]> git.ipfire.org Git - thirdparty/postgresql.git/commitdiff
Harden _int_matchsel() against being attached to the wrong operator.
authorTom Lane <tgl@sss.pgh.pa.us>
Mon, 9 Feb 2026 15:14:22 +0000 (10:14 -0500)
committerTom Lane <tgl@sss.pgh.pa.us>
Mon, 9 Feb 2026 15:14:22 +0000 (10:14 -0500)
While the preceding commit prevented such attachments from occurring
in future, this one aims to prevent further abuse of any already-
created operator that exposes _int_matchsel to the wrong data types.
(No other contrib module has a vulnerable selectivity estimator.)

We need only check that the Const we've found in the query is indeed
of the type we expect (query_int), but there's a difficulty: as an
extension type, query_int doesn't have a fixed OID that we could
hard-code into the estimator.

Therefore, the bulk of this patch consists of infrastructure to let
an extension function securely look up the OID of a datatype
belonging to the same extension.  (Extension authors have requested
such functionality before, so we anticipate that this code will
have additional non-security uses, and may soon be extended to allow
looking up other kinds of SQL objects.)

This is done by first finding the extension that owns the calling
function (there can be only one), and then thumbing through the
objects owned by that extension to find a type that has the desired
name.  This is relatively expensive, especially for large extensions,
so a simple cache is put in front of these lookups.

Reported-by: Daniel Firer as part of zeroday.cloud
Author: Tom Lane <tgl@sss.pgh.pa.us>
Reviewed-by: Noah Misch <noah@leadboat.com>
Security: CVE-2026-2004
Backpatch-through: 14

contrib/intarray/_int_selfuncs.c
src/backend/catalog/pg_depend.c
src/backend/commands/extension.c
src/include/catalog/dependency.h
src/include/commands/extension.h
src/tools/pgindent/typedefs.list

index 4b40a5a23f359508bb62763589fe071def69be03..37b277e7f14a5bfa4f450b03e72dbc9a8805db64 100644 (file)
@@ -19,6 +19,7 @@
 #include "catalog/pg_operator.h"
 #include "catalog/pg_statistic.h"
 #include "catalog/pg_type.h"
+#include "commands/extension.h"
 #include "miscadmin.h"
 #include "utils/builtins.h"
 #include "utils/lsyscache.h"
@@ -171,7 +172,18 @@ _int_matchsel(PG_FUNCTION_ARGS)
                PG_RETURN_FLOAT8(0.0);
        }
 
-       /* The caller made sure the const is a query, so get it now */
+       /*
+        * Verify that the Const is a query_int, else return a default estimate.
+        * (This could only fail if someone attached this estimator to the wrong
+        * operator.)
+        */
+       if (((Const *) other)->consttype !=
+               get_function_sibling_type(fcinfo->flinfo->fn_oid, "query_int"))
+       {
+               ReleaseVariableStats(vardata);
+               PG_RETURN_FLOAT8(DEFAULT_EQ_SEL);
+       }
+
        query = DatumGetQueryTypeP(((Const *) other)->constvalue);
 
        /* Empty query matches nothing */
index 07791b47a611cbeffbf5f339d889269c7e977bf5..55a2da35e4967ce83b411be82c77f61f0dd61398 100644 (file)
 #include "catalog/pg_constraint.h"
 #include "catalog/pg_depend.h"
 #include "catalog/pg_extension.h"
+#include "catalog/pg_type.h"
 #include "commands/extension.h"
 #include "miscadmin.h"
 #include "utils/fmgroids.h"
 #include "utils/lsyscache.h"
 #include "utils/rel.h"
+#include "utils/syscache.h"
 
 
 static bool isObjectPinned(const ObjectAddress *object, Relation rel);
@@ -846,6 +848,77 @@ getAutoExtensionsOfObject(Oid classId, Oid objectId)
        return result;
 }
 
