From: Noah Misch <noah@leadboat.com>
To: pgsql-committers@lists.postgresql.org
Subject: pgsql: Fix assorted places that need to use palloc_array().
Date: Mon, 11 May 2026 12:19:37 +0000
Message-ID: <E1wMPbl-0002U3-15@gemulon.postgresql.org> (raw)
Fix assorted places that need to use palloc_array().
multirange_recv and BlockRefTableReaderNextRelation were incautious
about multiplying a possibly-large integer by a factor more than 1
and then using it as an allocation size. This is harmless on 64-bit
systems where we'd compute a size exceeding MaxAllocSize and then
fail, but on 32-bit systems we could overflow size_t leading to an
undersized allocation and buffer overrun.
Fix these places by using palloc_array() instead of a handwritten
multiplication. (In HEAD, some of them were fixed already, but
none of that work got back-patched at the time.)
In addition, BlockRefTableReaderNextRelation passes the same value
to BlockRefTableRead's "int length" parameter. If built for
64-bit frontend code, palloc_array() allows a larger array size
than it otherwise would, potentially allowing that parameter to
overflow. Add an explicit check to forestall that and keep the
behavior the same cross-platform.
Reported-by: Xint Code
Author: Tom Lane <tgl@sss.pgh.pa.us>
Backpatch-through: 14
Security: CVE-2026-6473
Branch
------
REL_18_STABLE
Details
-------
https://git.postgresql.org/pg/commitdiff/01e568b8c11bc0e609cb2b1f936a0697d793703d
Author: Tom Lane <tgl@sss.pgh.pa.us>
Modified Files
--------------
src/backend/utils/adt/multirangetypes.c | 9 +++++----
src/common/blkreftable.c | 27 ++++++++++++++++++++-------
2 files changed, 25 insertions(+), 11 deletions(-)
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-committers@postgresql.org
Cc: noah@leadboat.com, pgsql-committers@lists.postgresql.org
Subject: Re: pgsql: Fix assorted places that need to use palloc_array().
In-Reply-To: <E1wMPbl-0002U3-15@gemulon.postgresql.org>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox