This is an automated email from the ASF dual-hosted git repository. reshke pushed a commit to branch backport_cve in repository https://gitbox.apache.org/repos/asf/cloudberry.git
commit 3b340d7c841dd669829cf163fa81411cd39aee8a Author: Heikki Linnakangas <[email protected]> AuthorDate: Mon Aug 10 06:38:24 2026 -0700 Fix pg_trgm's picksplit function with all-true datums The CACHESIGN.sign field is a BITVECP, not a TRGM, so you should not use GETSIGN() on it. You don't get a compiler warning because the GETSIGN() macro includes a cast. It resulted in a bogus read beyond end of buffer, which would cause bad split decisions or a crash if you're very unlucky. Reported-by: Mehmet D. INCE <[email protected]> Backpatch-through: 14 Security: CVE-2026-14678 --- contrib/pg_trgm/trgm_gist.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/contrib/pg_trgm/trgm_gist.c b/contrib/pg_trgm/trgm_gist.c index 9ef2e38560a..4835a37adf8 100644 --- a/contrib/pg_trgm/trgm_gist.c +++ b/contrib/pg_trgm/trgm_gist.c @@ -897,7 +897,7 @@ gtrgm_picksplit(PG_FUNCTION_ARGS) else size_alpha = SIGLENBIT(siglen) - sizebitvec((cache[j].allistrue) ? GETSIGN(datum_l) : - GETSIGN(cache[j].sign), + cache[j].sign, siglen); } else @@ -910,7 +910,7 @@ gtrgm_picksplit(PG_FUNCTION_ARGS) else size_beta = SIGLENBIT(siglen) - sizebitvec((cache[j].allistrue) ? GETSIGN(datum_r) : - GETSIGN(cache[j].sign), + cache[j].sign, siglen); } else --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
