Use palloc_array() in a few more places to avoid overflow

These could overflow on 32-bit systems.

Backpatch-through: 14
Security: CVE-2026-6473

diff --git a/contrib/hstore_plperl/hstore_plperl.c b/contrib/hstore_plperl/hstore_plperl.c
index 417b721cff9ae63545b43595d7966e835d96ca0e..f4c742edfa96cbd7526e2a79361ce80936d000f8 100644 (file)
--- a/contrib/hstore_plperl/hstore_plperl.c
+++ b/contrib/hstore_plperl/hstore_plperl.c
@@ -121,7 +121,7 @@ plperl_to_hstore(PG_FUNCTION_ARGS)
 
        pcount = hv_iterinit(hv);
 
-       pairs = palloc(pcount * sizeof(Pairs));
+       pairs = palloc_array(Pairs, pcount);
 
        i = 0;
        while ((he = hv_iternext(hv)))

diff --git a/contrib/hstore_plpython/hstore_plpython.c b/contrib/hstore_plpython/hstore_plpython.c
index 4b3ef025f2eb90007535ecadc855da40541dad01..de89511994c831fa924451c2533be875bfa341ea 100644 (file)
--- a/contrib/hstore_plpython/hstore_plpython.c
+++ b/contrib/hstore_plpython/hstore_plpython.c
@@ -149,7 +149,7 @@ plpython_to_hstore(PG_FUNCTION_ARGS)
                Py_ssize_t      i;
                Pairs      *pairs;
 
-               pairs = palloc(pcount * sizeof(*pairs));
+               pairs = palloc_array(Pairs, pcount);
 
                for (i = 0; i < pcount; i++)
                {