postgres.git / summary / log / commit / refs

commit    f0098e2fc90f8e0de8385d669bcc09d1e47ee1c8
Author:   Michael Paquier <michael@paquier.xyz>
Date:     Thu Aug 20 00:38:34 2026 +0000

    Reject too many arguments in CREATE TRIGGER
    
    The number of trigger arguments is stored as a smallint, but there was
    no check that the number of arguments fits with the catalog data type.
    This could result in an invalid negative value being stored once one
    defined more than INT16_MAX arguments, with an overflowed value stored
    in the catalogs.
    
    Looking at other catalogs that store a number of arguments, we have
    similar protections already in place (aggregates, functions, etc.).
    
    Reported-by: Xingwang Xiang <v3rdant.xiang@gmail.com>
    Author: Kyotaro Horiguchi <horikyota.ntt@gmail.com>
    Discussion: https://postgr.es/m/19627-5b72a57e332e2b3f@postgresql.org
    Backpatch-through: 14


 src/backend/commands/trigger.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/src/backend/commands/trigger.c b/src/backend/commands/trigger.c
index 9d8d919673b..eaa136b0444 100644
--- a/src/backend/commands/trigger.c
+++ b/src/backend/commands/trigger.c
@@ -890,9 +890,16 @@ CreateTriggerFiringOn(CreateTrigStmt *stmt, const char *queryString,
 	{
 		ListCell   *le;
 		char	   *args;
-		int16		nargs = list_length(stmt->args);
+		int			nargs = list_length(stmt->args);
 		int			len = 0;
 
+		Assert(nargs >= 0);
+		if (nargs > PG_INT16_MAX)
+			ereport(ERROR,
+					errcode(ERRCODE_TOO_MANY_ARGUMENTS),
+					errmsg("triggers cannot have more than %d arguments",
+						   PG_INT16_MAX));
+
 		foreach(le, stmt->args)
 		{
 			char	   *ar = strVal(lfirst(le));


[parent: 5ce645173e6d]