This is an automated email from the ASF dual-hosted git repository. reshke pushed a commit to branch REL_2_STABLE in repository https://gitbox.apache.org/repos/asf/cloudberry.git
commit 19dc66b5f7116bbd32d7a51bf1e4f18e355025f6 Author: Tom Lane <[email protected]> AuthorDate: Mon Aug 10 06:38:35 2026 -0700 Be more wary about constant's datatype in scalarineqsel(). The special case here for estimating conditions involving a ctid column failed to check that the RHS constant is of type tid. While that'd always be true for the built-in operators that reference this selectivity estimator, a maliciously constructed operator could provide a user-controlled Datum value that would get interpreted as an ItemPointer pointer. That at least risks SIGSEGV, and perhaps with a bit of sweat it could be used for server memory disclosure. Reported-by: Hcamael <[email protected]> Author: Tom Lane <[email protected]> Reviewed-by: Noah Misch <[email protected]> Backpatch-through: 14 Security: CVE-2026-14668 --- src/backend/utils/adt/selfuncs.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/backend/utils/adt/selfuncs.c b/src/backend/utils/adt/selfuncs.c index b83c29606c5..4446776c35e 100644 --- a/src/backend/utils/adt/selfuncs.c +++ b/src/backend/utils/adt/selfuncs.c @@ -604,7 +604,8 @@ scalarineqsel(PlannerInfo *root, Oid operator, bool isgt, bool iseq, * make an estimate based on comparing the constant to the table size. */ if (vardata->var && IsA(vardata->var, Var) && - ((Var *) vardata->var)->varattno == SelfItemPointerAttributeNumber) + ((Var *) vardata->var)->varattno == SelfItemPointerAttributeNumber && + consttype == TIDOID) { ItemPointer itemptr; double block; --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
