agora inbox for pgsql-committers@postgresql.orghelp / color / mirror / Atom feed
pgsql: Return nulls honestly in aggregate "combine" functions. 6+ messages / 1 participants [nested] [flat]
* pgsql: Return nulls honestly in aggregate "combine" functions. @ 2026-08-10 13:41 Noah Misch <noah@leadboat.com> 0 siblings, 0 replies; 6+ messages in thread From: Noah Misch @ 2026-08-10 13:41 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Return nulls honestly in aggregate "combine" functions. numeric_combine() and several other state-combining functions for aggregates cheated for the case of both inputs being NULL: they returned a null pointer without bothering to mark it as a SQL NULL. This was harmless in the expected usage where the result would be passed to the same combine function or a related aggregate final function. But it's bad news from a security standpoint, because now that value can be passed to an internal-accepting function even if said function is strict. While a previous patch prevented such queries from being issued, it seems like good defense-in-depth to expend the few additional lines of code needed to do this properly. Comparable functions such as array_agg_combine() already do so. Reported-by: Amy Burnett (OpenAI Codex Security) Author: Tom Lane <tgl@sss.pgh.pa.us> Backpatch-through: 14 Security: CVE-2026-14680 Branch ------ master Details ------- https://git.postgresql.org/pg/commitdiff/1aa601b4f55e337f1c8d19757129815f1685cac2 Author: Tom Lane <tgl@sss.pgh.pa.us> Modified Files -------------- src/backend/utils/adt/numeric.c | 32 ++++++++++++++++++++++++++++++++ src/backend/utils/adt/timestamp.c | 8 ++++++++ 2 files changed, 40 insertions(+) ^ permalink raw reply [nested|flat] 6+ messages in thread
* pgsql: Return nulls honestly in aggregate "combine" functions. @ 2026-08-10 13:41 Noah Misch <noah@leadboat.com> 0 siblings, 0 replies; 6+ messages in thread From: Noah Misch @ 2026-08-10 13:41 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Return nulls honestly in aggregate "combine" functions. numeric_combine() and several other state-combining functions for aggregates cheated for the case of both inputs being NULL: they returned a null pointer without bothering to mark it as a SQL NULL. This was harmless in the expected usage where the result would be passed to the same combine function or a related aggregate final function. But it's bad news from a security standpoint, because now that value can be passed to an internal-accepting function even if said function is strict. While a previous patch prevented such queries from being issued, it seems like good defense-in-depth to expend the few additional lines of code needed to do this properly. Comparable functions such as array_agg_combine() already do so. Reported-by: Amy Burnett (OpenAI Codex Security) Author: Tom Lane <tgl@sss.pgh.pa.us> Backpatch-through: 14 Security: CVE-2026-14680 Branch ------ REL_19_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/21d8cfb18f465be344dd83852792b88818c33634 Author: Tom Lane <tgl@sss.pgh.pa.us> Modified Files -------------- src/backend/utils/adt/numeric.c | 32 ++++++++++++++++++++++++++++++++ src/backend/utils/adt/timestamp.c | 8 ++++++++ 2 files changed, 40 insertions(+) ^ permalink raw reply [nested|flat] 6+ messages in thread
* pgsql: Return nulls honestly in aggregate "combine" functions. @ 2026-08-10 13:41 Noah Misch <noah@leadboat.com> 0 siblings, 0 replies; 6+ messages in thread From: Noah Misch @ 2026-08-10 13:41 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Return nulls honestly in aggregate "combine" functions. numeric_combine() and several other state-combining functions for aggregates cheated for the case of both inputs being NULL: they returned a null pointer without bothering to mark it as a SQL NULL. This was harmless in the expected usage where the result would be passed to the same combine function or a related aggregate final function. But it's bad news from a security standpoint, because now that value can be passed to an internal-accepting function even if said function is strict. While a previous patch prevented such queries from being issued, it seems like good defense-in-depth to expend the few additional lines of code needed to do this properly. Comparable functions such as array_agg_combine() already do so. Reported-by: Amy Burnett (OpenAI Codex Security) Author: Tom Lane <tgl@sss.pgh.pa.us> Backpatch-through: 14 Security: CVE-2026-14680 Branch ------ REL_18_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/722695db18b6540a3757811436116f928c71b763 Author: Tom Lane <tgl@sss.pgh.pa.us> Modified Files -------------- src/backend/utils/adt/numeric.c | 32 ++++++++++++++++++++++++++++++++ src/backend/utils/adt/timestamp.c | 8 ++++++++ 2 files changed, 40 insertions(+) ^ permalink raw reply [nested|flat] 6+ messages in thread