+/*
+ * Look up a type belonging to an extension.
+ *
+ * Returns the type's OID, or InvalidOid if not found.
+ *
+ * Notice that the type is specified by name only, without a schema.
+ * That's because this will typically be used by relocatable extensions
+ * which can't make a-priori assumptions about which schema their objects
+ * are in.  As long as the extension only defines one type of this name,
+ * the answer is unique anyway.
+ *
+ * We might later add the ability to look up functions, operators, etc.
+ */
+Oid
+getExtensionType(Oid extensionOid, const char *typname)
+{
+       Oid                     result = InvalidOid;
+       Relation        depRel;
+       ScanKeyData key[3];
+       SysScanDesc scan;
+       HeapTuple       tup;
+
+       depRel = table_open(DependRelationId, AccessShareLock);
+
+       ScanKeyInit(&key[0],
+                               Anum_pg_depend_refclassid,
+                               BTEqualStrategyNumber, F_OIDEQ,
+                               ObjectIdGetDatum(ExtensionRelationId));
+       ScanKeyInit(&key[1],
+                               Anum_pg_depend_refobjid,
+                               BTEqualStrategyNumber, F_OIDEQ,
+                               ObjectIdGetDatum(extensionOid));
+       ScanKeyInit(&key[2],
+                               Anum_pg_depend_refobjsubid,
+                               BTEqualStrategyNumber, F_INT4EQ,
+                               Int32GetDatum(0));
+
+       scan = systable_beginscan(depRel, DependReferenceIndexId, true,
+                                                         NULL, 3, key);
+
+       while (HeapTupleIsValid(tup = systable_getnext(scan)))
+       {
+               Form_pg_depend depform = (Form_pg_depend) GETSTRUCT(tup);
+
+               if (depform->classid == TypeRelationId &&
+                       depform->deptype == DEPENDENCY_EXTENSION)
+               {
+                       Oid                     typoid = depform->objid;
+                       HeapTuple       typtup;
+
+                       typtup = SearchSysCache1(TYPEOID, ObjectIdGetDatum(typoid));
+                       if (!HeapTupleIsValid(typtup))
+                               continue;               /* should we throw an error? */
+                       if (strcmp(NameStr(((Form_pg_type) GETSTRUCT(typtup))->typname),
+                                          typname) == 0)
+                       {
+                               result = typoid;
+                               ReleaseSysCache(typtup);
+                               break;                  /* no need to keep searching */
+                       }
+                       ReleaseSysCache(typtup);
+               }
+       }
+
+       systable_endscan(scan);
+
+       table_close(depRel, AccessShareLock);
+
+       return result;
+}
+
 /*
  * Detect whether a sequence is marked as "owned" by a column
  *
index a71504fbcae958de29e5f6ab5a8d976c164cc776..c04daa3450d5764321c53d2923548b8c01e18752 100644 (file)
@@ -45,6 +45,7 @@
 #include "catalog/pg_depend.h"
 #include "catalog/pg_extension.h"
 #include "catalog/pg_namespace.h"
+#include "catalog/pg_proc.h"
 #include "catalog/pg_type.h"
 #include "commands/alter.h"
 #include "commands/comment.h"
 #include "utils/acl.h"
 #include "utils/builtins.h"
 #include "utils/fmgroids.h"
+#include "utils/inval.h"
 #include "utils/lsyscache.h"
 #include "utils/memutils.h"
 #include "utils/rel.h"
 #include "utils/snapmgr.h"
+#include "utils/syscache.h"
 #include "utils/varlena.h"
 
 
@@ -104,7 +107,26 @@ typedef struct ExtensionVersionInfo
        struct ExtensionVersionInfo *previous;  /* current best predecessor */
 } ExtensionVersionInfo;
 
+/*
+ * Cache structure for get_function_sibling_type (and maybe later,
+ * allied lookup functions).
+ */
+typedef struct ExtensionSiblingCache
+{
+       struct ExtensionSiblingCache *next; /* list link */
+       /* lookup key: requesting function's OID and type name */
+       Oid                     reqfuncoid;
+       const char *typname;
+       bool            valid;                  /* is entry currently valid? */
+       uint32          exthash;                /* cache hash of owning extension's OID */
+       Oid                     typeoid;                /* OID associated with typname */
+} ExtensionSiblingCache;
+
+/* Head of linked list of ExtensionSiblingCache structs */
+static ExtensionSiblingCache *ext_sibling_list = NULL;
+
 /* Local functions */
+static void ext_sibling_callback(Datum arg, int cacheid, uint32 hashvalue);
 static List *find_update_path(List *evi_list,
                                                          ExtensionVersionInfo *evi_start,
                                                          ExtensionVersionInfo *evi_target,
@@ -254,6 +276,114 @@ get_extension_schema(Oid ext_oid)
        return result;
 }
 
