This is an automated email from the ASF dual-hosted git repository. my-ship-it pushed a commit to branch REL_2_STABLE in repository https://gitbox.apache.org/repos/asf/cloudberry.git
commit 1ac939bfb8bf64f4fd5cc4ad908e07387adcb3ad Author: Michael Paquier <[email protected]> AuthorDate: Mon May 11 05:13:49 2026 -0700 ltree: Fix overflows with lquery parsing The lquery parser in contrib/ltree/ had two overflow problems: - A single lquery level with many OR-separated variants (e.g., 'label1|label2|...'), could cause an overflow of totallen, this being stored as a uint16, meaning a maximum value of UINT16_MAX or 65k. Each variant contributes MAXALIGN(LVAR_HDRSIZE + len) bytes. With enough long variants, the value would wraparound. This would corrupt the data written by LQL_NEXT(), leading to a stack corruption, most likely translating into a crash, but it would allow incorrect memory access. - numvar, labelled as a uint16, counts the number of OR-variants in a single level, and it is incremented without bounds checking. With more than PG_UINT16_MAX (65k) variants in a single level, and a minimum of 131kB of input data, it would wrap to 0. When a (wildcard) '*' is used, this would change the query results silently. For both issues, a set of overflows checks are added to guard against these problematic patterns. The first issue has been reported by the three people listed below, affecting v16 and newer versions due to b1665bf01e5f. Its coding was still unsafe in v14 and v15. The second issue affects all the stable branches; I have bumped into while reviewing the code of the module. Reported-by: Vergissmeinnicht <[email protected]> Reported-by: A1ex <[email protected]> Reported-by: Jihe Wang <[email protected]> Author: Michael Paquier <[email protected]> Security: CVE-2026-6473 Backpatch-through: 14 --- contrib/ltree/expected/ltree.out | 39 +++++++++++++++++++++++++++++++++++++++ contrib/ltree/ltree_io.c | 19 +++++++++++++++++-- contrib/ltree/sql/ltree.sql | 27 +++++++++++++++++++++++++++ 3 files changed, 83 insertions(+), 2 deletions(-) diff --git a/contrib/ltree/expected/ltree.out b/contrib/ltree/expected/ltree.out index f829bbf2a36..a02579de447 100644 --- a/contrib/ltree/expected/ltree.out +++ b/contrib/ltree/expected/ltree.out @@ -8096,3 +8096,42 @@ select opcname,amname from pg_opclass opc, pg_am am where am.oid=opc.opcmethod ltree_ops | bitmap (3 rows) +-- test non-error-throwing input +SELECT str as "value", typ as "type", + pg_input_is_valid(str,typ) as ok, + errinfo.sql_error_code, + errinfo.message, + errinfo.detail, + errinfo.hint +FROM (VALUES ('.2.3', 'ltree'), + ('1.2.', 'ltree'), + ('1.2.3','ltree'), + ('@.2.3','lquery'), + (' 2.3', 'lquery'), + ('1.2.3','lquery'), + ('$tree & aWdf@*','ltxtquery'), + ('!tree & aWdf@*','ltxtquery')) + AS a(str,typ), + LATERAL pg_input_error_info(a.str, a.typ) as errinfo; + value | type | ok | sql_error_code | message | detail | hint +----------------+-----------+----+----------------+------------------------------------+--------------------------+------ + .2.3 | ltree | f | 42601 | ltree syntax error at character 1 | | + 1.2. | ltree | f | 42601 | ltree syntax error | Unexpected end of input. | + 1.2.3 | ltree | t | | | | + @.2.3 | lquery | f | 42601 | lquery syntax error at character 1 | | + 2.3 | lquery | f | 42601 | lquery syntax error