hcq/postgresql
1
0
Fork 0
mirror of https://git.postgresql.org/git/postgresql.git synced 2026-02-22 06:17:00 +08:00
Code Issues Packages Projects Releases Wiki Activity

Harden _int_matchsel() against being attached to the wrong operator.

Browse Source 
While the preceding commit prevented such attachments from occurring
in future, this one aims to prevent further abuse of any already-
created operator that exposes _int_matchsel to the wrong data types.
(No other contrib module has a vulnerable selectivity estimator.)

We need only check that the Const we've found in the query is indeed
of the type we expect (query_int), but there's a difficulty: as an
extension type, query_int doesn't have a fixed OID that we could
hard-code into the estimator.

Therefore, the bulk of this patch consists of infrastructure to let
an extension function securely look up the OID of a datatype
belonging to the same extension.  (Extension authors have requested
such functionality before, so we anticipate that this code will
have additional non-security uses, and may soon be extended to allow
looking up other kinds of SQL objects.)

This is done by first finding the extension that owns the calling
function (there can be only one), and then thumbing through the
objects owned by that extension to find a type that has the desired
name.  This is relatively expensive, especially for large extensions,
so a simple cache is put in front of these lookups.

Reported-by: Daniel Firer as part of zeroday.cloud
Author: Tom Lane <tgl@sss.pgh.pa.us>
Reviewed-by: Noah Misch <noah@leadboat.com>
Security: CVE-2026-2004
Backpatch-through: 14
This commit is contained in:
Tom Lane
2026-02-09 10:14:22 -05:00
parent 841d42cc4e
commit 8ebdf41c26
6 changed files with 220 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
contrib/intarray/_int_selfuncs.c
View File

@ -19,6 +19,7 @@
#include "catalog/pg_operator.h"
#include "catalog/pg_statistic.h"
#include "catalog/pg_type.h"
#include "commands/extension.h"
#include "miscadmin.h"
#include "utils/fmgrprotos.h"
#include "utils/lsyscache.h"
@ -170,7 +171,18 @@ _int_matchsel(PG_FUNCTION_ARGS)
PG_RETURN_FLOAT8(0.0);
}
/* The caller made sure the const is a query, so get it now */
/*
* Verify that the Const is a query_int, else return a default estimate.
* (This could only fail if someone attached this estimator to the wrong
* operator.)
*/
if (((Const *) other)->consttype !=
get_function_sibling_type(fcinfo->flinfo->fn_oid, "query_int"))
{
ReleaseVariableStats(vardata);
PG_RETURN_FLOAT8(DEFAULT_EQ_SEL);
}
query = DatumGetQueryTypeP(((Const *) other)->constvalue);
/* Empty query matches nothing */