postgres.git / summary / log / commit / refs

commit    cf44ff5e66353264451ac239b39e9053e8d138e6
Author:   Tom Lane <tgl@sss.pgh.pa.us>
Commit:   Noah Misch <noah@leadboat.com>
Date:     Mon Aug 10 13:38:35 2026 +0000

    Replace fixed-size, too-short array with a palloc'd one.
    
    MatchNamedCall's arggiven array was declared FUNC_MAX_ARGS long,
    but we may actually use up to pronallargs elements, and that can
    be more than FUNC_MAX_ARGS if the function has OUT arguments
    (cf. ProcedureCreate).  Convert it to a palloc'd array.
    
    Reported-by: Zheng Yu <zheng@depthfirst.com>
    Reported-by: ylwangtju <ylwangtju@qq.com>
    Author: Tom Lane <tgl@sss.pgh.pa.us>
    Reviewed-by: Michael Paquier <michael@paquier.xyz>
    Reviewed-by: Masahiko Sawada <sawada.mshk@gmail.com>
    Backpatch-through: 14
    Security: CVE-2026-14679


 src/backend/catalog/namespace.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/backend/catalog/namespace.c b/src/backend/catalog/namespace.c
index df91d2d8d3d..5fe4003de37 100644
--- a/src/backend/catalog/namespace.c
+++ b/src/backend/catalog/namespace.c
@@ -1355,7 +1355,7 @@ MatchNamedCall(HeapTuple proctup, int nargs, List *argnames,
 	Oid		   *p_argtypes;
 	char	  **p_argnames;
 	char	   *p_argmodes;
-	bool		arggiven[FUNC_MAX_ARGS];
+	bool	   *arggiven;
 	bool		isnull;
 	int			ap;				/* call args position */
 	int			pp;				/* proargs position */
@@ -1379,8 +1379,8 @@ MatchNamedCall(HeapTuple proctup, int nargs, List *argnames,
 	Assert(include_out_arguments ? (pronargs == pronallargs) : (pronargs <= pronallargs));
 
 	/* initialize state for matching */
-	*argnumbers = (int *) palloc(pronargs * sizeof(int));
-	memset(arggiven, false, pronargs * sizeof(bool));
+	*argnumbers = palloc_array(int, pronargs);
+	arggiven = palloc0_array(bool, pronallargs);
 
 	/* there are numposargs positional args before the named args */
 	for (ap = 0; ap < numposargs; ap++)


[parent: 59205c7e9b4a]