postgres.git / summary / log / commit / refs

commit    c3f7dde39e940c86cccc179e8cbe188966e4e3ec
Author:   Heikki Linnakangas <heikki.linnakangas@iki.fi>
Date:     Mon May 11 18:18:06 2026 +0000

    Use palloc_array() in a few more places to avoid overflow
    
    These could overflow on 32-bit systems.
    
    Backpatch-through: 14
    Security: CVE-2026-6473


 contrib/hstore_plperl/hstore_plperl.c     | 2 +-
 contrib/hstore_plpython/hstore_plpython.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/contrib/hstore_plperl/hstore_plperl.c b/contrib/hstore_plperl/hstore_plperl.c
index 69001191cc0..996b46b148d 100644
--- a/contrib/hstore_plperl/hstore_plperl.c
+++ b/contrib/hstore_plperl/hstore_plperl.c
@@ -122,7 +122,7 @@ plperl_to_hstore(PG_FUNCTION_ARGS)
 
 	pcount = hv_iterinit(hv);
 
-	pairs = palloc(pcount * sizeof(Pairs));
+	pairs = palloc_array(Pairs, pcount);
 
 	i = 0;
 	while ((he = hv_iternext(hv)))
diff --git a/contrib/hstore_plpython/hstore_plpython.c b/contrib/hstore_plpython/hstore_plpython.c
index d2be030e07c..f1e483980f4 100644
--- a/contrib/hstore_plpython/hstore_plpython.c
+++ b/contrib/hstore_plpython/hstore_plpython.c
@@ -151,7 +151,7 @@ plpython_to_hstore(PG_FUNCTION_ARGS)
 		Py_ssize_t	i;
 		Pairs	   *pairs;
 
-		pairs = palloc(pcount * sizeof(*pairs));
+		pairs = palloc_array(Pairs, pcount);
 
 		for (i = 0; i < pcount; i++)
 		{


[parent: 36f52a59b315]