From b99b74144f9f37f39c38ca43b94a5ad46bb24a43 Mon Sep 17 00:00:00 2001 From: Michael Paquier Date: Thu, 20 Aug 2026 09:38:23 +0900 Subject: [PATCH] Reject too many arguments in CREATE TRIGGER The number of trigger arguments is stored as a smallint, but there was no check that the number of arguments fits with the catalog data type. This could result in an invalid negative value being stored once one defined more than INT16_MAX arguments, with an overflowed value stored in the catalogs. Looking at other catalogs that store a number of arguments, we have similar protections already in place (aggregates, functions, etc.). Reported-by: Xingwang Xiang Author: Kyotaro Horiguchi Discussion: https://postgr.es/m/19627-5b72a57e332e2b3f@postgresql.org Backpatch-through: 14 --- src/backend/commands/trigger.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/src/backend/commands/trigger.c b/src/backend/commands/trigger.c index b7881bf4a29..8e1338d2c21 100644 --- a/src/backend/commands/trigger.c +++ b/src/backend/commands/trigger.c @@ -897,9 +897,16 @@ CreateTriggerFiringOn(const CreateTrigStmt *stmt, const char *queryString, { ListCell *le; char *args; - int16 nargs = list_length(stmt->args); + int nargs = list_length(stmt->args); int len = 0; + Assert(nargs >= 0); + if (nargs > PG_INT16_MAX) + ereport(ERROR, + errcode(ERRCODE_TOO_MANY_ARGUMENTS), + errmsg("triggers cannot have more than %d arguments", + PG_INT16_MAX)); + foreach(le, stmt->args) { char *ar = strVal(lfirst(le));