postgres.git / summary / log / commit / refs
commit 87c4b821972c9b66ced5520636c8ad4b60f8fd81
Author: Tom Lane <tgl@sss.pgh.pa.us>
Commit: Noah Misch <noah@leadboat.com>
Date: Mon Aug 10 13:38:11 2026 +0000
First released in: 14.24, 15.19, 16.15, 17.11, 18.6
Harden PL/Perl code against "tied" Perl arrays and hashes.
Tied arrays might report different sizes each time they are inspected.
To avoid generating a corrupt result array, fix plperl_array_to_datum()
to read av_len() of each input array only once. If the input does
appear to get shorter, we'll fill nulls for the now-missing entries,
which seems fine. Conversely, if it gets longer, we'll ignore the new
entries.
plperl_to_hstore() assumed that Perl's hv_iterinit() returns the
number of entries in the given Perl hash. Usually that's true,
but per the Perl docs, "the return value is currently only meaningful
for hashes without tie magic". That could potentially end in a memory
stomp. We don't depend on that result value anywhere else, so don't
do so here either.
Reported-by: Hcamael <baiyjrh@gmail.com>
Author: Tom Lane <tgl@sss.pgh.pa.us>
Reviewed-by: Andrew Dunstan <andrew@dunslane.net>
Backpatch-through: 14
Security: CVE-2026-14670
contrib/hstore_plperl/hstore_plperl.c | 11 +++++++++--
src/pl/plperl/plperl.c | 6 +++++-
2 files changed, 14 insertions(+), 3 deletions(-)
diff --git a/contrib/hstore_plperl/hstore_plperl.c b/contrib/hstore_plperl/hstore_plperl.c
index 1dd0664508b..07eff0e3bd3 100644
--- a/contrib/hstore_plperl/hstore_plperl.c
+++ b/contrib/hstore_plperl/hstore_plperl.c
@@ -128,8 +128,9 @@ plperl_to_hstore(PG_FUNCTION_ARGS)
errmsg("cannot transform non-hash Perl value to hstore")));
hv = (HV *) in;
- pcount = hv_iterinit(hv);
+ (void) hv_iterinit(hv);
+ pcount = 64; /* arbitrary initial guess */
pairs = palloc_array(Pairs, pcount);
i = 0;
@@ -138,6 +139,12 @@ plperl_to_hstore(PG_FUNCTION_ARGS)
char *key = sv2cstr(HeSVKEY_force(he));
SV *value = HeVAL(he);
+ if (i >= pcount)
+ {
+ pcount *= 2;
+ pairs = repalloc_array(pairs, Pairs, pcount);
+ }
+
pairs[i].key = pstrdup(key);
pairs[i].keylen = hstoreCheckKeyLen(strlen(pairs[i].key));
pairs[i].needfree = true;
@@ -158,7 +165,7 @@ plperl_to_hstore(PG_FUNCTION_ARGS)
i++;
}
- pcount = hstoreUniquePairs(pairs, pcount, &buflen);
+ pcount = hstoreUniquePairs(pairs, i, &buflen);
out = hstorePairs(pairs, pcount, buflen);
PG_RETURN_POINTER(out);
}
diff --git a/src/pl/plperl/plperl.c b/src/pl/plperl/plperl.c
index 1c52084403b..1b373244c16 100644
--- a/src/pl/plperl/plperl.c
+++ b/src/pl/plperl/plperl.c
@@ -1167,6 +1167,10 @@ get_perl_array_ref(SV *sv)
* if we didn't do it like that, we'd need some other convention for knowing
* whether we'd already found any scalars (and thus the number of dimensions
* is frozen).
+ *
+ * Caller is required to have set dims[cur_depth - 1] to the length of the
+ * input array, i.e., av_len(av) + 1. We make this requirement so as to
+ * avoid reading av_len() twice, which is hazardous for tied arrays.
*/
static void
array_to_datum_internal(AV *av, ArrayBuildState **astatep,
@@ -1176,7 +1180,7 @@ array_to_datum_internal(AV *av, ArrayBuildState **astatep,
{
dTHX;
int i;
- int len = av_len(av) + 1;
+ int len = dims[cur_depth - 1];
for (i = 0; i < len; i++)
{
[parent: b7e5c3f63464]