diff options
| author | Michael Paquier | 2026-08-20 00:38:32 +0000 |
|---|---|---|
| committer | Michael Paquier | 2026-08-20 00:38:32 +0000 |
| commit | 4027fb60b9691f3fada876822396c8a00e697beb (patch) | |
| tree | c68bfdc4637d57e0d17b2bb06ef7f638b336c80b | |
| parent | bf25c5f832fed181505bbbd46f8ce17a2583b79f (diff) | |
Reject too many arguments in CREATE TRIGGER
The number of trigger arguments is stored as a smallint, but there was
no check that the number of arguments fits with the catalog data type.
This could result in an invalid negative value being stored once one
defined more than INT16_MAX arguments, with an overflowed value stored
in the catalogs.
Looking at other catalogs that store a number of arguments, we have
similar protections already in place (aggregates, functions, etc.).
Reported-by: Xingwang Xiang <v3rdant.xiang@gmail.com>
Author: Kyotaro Horiguchi <horikyota.ntt@gmail.com>
Discussion: https://postgr.es/m/19627-5b72a57e332e2b3f@postgresql.org
Backpatch-through: 14
| -rw-r--r-- | src/backend/commands/trigger.c | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/src/backend/commands/trigger.c b/src/backend/commands/trigger.c index 537590304e8..b393ee87ad1 100644 --- a/src/backend/commands/trigger.c +++ b/src/backend/commands/trigger.c @@ -885,9 +885,16 @@ CreateTriggerFiringOn(CreateTrigStmt *stmt, const char *queryString, { ListCell *le; char *args; - int16 nargs = list_length(stmt->args); + int nargs = list_length(stmt->args); int len = 0; + Assert(nargs >= 0); + if (nargs > PG_INT16_MAX) + ereport(ERROR, + errcode(ERRCODE_TOO_MANY_ARGUMENTS), + errmsg("triggers cannot have more than %d arguments", + PG_INT16_MAX)); + foreach(le, stmt->args) { char *ar = strVal(lfirst(le)); |