Fix pg_trgm's picksplit function with all-true datums The CACHESIGN.sign field is a BITVECP, not a TRGM, so you should not use GETSIGN() on it. You don't get a compiler warning because the GETSIGN() macro includes a cast. It resulted in a bogus read beyond end of buffer, which would cause bad split decisions or a crash if you're very unlucky.
Reported-by: Mehmet D. INCE <[email protected]> Backpatch-through: 14 Security: CVE-2026-14678 Branch ------ REL_16_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/24c88cd39d0174790b657bbaba88d557c09856b8 Author: Heikki Linnakangas <[email protected]> Modified Files -------------- contrib/pg_trgm/trgm_gist.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
