You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cloudberry.apache.org by re...@apache.org on 2026/09/01 06:19:57 UTC
(cloudberry) 11/21: Cross-check the type of a portal running EXECUTE or FETCH.
This is an automated email from the ASF dual-hosted git repository.
reshke pushed a commit to branch REL_2_STABLE
in repository https://gitbox.apache.org/repos/asf/cloudberry.git
commit a872b22d44ae87d9e10582a7febba49c62e046c5
Author: Robert Haas <rh...@postgresql.org>
AuthorDate: Mon Aug 10 06:38:36 2026 -0700
Cross-check the type of a portal running EXECUTE or FETCH.
When an EXECUTE or FETCH statement is executed, there are two portals:
an outer portal that is created for the EXECUTE or FETCH statement itself,
and an inner portal for the statement being executed on its behalf.
Before this commit, nothing checked that these two portals agreed on
the tuple descriptor of the rows being returned. This can be leveraged
to disclose server memory contents and achieve arbitrary code execution.
To prevent that, we can make use of an existing safety mechanism,
added by Tom Lane in commit 2f48ede080f42b97b594fb14102c82ca1001b80c,
which allows a tuplestore DestReceiver to be informed of the tupleDesc
required by the caller, and which will cause an ERROR to occur if
that doesn't match the tupleDesc of what emerges from the executor
(modulo dropped columns, which aren't an issue in the case at hand).
Reported-by: Ben Morris in collaboration with Claude and Anthropic Research
Reported-by: Peter Geoghegan <pg...@bowt.ie>
Reviewed-by: Michael Paquier <mi...@paquier.xyz>
Security: CVE-2026-16239
---
src/backend/tcop/pquery.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/src/backend/tcop/pquery.c b/src/backend/tcop/pquery.c
index e5512bb8271..a992505133b 100644
--- a/src/backend/tcop/pquery.c
+++ b/src/backend/tcop/pquery.c
@@ -1223,8 +1223,8 @@ FillPortalStore(Portal portal, bool isTopLevel)
portal->holdStore,
portal->holdContext,
false,
- NULL,
- NULL);
+ portal->tupDesc,
+ gettext_noop("query result type does not match portal result type"));
switch (portal->strategy)
{
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@cloudberry.apache.org
For additional commands, e-mail: commits-help@cloudberry.apache.org