This is an automated email from the ASF dual-hosted git repository. reshke pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/cloudberry.git
commit fb9ce0c6e36b21e6f37f3addc0f0d625cfc4e01f Author: Tom Lane <[email protected]> AuthorDate: Mon Aug 10 06:38:23 2026 -0700 Be more wary about constant's datatype in scalarineqsel(). The special case here for estimating conditions involving a ctid column failed to check that the RHS constant is of type tid. While that'd always be true for the built-in operators that reference this selectivity estimator, a maliciously constructed operator could provide a user-controlled Datum value that would get interpreted as an ItemPointer pointer. That at least risks SIGSEGV, and perhaps with a bit of sweat it could be used for server memory disclosure. Reported-by: Hcamael <[email protected]> Author: Tom Lane <[email protected]> Reviewed-by: Noah Misch <[email protected]> Backpatch-through: 14 Security: CVE-2026-14668 --- src/backend/utils/adt/selfuncs.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/backend/utils/adt/selfuncs.c b/src/backend/utils/adt/selfuncs.c index 7c6750fb8e6..98ddc9a7ade 100644 --- a/src/backend/utils/adt/selfuncs.c +++ b/src/backend/utils/adt/selfuncs.c @@ -608,7 +608,8 @@ scalarineqsel(PlannerInfo *root, Oid operator, bool isgt, bool iseq, * make an estimate based on comparing the constant to the table size. */ if (vardata->var && IsA(vardata->var, Var) && - ((Var *) vardata->var)->varattno == SelfItemPointerAttributeNumber) + ((Var *) vardata->var)->varattno == SelfItemPointerAttributeNumber && + consttype == TIDOID) { ItemPointer itemptr; double block; --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
