From 2a92b0c519663fe2bb4cbac8f71829f0ccc76149 Mon Sep 17 00:00:00 2001 From: Kyotaro Horiguchi Date: Wed, 19 Aug 2026 11:40:16 +0900 Subject: [PATCH v1] Reject too many arguments in CREATE TRIGGER The number of trigger arguments is stored as an int16, but there was no check that the number of arguments fits in that type. This could result in an invalid negative value being stored. Check that the number of arguments does not exceed INT16_MAX. --- src/backend/commands/trigger.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/src/backend/commands/trigger.c b/src/backend/commands/trigger.c index b7881bf4a29..304cc1e7ace 100644 --- a/src/backend/commands/trigger.c +++ b/src/backend/commands/trigger.c @@ -897,9 +897,16 @@ CreateTriggerFiringOn(const CreateTrigStmt *stmt, const char *queryString, { ListCell *le; char *args; - int16 nargs = list_length(stmt->args); + int nargs = list_length(stmt->args); int len = 0; + Assert(nargs >= 0); + if (nargs > INT16_MAX) + ereport(ERROR, + errcode(ERRCODE_TOO_MANY_ARGUMENTS), + errmsg("triggers cannot have more than %d arguments", + INT16_MAX)); + foreach(le, stmt->args) { char *ar = strVal(lfirst(le)); -- 2.52.0