You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cloudberry.apache.org by re...@apache.org on 2026/08/14 16:53:20 UTC
(cloudberry) 11/25: Fix pg_trgm's picksplit function with all-true datums
This is an automated email from the ASF dual-hosted git repository.
reshke pushed a commit to branch backport_cve
in repository https://gitbox.apache.org/repos/asf/cloudberry.git
commit 3b340d7c841dd669829cf163fa81411cd39aee8a
Author: Heikki Linnakangas <he...@iki.fi>
AuthorDate: Mon Aug 10 06:38:24 2026 -0700
Fix pg_trgm's picksplit function with all-true datums
The CACHESIGN.sign field is a BITVECP, not a TRGM, so you should not
use GETSIGN() on it. You don't get a compiler warning because the
GETSIGN() macro includes a cast. It resulted in a bogus read beyond
end of buffer, which would cause bad split decisions or a crash if
you're very unlucky.
Reported-by: Mehmet D. INCE <me...@mehmetince.net>
Backpatch-through: 14
Security: CVE-2026-14678
---
contrib/pg_trgm/trgm_gist.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/contrib/pg_trgm/trgm_gist.c b/contrib/pg_trgm/trgm_gist.c
index 9ef2e38560a..4835a37adf8 100644
--- a/contrib/pg_trgm/trgm_gist.c
+++ b/contrib/pg_trgm/trgm_gist.c
@@ -897,7 +897,7 @@ gtrgm_picksplit(PG_FUNCTION_ARGS)
else
size_alpha = SIGLENBIT(siglen) -
sizebitvec((cache[j].allistrue) ? GETSIGN(datum_l) :
- GETSIGN(cache[j].sign),
+ cache[j].sign,
siglen);
}
else
@@ -910,7 +910,7 @@ gtrgm_picksplit(PG_FUNCTION_ARGS)
else
size_beta = SIGLENBIT(siglen) -
sizebitvec((cache[j].allistrue) ? GETSIGN(datum_r) :
- GETSIGN(cache[j].sign),
+ cache[j].sign,
siglen);
}
else
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@cloudberry.apache.org
For additional commands, e-mail: commits-help@cloudberry.apache.org