postgres.git / summary / log / commit / refs

commit    0ebf896f44d2a930c7e3722621e319a3d923c830
Author:   Tom Lane <tgl@sss.pgh.pa.us>
Commit:   Noah Misch <noah@leadboat.com>
Date:     Mon Aug 10 13:38:17 2026 +0000
First released in: 14.24, 15.19, 16.15, 17.11, 18.6

    Be more wary about constant's datatype in scalarineqsel().
    
    The special case here for estimating conditions involving a ctid
    column failed to check that the RHS constant is of type tid.
    While that'd always be true for the built-in operators that
    reference this selectivity estimator, a maliciously constructed
    operator could provide a user-controlled Datum value that would
    get interpreted as an ItemPointer pointer.  That at least risks
    SIGSEGV, and perhaps with a bit of sweat it could be used for
    server memory disclosure.
    
    Reported-by: Hcamael <baiyjrh@gmail.com>
    Author: Tom Lane <tgl@sss.pgh.pa.us>
    Reviewed-by: Noah Misch <noah@leadboat.com>
    Backpatch-through: 14
    Security: CVE-2026-14668


 src/backend/utils/adt/selfuncs.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/backend/utils/adt/selfuncs.c b/src/backend/utils/adt/selfuncs.c
index 2c1daefc0c0..ee9965c6021 100644
--- a/src/backend/utils/adt/selfuncs.c
+++ b/src/backend/utils/adt/selfuncs.c
@@ -597,7 +597,8 @@ scalarineqsel(PlannerInfo *root, Oid operator, bool isgt, bool iseq,
 		 * make an estimate based on comparing the constant to the table size.
 		 */
 		if (vardata->var && IsA(vardata->var, Var) &&
-			((Var *) vardata->var)->varattno == SelfItemPointerAttributeNumber)
+			((Var *) vardata->var)->varattno == SelfItemPointerAttributeNumber &&
+			consttype == TIDOID)
 		{
 			ItemPointer itemptr;
 			double		block;


[parent: 2d78c34f8257]