pgsql: Use palloc_array() in pltcl and plperl to avoid overflow

From: Noah Misch <noah(at)leadboat(dot)com>
To: pgsql-committers(at)lists(dot)postgresql(dot)org
Subject: pgsql: Use palloc_array() in pltcl and plperl to avoid overflow
Date: 2026-08-10 13:41:31
Message-ID: E1wtQFv-00000000yKY-0aGN@gemulon.postgresql.org
Views: Whole Thread | Raw Message | Download mbox | Resend email
Thread:
Lists: pgsql-committers

Use palloc_array() in pltcl and plperl to avoid overflow

Some of these could overflow on 32-bit systems with the right input.
Convert all cases where we called palloc() with multiplication to fix
them. Not all of them were bugs, but it's better to be safe than
sorry.

Reported-by: Tulya Project, Team Dhiutsa, Bitecope Technologies Private Ltd
Backpatch-through: 14
Security: CVE-2026-14677

Branch
------
REL_15_STABLE

Details
-------
https://git.postgresql.org/pg/commitdiff/1eb0d53804a42b9d2bcc645bbd4ec75fd7c5291a
Author: Heikki Linnakangas <heikki(dot)linnakangas(at)iki(dot)fi>

Modified Files
--------------
src/pl/plperl/SPI.xs | 6 +++---
src/pl/plperl/plperl.c | 38 +++++++++++++++++++-------------------
src/pl/tcl/pltcl.c | 20 ++++++++++----------
3 files changed, 32 insertions(+), 32 deletions(-)

Browse pgsql-committers by date

  From Date Subject
Next Message Noah Misch 2026-08-10 13:41:32 pgsql: psql: Don't do backquote expansion in \unrestrict.
Previous Message Noah Misch 2026-08-10 13:41:30 pgsql: pgcrypto: Add option to revert to prior decryption behavior