+/*
+ * get_function_sibling_type - find a type belonging to same extension as func
+ *
+ * Returns the type's OID, or InvalidOid if not found.
+ *
+ * This is useful in extensions, which won't have fixed object OIDs.
+ * We work from the calling function's own OID, which it can get from its
+ * FunctionCallInfo parameter, and look up the owning extension and thence
+ * a type belonging to the same extension.
+ *
+ * Notice that the type is specified by name only, without a schema.
+ * That's because this will typically be used by relocatable extensions
+ * which can't make a-priori assumptions about which schema their objects
+ * are in.  As long as the extension only defines one type of this name,
+ * the answer is unique anyway.
+ *
+ * We might later add the ability to look up functions, operators, etc.
+ *
+ * This code is simply a frontend for some pg_depend lookups.  Those lookups
+ * are fairly expensive, so we provide a simple cache facility.  We assume
+ * that the passed typname is actually a C constant, or at least permanently
+ * allocated, so that we need not copy that string.
+ */
+Oid
+get_function_sibling_type(Oid funcoid, const char *typname)
+{
+       ExtensionSiblingCache *cache_entry;
+       Oid                     extoid;
+       Oid                     typeoid;
+
+       /*
+        * See if we have the answer cached.  Someday there may be enough callers
+        * to justify a hash table, but for now, a simple linked list is fine.
+        */
+       for (cache_entry = ext_sibling_list; cache_entry != NULL;
+                cache_entry = cache_entry->next)
+       {
+               if (funcoid == cache_entry->reqfuncoid &&
+                       strcmp(typname, cache_entry->typname) == 0)
+                       break;
+       }
+       if (cache_entry && cache_entry->valid)
+               return cache_entry->typeoid;
+
+       /*
+        * Nope, so do the expensive lookups.  We do not expect failures, so we do
+        * not cache negative results.
+        */
+       extoid = getExtensionOfObject(ProcedureRelationId, funcoid);
+       if (!OidIsValid(extoid))
+               return InvalidOid;
+       typeoid = getExtensionType(extoid, typname);
+       if (!OidIsValid(typeoid))
+               return InvalidOid;
+
+       /*
+        * Build, or revalidate, cache entry.
+        */
+       if (cache_entry == NULL)
+       {
+               /* Register invalidation hook if this is first entry */
+               if (ext_sibling_list == NULL)
+                       CacheRegisterSyscacheCallback(EXTENSIONOID,
+                                                                                 ext_sibling_callback,
+                                                                                 (Datum) 0);
+
+               /* Momentarily zero the space to ensure valid flag is false */
+               cache_entry = (ExtensionSiblingCache *)
+                       MemoryContextAllocZero(CacheMemoryContext,
+                                                                  sizeof(ExtensionSiblingCache));
+               cache_entry->next = ext_sibling_list;
+               ext_sibling_list = cache_entry;
+       }
+
+       cache_entry->reqfuncoid = funcoid;
+       cache_entry->typname = typname;
+       cache_entry->exthash = GetSysCacheHashValue1(EXTENSIONOID,
+                                                                                                ObjectIdGetDatum(extoid));
+       cache_entry->typeoid = typeoid;
+       /* Mark it valid only once it's fully populated */
+       cache_entry->valid = true;
+
+       return typeoid;
+}
+
+/*
+ * ext_sibling_callback
+ *             Syscache inval callback function for EXTENSIONOID cache
+ *
+ * It seems sufficient to invalidate ExtensionSiblingCache entries when
+ * the owning extension's pg_extension entry is modified or deleted.
+ * Neither a requesting function's OID, nor the OID of the object it's
+ * looking for, could change without an extension update or drop/recreate.
+ */
+static void
+ext_sibling_callback(Datum arg, int cacheid, uint32 hashvalue)
+{
+       ExtensionSiblingCache *cache_entry;
+
+       for (cache_entry = ext_sibling_list; cache_entry != NULL;
+                cache_entry = cache_entry->next)
+       {
+               if (hashvalue == 0 ||
+                       cache_entry->exthash == hashvalue)
+                       cache_entry->valid = false;
+       }
+}
+
 /*
  * Utility functions to check validity of extension and version names
  */
index 242026bda763e764be936b2a9f3755087d9b5342..1a9252cb13a618f1bdd894cae3bdb1199dfe641f 100644 (file)
@@ -226,6 +226,8 @@ extern long changeDependenciesOn(Oid refClassId, Oid oldRefObjectId,
 extern Oid     getExtensionOfObject(Oid classId, Oid objectId);
 extern List *getAutoExtensionsOfObject(Oid classId, Oid objectId);
 
+extern Oid     getExtensionType(Oid extensionOid, const char *typname);
+
 extern bool sequenceIsOwned(Oid seqId, char deptype, Oid *tableId, int32 *colId);
 extern List *getOwnedSequences(Oid relid);
 extern Oid     getIdentitySequence(Oid relid, AttrNumber attnum, bool missing_ok);
index 24dbf86e9702bd98770b04ea04d8bb05e3a4523a..aa8386b1f6feb676c85646392abf6e41c2235ebd 100644 (file)
@@ -49,6 +49,8 @@ extern Oid    get_extension_oid(const char *extname, bool missing_ok);
 extern char *get_extension_name(Oid ext_oid);
 extern bool extension_file_exists(const char *extensionName);
 
+extern Oid     get_function_sibling_type(Oid funcoid, const char *typname);
+
 extern ObjectAddress AlterExtensionNamespace(const char *extensionName, const char *newschema,
                                                                                         Oid *oldschema);
 
index 7eb23a0c5ea7c5652fb7c3fa4cad7f3b169059cb..863d1fa8c39683bd8e43d085a85f2e8b2a56bb82 100644 (file)
@@ -686,6 +686,7 @@ ExtensibleNodeMethods
 ExtensionControlFile
 ExtensionInfo
 ExtensionMemberId
+ExtensionSiblingCache
 ExtensionVersionInfo
 FDWCollateState
 FD_SET