postgres.git / summary / log / commit / refs

commit    59205c7e9b4a3afbdab4d677c16036cdd1bd080d
Author:   Tom Lane <tgl@sss.pgh.pa.us>
Commit:   Noah Misch <noah@leadboat.com>
Date:     Mon Aug 10 13:38:35 2026 +0000

    Be more wary about constant's datatype in scalarineqsel().
    
    The special case here for estimating conditions involving a ctid
    column failed to check that the RHS constant is of type tid.
    While that'd always be true for the built-in operators that
    reference this selectivity estimator, a maliciously constructed
    operator could provide a user-controlled Datum value that would
    get interpreted as an ItemPointer pointer.  That at least risks
    SIGSEGV, and perhaps with a bit of sweat it could be used for
    server memory disclosure.
    
    Reported-by: Hcamael <baiyjrh@gmail.com>
    Author: Tom Lane <tgl@sss.pgh.pa.us>
    Reviewed-by: Noah Misch <noah@leadboat.com>
    Backpatch-through: 14
    Security: CVE-2026-14668


 src/backend/utils/adt/selfuncs.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/backend/utils/adt/selfuncs.c b/src/backend/utils/adt/selfuncs.c
index 64e5398b6af..37bd1c39279 100644
--- a/src/backend/utils/adt/selfuncs.c
+++ b/src/backend/utils/adt/selfuncs.c
@@ -593,7 +593,8 @@ scalarineqsel(PlannerInfo *root, Oid operator, bool isgt, bool iseq,
 		 * make an estimate based on comparing the constant to the table size.
 		 */
 		if (vardata->var && IsA(vardata->var, Var) &&
-			((Var *) vardata->var)->varattno == SelfItemPointerAttributeNumber)
+			((Var *) vardata->var)->varattno == SelfItemPointerAttributeNumber &&
+			consttype == TIDOID)
 		{
 			ItemPointer itemptr;
 			double		block;


[parent: d7fcfead3da8]