at character 1 | | + 1.2.3 | lquery | t | | | | + $tree & aWdf@* | ltxtquery | f | 42601 | operand syntax error | | + !tree & aWdf@* | ltxtquery | t | | | | +(8 rows) + +-- Test for overflow of lquery_level.totallen, based on an lquery level with +-- many OR-variants. +SELECT (repeat('x', 1000) || repeat('|' || repeat('x', 1000), 65))::lquery; +ERROR: lquery level is too large +DETAIL: Total size of level exceeds the maximum allowed (65535 bytes). +-- Test for overflow of lquery_level.numvar, with a set of single-char +-- variants in one level. +SELECT (repeat('a|', 65535) || 'a')::lquery; +ERROR: lquery level has too many variants +DETAIL: Number of variants exceeds the maximum allowed (65535). diff --git a/contrib/ltree/ltree_io.c b/contrib/ltree/ltree_io.c index 15115cb29f3..1e24f54ec62 100644 --- a/contrib/ltree/ltree_io.c +++ b/contrib/ltree/ltree_io.c @@ -7,6 +7,7 @@ #include <ctype.h> +#include "common/int.h" #include "crc32.h" #include "libpq/pqformat.h" #include "ltree.h" @@ -338,7 +339,12 @@ parse_lquery(const char *buf) lptr++; lptr->start = ptr; state = LQPRS_WAITDELIM; - curqlevel->numvar++; + if (pg_add_u16_overflow(curqlevel->numvar, 1, &curqlevel->numvar)) + ereturn(escontext, NULL, + (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED), + errmsg("lquery level has too many variants"), + errdetail("Number of variants exceeds the maximum allowed (%d).", + PG_UINT16_MAX))); } else UNCHAR; @@ -530,7 +536,16 @@ parse_lquery(const char *buf) lptr = GETVAR(curqlevel); while (lptr - GETVAR(curqlevel) < curqlevel->numvar) { - cur->totallen += MAXALIGN(LVAR_HDRSIZE + lptr->len); + int newlen = cur->totallen + MAXALIGN(LVAR_HDRSIZE + lptr->len); + + if (newlen > PG_UINT16_MAX) + ereturn(escontext, NULL, + (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED), + errmsg("lquery level is too large"), + errdetail("Total size of level exceeds the maximum allowed (%d bytes).", + PG_UINT16_MAX))); + cur->totallen = (uint16) newlen; + lrptr->len = lptr->len; lrptr->flag = lptr->flag; lrptr->val = ltree_crc32_sz(lptr->start, lptr->len); diff --git a/contrib/ltree/sql/ltree.sql b/contrib/ltree/sql/ltree.sql index b2bce33b0af..cc2aa4f4c57 100644 --- a/contrib/ltree/sql/ltree.sql +++ b/contrib/ltree/sql/ltree.sql @@ -389,3 +389,30 @@ SELECT count(*) FROM _ltreetest WHERE t ? '{23.*.1,23.*.2}' ; -- Test that has all opclasses select opcname,amname from pg_opclass opc, pg_am am where am.oid=opc.opcmethod and opcintype='ltree'::regtype; + +-- test non-error-throwing input + +SELECT str as "value", typ as "type", + pg_input_is_valid(str,typ) as ok, + errinfo.sql_error_code, + errinfo.message, + errinfo.detail, + errinfo.hint +FROM (VALUES ('.2.3', 'ltree'), + ('1.2.', 'ltree'), + ('1.2.3','ltree'), + ('@.2.3','lquery'), + (' 2.3', 'lquery'), + ('1.2.3','lquery'), + ('$tree & aWdf@*','ltxtquery'), + ('!tree & aWdf@*','ltxtquery')) + AS a(str,typ), + LATERAL pg_input_error_info(a.str, a.typ) as errinfo; + +-- Test for overflow of lquery_level.totallen, based on an lquery level with +-- many OR-variants. +SELECT (repeat('x', 1000) || repeat('|' || repeat('x', 1000), 65))::lquery; + +-- Test for overflow of lquery_level.numvar, with a set of single-char +-- variants in one level. +SELECT (repeat('a|', 65535) || 'a')::lquery; --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
