Cross-check the type of a portal running EXECUTE or FETCH. When an EXECUTE or FETCH statement is executed, there are two portals: an outer portal that is created for the EXECUTE or FETCH statement itself, and an inner portal for the statement being executed on its behalf. Before this commit, nothing checked that these two portals agreed on the tuple descriptor of the rows being returned. This can be leveraged to disclose server memory contents and achieve arbitrary code execution.
To prevent that, we can make use of an existing safety mechanism, added by Tom Lane in commit 2f48ede080f42b97b594fb14102c82ca1001b80c, which allows a tuplestore DestReceiver to be informed of the tupleDesc required by the caller, and which will cause an ERROR to occur if that doesn't match the tupleDesc of what emerges from the executor (modulo dropped columns, which aren't an issue in the case at hand). Reported-by: Ben Morris in collaboration with Claude and Anthropic Research Reported-by: Peter Geoghegan <[email protected]> Reviewed-by: Michael Paquier <[email protected]> Security: CVE-2026-16239 Branch ------ REL_18_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/37b8f3b0e05e85d4338f04c71caa156ba21d5015 Author: Robert Haas <[email protected]> Modified Files -------------- src/backend/tcop/pquery.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
