAX_ARGS long, but we may actually use up to pronallargs elements, and that can be more than FUNC_MAX_ARGS if the function has OUT arguments (cf. ProcedureCreate). Convert it to a palloc'd array. Reported-by: Zheng Yu Reported-by: ylwangtju Author: Tom Lane Reviewed-by: Michael Paquier Reviewed-by: Masahiko Sawada Backpatch-through: 14 Security: CVE-2026-14679 --- src/backend/catalog/namespace.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/backend/catalog/namespace.c b/src/backend/catalog/namespace.c index 56b87d878e8..b2daf9adb32 100644 --- a/src/backend/catalog/namespace.c +++ b/src/backend/catalog/namespace.c @@ -1625,7 +1625,7 @@ MatchNamedCall(HeapTuple proctup, int nargs, List *argnames, Oid *p_argtypes; char **p_argnames; char *p_argmodes; - bool arggiven[FUNC_MAX_ARGS]; + bool *arggiven; bool arg_filled_twice = false; bool isnull; int ap; /* call args position */ @@ -1650,8 +1650,8 @@ MatchNamedCall(HeapTuple proctup, int nargs, List *argnames, Assert(include_out_arguments ? (pronargs == pronallargs) : (pronargs <= pronallargs)); /* initialize state for matching */ - *argnumbers = (int *) palloc(pronargs * sizeof(int)); - memset(arggiven, false, pronargs * sizeof(bool)); + *argnumbers = palloc_array(int, pronargs); + arggiven = palloc0_array(bool, pronallargs); /* there are numposargs positional args before the named args */ for (ap = 0; ap < numposargs; ap++)