* pgsql: Return nulls honestly in aggregate "combine" functions. @ 2026-08-10 13:41 Noah Misch <noah@leadboat.com> 0 siblings, 0 replies; 6+ messages in thread From: Noah Misch @ 2026-08-10 13:41 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Return nulls honestly in aggregate "combine" functions. numeric_combine() and several other state-combining functions for aggregates cheated for the case of both inputs being NULL: they returned a null pointer without bothering to mark it as a SQL NULL. This was harmless in the expected usage where the result would be passed to the same combine function or a related aggregate final function. But it's bad news from a security standpoint, because now that value can be passed to an internal-accepting function even if said function is strict. While a previous patch prevented such queries from being issued, it seems like good defense-in-depth to expend the few additional lines of code needed to do this properly. Comparable functions such as array_agg_combine() already do so. Reported-by: Amy Burnett (OpenAI Codex Security) Author: Tom Lane <tgl@sss.pgh.pa.us> Backpatch-through: 14 Security: CVE-2026-14680 Branch ------ REL_17_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/83d0a083f178f22c60814b93d17ecacdcce76eac Author: Tom Lane <tgl@sss.pgh.pa.us> Modified Files -------------- src/backend/utils/adt/numeric.c | 32 ++++++++++++++++++++++++++++++++ src/backend/utils/adt/timestamp.c | 8 ++++++++ 2 files changed, 40 insertions(+) ^ permalink raw reply [nested|flat] 6+ messages in thread
* pgsql: Return nulls honestly in aggregate "combine" functions. @ 2026-08-10 13:41 Noah Misch <noah@leadboat.com> 0 siblings, 0 replies; 6+ messages in thread From: Noah Misch @ 2026-08-10 13:41 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Return nulls honestly in aggregate "combine" functions. numeric_combine() and several other state-combining functions for aggregates cheated for the case of both inputs being NULL: they returned a null pointer without bothering to mark it as a SQL NULL. This was harmless in the expected usage where the result would be passed to the same combine function or a related aggregate final function. But it's bad news from a security standpoint, because now that value can be passed to an internal-accepting function even if said function is strict. While a previous patch prevented such queries from being issued, it seems like good defense-in-depth to expend the few additional lines of code needed to do this properly. Comparable functions such as array_agg_combine() already do so. Reported-by: Amy Burnett (OpenAI Codex Security) Author: Tom Lane <tgl@sss.pgh.pa.us> Backpatch-through: 14 Security: CVE-2026-14680 Branch ------ REL_16_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/7f308dd7ca11251a056444d66dd97a842e1b16b2 Author: Tom Lane <tgl@sss.pgh.pa.us> Modified Files -------------- src/backend/utils/adt/numeric.c | 32 ++++++++++++++++++++++++++++++++ 1 file changed, 32 insertions(+) ^ permalink raw reply [nested|flat] 6+ messages in thread
* pgsql: Return nulls honestly in aggregate "combine" functions. @ 2026-08-10 13:41 Noah Misch <noah@leadboat.com> 0 siblings, 0 replies; 6+ messages in thread From: Noah Misch @ 2026-08-10 13:41 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Return nulls honestly in aggregate "combine" functions. numeric_combine() and several other state-combining functions for aggregates cheated for the case of both inputs being NULL: they returned a null pointer without bothering to mark it as a SQL NULL. This was harmless in the expected usage where the result would be passed to the same combine function or a related aggregate final function. But it's bad news from a security standpoint, because now that value can be passed to an internal-accepting function even if said function is strict. While a previous patch prevented such queries from being issued, it seems like good defense-in-depth to expend the few additional lines of code needed to do this properly. Comparable functions such as array_agg_combine() already do so. Reported-by: Amy Burnett (OpenAI Codex Security) Author: Tom Lane <tgl@sss.pgh.pa.us> Backpatch-through: 14 Security: CVE-2026-14680 Branch ------ REL_15_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/d6e861e19ab668b5e3567318bbded59b3359b79d Author: Tom Lane <tgl@sss.pgh.pa.us> Modified Files -------------- src/backend/utils/adt/numeric.c | 32 ++++++++++++++++++++++++++++++++ 1 file changed, 32 insertions(+) ^ permalink raw reply [nested|flat] 6+ messages in thread
end of thread, other threads:[~2026-08-10 13:41 UTC | newest] Thread overview: 6+ messages (download: mbox mbox.gz follow: Atom feed) -- links below jump to the message on this page -- 2026-08-10 13:41 pgsql: Return nulls honestly in aggregate "combine" functions. Noah Misch <noah@leadboat.com> 2026-08-10 13:41 pgsql: Return nulls honestly in aggregate "combine" functions. Noah Misch <noah@leadboat.com> 2026-08-10 13:41 pgsql: Return nulls honestly in aggregate "combine" functions. Noah Misch <noah@leadboat.com> 2026-08-10 13:41 pgsql: Return nulls honestly in aggregate "combine" functions. Noah Misch <noah@leadboat.com> 2026-08-10 13:41 pgsql: Return nulls honestly in aggregate "combine" functions. Noah Misch <noah@leadboat.com> 2026-08-10 13:41 pgsql: Return nulls honestly in aggregate "combine" functions. Noah Misch <noah@leadboat.com>
This inbox is served by agora; see mirroring instructions for how to clone and mirror all data and code used for this inbox