agora inbox for pgsql-committers@postgresql.org  
help / color / mirror / Atom feed
From: Noah Misch <noah@leadboat.com>
To: pgsql-committers@lists.postgresql.org
Subject: pgsql: Use palloc_array() in pltcl and plperl to avoid overflow
Date: Mon, 10 Aug 2026 13:41:29 +0000
Message-ID: <E1wtQFt-00000000yGd-26DW@gemulon.postgresql.org> (raw)

Use palloc_array() in pltcl and plperl to avoid overflow

Some of these could overflow on 32-bit systems with the right input.
Convert all cases where we called palloc() with multiplication to fix
them. Not all of them were bugs, but it's better to be safe than
sorry.

Reported-by: Tulya Project, Team Dhiutsa, Bitecope Technologies Private Ltd
Backpatch-through: 14
Security: CVE-2026-14677

Branch
------
REL_16_STABLE

Details
-------
https://git.postgresql.org/pg/commitdiff/8bbdc054043af64add7ac4ec544efb1219d9901d
Author: Heikki Linnakangas <heikki.linnakangas@iki.fi>

Modified Files
--------------
src/pl/plperl/SPI.xs   |  6 +++---
src/pl/plperl/plperl.c | 38 +++++++++++++++++++-------------------
src/pl/tcl/pltcl.c     | 20 ++++++++++----------
3 files changed, 32 insertions(+), 32 deletions(-)



view thread (6+ messages)  latest in thread

Message-ID: <E1wtQFt-00000000yGd-26DW@gemulon.postgresql.org>
Permalink:  ../E1wtQFt-00000000yGd-26DW@gemulon.postgresql.org/
Also on:    postgresql.org/message-id/E1wtQFt-00000000yGd-26DW@gemulon.postgresql.org

reply

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-committers@postgresql.org
  Cc: noah@leadboat.com, pgsql-committers@lists.postgresql.org
  Subject: Re: pgsql: Use palloc_array() in pltcl and plperl to avoid overflow
  In-Reply-To: <E1wtQFt-00000000yGd-26DW@gemulon.postgresql.org>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox