This is an automated email from the ASF dual-hosted git repository. reshke pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/cloudberry.git
commit 99de710c94d7edecd2236d3db487cab815227b8f Author: Tom Lane <[email protected]> AuthorDate: Mon Aug 10 06:38:23 2026 -0700 Harden PL/Perl code against "tied" Perl arrays and hashes. Tied arrays might report different sizes each time they are inspected. To avoid generating a corrupt result array, fix plperl_array_to_datum() to read av_len() of each input array only once. If the input does appear to get shorter, we'll fill nulls for the now-missing entries, which seems fine. Conversely, if it gets longer, we'll ignore the new entries. plperl_to_hstore() assumed that Perl's hv_iterinit() returns the number of entries in the given Perl hash. Usually that's true, but per the Perl docs, "the return value is currently only meaningful for hashes without tie magic". That could potentially end in a memory stomp. We don't depend on that result value anywhere else, so don't do so here either. Reported-by: Hcamael <[email protected]> Author: Tom Lane <[email protected]> Reviewed-by: Andrew Dunstan <[email protected]> Backpatch-through: 14 Security: CVE-2026-14670 --- contrib/hstore_plperl/hstore_plperl.c | 11 +++++++++-- src/pl/plperl/plperl.c | 6 +++++- 2 files changed, 14 insertions(+), 3 deletions(-) diff --git a/contrib/hstore_plperl/hstore_plperl.c b/contrib/hstore_plperl/hstore_plperl.c index 945b90eba64..047f25ee0c1 100644 --- a/contrib/hstore_plperl/hstore_plperl.c +++ b/contrib/hstore_plperl/hstore_plperl.c @@ -116,8 +116,9 @@ plperl_to_hstore(PG_FUNCTION_ARGS) errmsg("cannot transform non-hash Perl value to hstore"))); hv = (HV *) in; - pcount = hv_iterinit(hv); + (void) hv_iterinit(hv); + pcount = 64; /* arbitrary initial guess */ pairs = palloc_array(Pairs, pcount); i = 0; @@ -126,6 +127,12 @@ plperl_to_hstore(PG_FUNCTION_ARGS) char *key = sv2cstr(HeSVKEY_force(he)); SV *value = HeVAL(he); + if (i >= pcount) + { + pcount *= 2; + pairs = repalloc_array(pairs, Pairs, pcount); + } + pairs[i].key = pstrdup(key); pairs[i].keylen = hstoreCheckKeyLen(strlen(pairs[i].key)); pairs[i].needfree = true; @@ -146,7 +153,7 @@ plperl_to_hstore(PG_FUNCTION_ARGS) i++; } - pcount = hstoreUniquePairs(pairs, pcount, &buflen); + pcount = hstoreUniquePairs(pairs, i, &buflen); out = hstorePairs(pairs, pcount, buflen); PG_RETURN_POINTER(out); } diff --git a/src/pl/plperl/plperl.c b/src/pl/plperl/plperl.c index 7fb585b4bd1..493e3bf7702 100644 --- a/src/pl/plperl/plperl.c +++ b/src/pl/plperl/plperl.c @@ -1166,6 +1166,10 @@ get_perl_array_ref(SV *sv) * if we didn't do it like that, we'd need some other convention for knowing * whether we'd already found any scalars (and thus the number of dimensions * is frozen). + * + * Caller is required to have set dims[cur_depth - 1] to the length of the + * input array, i.e., av_len(av) + 1. We make this requirement so as to + * avoid reading av_len() twice, which is hazardous for tied arrays. */ static void array_to_datum_internal(AV *av, ArrayBuildState **astatep, @@ -1175,7 +1179,7 @@ array_to_datum_internal(AV *av, ArrayBuildState **astatep, { dTHX; int i; - int len = av_len(av) + 1; + int len = dims[cur_depth - 1]; for (i = 0; i < len; i++) { --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
