agora inbox for pgsql-committers@postgresql.org  
help / color / mirror / Atom feed
pgsql: Fix pg_trgm's picksplit function with all-true datums
6+ messages / 1 participants
[nested] [flat]

* pgsql: Fix pg_trgm's picksplit function with all-true datums
@ 2026-08-10 13:41 Noah Misch <noah@leadboat.com>
  0 siblings, 0 replies; 6+ messages in thread

From: Noah Misch @ 2026-08-10 13:41 UTC (permalink / raw)
  To: pgsql-committers@lists.postgresql.org

Fix pg_trgm's picksplit function with all-true datums

The CACHESIGN.sign field is a BITVECP, not a TRGM, so you should not
use GETSIGN() on it. You don't get a compiler warning because the
GETSIGN() macro includes a cast. It resulted in a bogus read beyond
end of buffer, which would cause bad split decisions or a crash if
you're very unlucky.

Reported-by: Mehmet D. INCE <mehmet@mehmetince.net>
Backpatch-through: 14
Security: CVE-2026-14678

Branch
------
master

Details
-------
https://git.postgresql.org/pg/commitdiff/66c2dbb20445195f92225708a930112ee9e96bf4
Author: Heikki Linnakangas <heikki.linnakangas@iki.fi>

Modified Files
--------------
contrib/pg_trgm/trgm_gist.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)



^ permalink  raw  reply  [nested|flat] 6+ messages in thread

* pgsql: Fix pg_trgm's picksplit function with all-true datums
@ 2026-08-10 13:41 Noah Misch <noah@leadboat.com>
  0 siblings, 0 replies; 6+ messages in thread

From: Noah Misch @ 2026-08-10 13:41 UTC (permalink / raw)
  To: pgsql-committers@lists.postgresql.org

Fix pg_trgm's picksplit function with all-true datums

The CACHESIGN.sign field is a BITVECP, not a TRGM, so you should not
use GETSIGN() on it. You don't get a compiler warning because the
GETSIGN() macro includes a cast. It resulted in a bogus read beyond
end of buffer, which would cause bad split decisions or a crash if
you're very unlucky.

Reported-by: Mehmet D. INCE <mehmet@mehmetince.net>
Backpatch-through: 14
Security: CVE-2026-14678

Branch
------
REL_19_STABLE

Details
-------
https://git.postgresql.org/pg/commitdiff/aa7b5815ea099763b1cfe01e431b0ec8312c943f
Author: Heikki Linnakangas <heikki.linnakangas@iki.fi>

Modified Files
--------------
contrib/pg_trgm/trgm_gist.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)



^ permalink  raw  reply  [nested|flat] 6+ messages in thread

* pgsql: Fix pg_trgm's picksplit function with all-true datums
@ 2026-08-10 13:41 Noah Misch <noah@leadboat.com>
  0 siblings, 0 replies; 6+ messages in thread

From: Noah Misch @ 2026-08-10 13:41 UTC (permalink / raw)
  To: pgsql-committers@lists.postgresql.org

Fix pg_trgm's picksplit function with all-true datums

The CACHESIGN.sign field is a BITVECP, not a TRGM, so you should not
use GETSIGN() on it. You don't get a compiler warning because the
GETSIGN() macro includes a cast. It resulted in a bogus read beyond
end of buffer, which would cause bad split decisions or a crash if
you're very unlucky.

Reported-by: Mehmet D. INCE <mehmet@mehmetince.net>
Backpatch-through: 14
Security: CVE-2026-14678

Branch
------
REL_18_STABLE

Details
-------
https://git.postgresql.org/pg/commitdiff/849019a50a0ccbc7a7fe2ab3db53078ec2f99131
Author: Heikki Linnakangas <heikki.linnakangas@iki.fi>

Modified Files
--------------
contrib/pg_trgm/trgm_gist.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)



^ permalink  raw  reply  [nested|flat] 6+ messages in thread

* pgsql: Fix pg_trgm's picksplit function with all-true datums
@ 2026-08-10 13:41 Noah Misch <noah@leadboat.com>
  0 siblings, 0 replies; 6+ messages in thread

From: Noah Misch @ 2026-08-10 13:41 UTC (permalink / raw)
  To: pgsql-committers@lists.postgresql.org

Fix pg_trgm's picksplit function with all-true datums

The CACHESIGN.sign field is a BITVECP, not a TRGM, so you should not
use GETSIGN() on it. You don't get a compiler warning because the
GETSIGN() macro includes a cast. It resulted in a bogus read beyond
end of buffer, which would cause bad split decisions or a crash if
you're very unlucky.

