pgsql: Be more wary about constant's datatype in scalarineqsel().

Be more wary about constant's datatype in scalarineqsel().

The special case here for estimating conditions involving a ctid
column failed to check that the RHS constant is of type tid.
While that'd always be true for the built-in operators that
reference this selectivity estimator, a maliciously constructed
operator could provide a user-controlled Datum value that would
get interpreted as an ItemPointer pointer. That at least risks
SIGSEGV, and perhaps with a bit of sweat it could be used for
server memory disclosure.

Reported-by: Hcamael <baiyjrh(at)gmail(dot)com>
Author: Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us>
Reviewed-by: Noah Misch <noah(at)leadboat(dot)com>
Backpatch-through: 14
Security: CVE-2026-14668

Branch
------
REL_18_STABLE

Details
-------
https://git.postgresql.org/pg/commitdiff/a2cb5a1cfbae3c002f382ec22781c8f7c284f9d0
Author: Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us>

Modified Files
--------------
src/backend/utils/adt/selfuncs.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)