postgres.git / summary / log / commit / refs

commit    d6cde5b6b1bbcc13dbbcdbf85e81682f186a4c07
Author:   Michael Paquier <michael@paquier.xyz>
Date:     Thu Aug 20 00:38:29 2026 +0000
First released in: 14.25, 15.20, 16.16, 17.12, 18.7

    Reject too many arguments in CREATE TRIGGER
    
    The number of trigger arguments is stored as a smallint, but there was
    no check that the number of arguments fits with the catalog data type.
    This could result in an invalid negative value being stored once one
    defined more than INT16_MAX arguments, with an overflowed value stored
    in the catalogs.
    
    Looking at other catalogs that store a number of arguments, we have
    similar protections already in place (aggregates, functions, etc.).
    
    Reported-by: Xingwang Xiang <v3rdant.xiang@gmail.com>
    Author: Kyotaro Horiguchi <horikyota.ntt@gmail.com>
    Discussion: https://postgr.es/m/19627-5b72a57e332e2b3f@postgresql.org
    Backpatch-through: 14


 src/backend/commands/trigger.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/src/backend/commands/trigger.c b/src/backend/commands/trigger.c
index 7ae6557d897..b70cafa6bc3 100644
--- a/src/backend/commands/trigger.c
+++ b/src/backend/commands/trigger.c
@@ -884,9 +884,16 @@ CreateTriggerFiringOn(CreateTrigStmt *stmt, const char *queryString,
 	{
 		ListCell   *le;
 		char	   *args;
-		int16		nargs = list_length(stmt->args);
+		int			nargs = list_length(stmt->args);
 		int			len = 0;
 
+		Assert(nargs >= 0);
+		if (nargs > PG_INT16_MAX)
+			ereport(ERROR,
+					errcode(ERRCODE_TOO_MANY_ARGUMENTS),
+					errmsg("triggers cannot have more than %d arguments",
+						   PG_INT16_MAX));
+
 		foreach(le, stmt->args)
 		{
 			char	   *ar = strVal(lfirst(le));


[parent: d7ce15e4de6f]