Reported-by: Mehmet D. INCE <mehmet@mehmetince.net>
Backpatch-through: 14
Security: CVE-2026-14678

Branch
------
REL_17_STABLE

Details
-------
https://git.postgresql.org/pg/commitdiff/1af08af694815520e5642dc3a85cc010cbcf9f84
Author: Heikki Linnakangas <heikki.linnakangas@iki.fi>

Modified Files
--------------
contrib/pg_trgm/trgm_gist.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)



^ permalink  raw  reply  [nested|flat] 6+ messages in thread

* pgsql: Fix pg_trgm's picksplit function with all-true datums
@ 2026-08-10 13:41 Noah Misch <noah@leadboat.com>
  0 siblings, 0 replies; 6+ messages in thread

From: Noah Misch @ 2026-08-10 13:41 UTC (permalink / raw)
  To: pgsql-committers@lists.postgresql.org

Fix pg_trgm's picksplit function with all-true datums

The CACHESIGN.sign field is a BITVECP, not a TRGM, so you should not
use GETSIGN() on it. You don't get a compiler warning because the
GETSIGN() macro includes a cast. It resulted in a bogus read beyond
end of buffer, which would cause bad split decisions or a crash if
you're very unlucky.

Reported-by: Mehmet D. INCE <mehmet@mehmetince.net>
Backpatch-through: 14
Security: CVE-2026-14678

Branch
------
REL_16_STABLE

Details
-------
https://git.postgresql.org/pg/commitdiff/24c88cd39d0174790b657bbaba88d557c09856b8
Author: Heikki Linnakangas <heikki.linnakangas@iki.fi>

Modified Files
--------------
contrib/pg_trgm/trgm_gist.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)



^ permalink  raw  reply  [nested|flat] 6+ messages in thread

* pgsql: Fix pg_trgm's picksplit function with all-true datums
@ 2026-08-10 13:41 Noah Misch <noah@leadboat.com>
  0 siblings, 0 replies; 6+ messages in thread

From: Noah Misch @ 2026-08-10 13:41 UTC (permalink / raw)
  To: pgsql-committers@lists.postgresql.org

Fix pg_trgm's picksplit function with all-true datums

The CACHESIGN.sign field is a BITVECP, not a TRGM, so you should not
use GETSIGN() on it. You don't get a compiler warning because the
GETSIGN() macro includes a cast. It resulted in a bogus read beyond
end of buffer, which would cause bad split decisions or a crash if
you're very unlucky.

Reported-by: Mehmet D. INCE <mehmet@mehmetince.net>
Backpatch-through: 14
Security: CVE-2026-14678

Branch
------
REL_15_STABLE

Details
-------
https://git.postgresql.org/pg/commitdiff/c7c82a88c312dc6ff626c037ac12846f1d0ca9c4
Author: Heikki Linnakangas <heikki.linnakangas@iki.fi>

Modified Files
--------------
contrib/pg_trgm/trgm_gist.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)



^ permalink  raw  reply  [nested|flat] 6+ messages in thread


end of thread, other threads:[~2026-08-10 13:41 UTC | newest]

Thread overview: 6+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2026-08-10 13:41 pgsql: Fix pg_trgm's picksplit function with all-true datums Noah Misch <noah@leadboat.com>
2026-08-10 13:41 pgsql: Fix pg_trgm's picksplit function with all-true datums Noah Misch <noah@leadboat.com>
2026-08-10 13:41 pgsql: Fix pg_trgm's picksplit function with all-true datums Noah Misch <noah@leadboat.com>
2026-08-10 13:41 pgsql: Fix pg_trgm's picksplit function with all-true datums Noah Misch <noah@leadboat.com>
2026-08-10 13:41 pgsql: Fix pg_trgm's picksplit function with all-true datums Noah Misch <noah@leadboat.com>
2026-08-10 13:41 pgsql: Fix pg_trgm's picksplit function with all-true datums Noah Misch <noah@leadboat.com>

This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox