Subject: [PATCH v1] Reject too many arguments in CREATE TRIGGER

From: Kyotaro Horiguchi <[email-masked]>
Date: Wed, 19 Aug 2026 11:40:16 +0900

The number of trigger arguments is stored as an int16, but there was no
check that the number of arguments fits in that type.  This could result
in an invalid negative value being stored.

Check that the number of arguments does not exceed INT16_MAX.
---
 src/backend/commands/trigger.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/src/backend/commands/trigger.c b/src/backend/commands/trigger.c
index b7881bf4a29..304cc1e7ace 100644
--- a/src/backend/commands/trigger.c
+++ b/src/backend/commands/trigger.c
@@ -897,9 +897,16 @@ CreateTriggerFiringOn(const CreateTrigStmt *stmt, const char *queryString,
 	{
 		ListCell   *le;
 		char	   *args;
-		int16		nargs = list_length(stmt->args);
+		int			nargs = list_length(stmt->args); 
 		int			len = 0;
 
+		Assert(nargs >= 0);
+		if (nargs > INT16_MAX)
+			ereport(ERROR,
+					errcode(ERRCODE_TOO_MANY_ARGUMENTS),
+					errmsg("triggers cannot have more than %d arguments",
+						   INT16_MAX));
+					
 		foreach(le, stmt->args)
 		{
 			char	   *ar = strVal(lfirst(le));
-- 
2.52.0

----Next_Part(Wed_Aug_19_11_56_36_2026_742)----