diff options
| author | Tom Lane | 2026-08-10 13:38:35 +0000 |
|---|---|---|
| committer | Noah Misch | 2026-08-10 13:38:35 +0000 |
| commit | cf44ff5e66353264451ac239b39e9053e8d138e6 (patch) | |
| tree | 552e87baee756d20de30039172275cc4f55db44a | |
| parent | 59205c7e9b4a3afbdab4d677c16036cdd1bd080d (diff) | |
Replace fixed-size, too-short array with a palloc'd one.
MatchNamedCall's arggiven array was declared FUNC_MAX_ARGS long,
but we may actually use up to pronallargs elements, and that can
be more than FUNC_MAX_ARGS if the function has OUT arguments
(cf. ProcedureCreate). Convert it to a palloc'd array.
Reported-by: Zheng Yu <zheng@depthfirst.com>
Reported-by: ylwangtju <ylwangtju@qq.com>
Author: Tom Lane <tgl@sss.pgh.pa.us>
Reviewed-by: Michael Paquier <michael@paquier.xyz>
Reviewed-by: Masahiko Sawada <sawada.mshk@gmail.com>
Backpatch-through: 14
Security: CVE-2026-14679
| -rw-r--r-- | src/backend/catalog/namespace.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/src/backend/catalog/namespace.c b/src/backend/catalog/namespace.c index df91d2d8d3d..5fe4003de37 100644 --- a/src/backend/catalog/namespace.c +++ b/src/backend/catalog/namespace.c @@ -1355,7 +1355,7 @@ MatchNamedCall(HeapTuple proctup, int nargs, List *argnames, Oid *p_argtypes; char **p_argnames; char *p_argmodes; - bool arggiven[FUNC_MAX_ARGS]; + bool *arggiven; bool isnull; int ap; /* call args position */ int pp; /* proargs position */ @@ -1379,8 +1379,8 @@ MatchNamedCall(HeapTuple proctup, int nargs, List *argnames, Assert(include_out_arguments ? (pronargs == pronallargs) : (pronargs <= pronallargs)); /* initialize state for matching */ - *argnumbers = (int *) palloc(pronargs * sizeof(int)); - memset(arggiven, false, pronargs * sizeof(bool)); + *argnumbers = palloc_array(int, pronargs); + arggiven = palloc0_array(bool, pronallargs); /* there are numposargs positional args before the named args */ for (ap = 0; ap < numposargs; ap++) |