Use palloc_array() in a few more places to avoid overflow

hlinnaka · Rucha Kulkarni · commit 17e033cb6b8f · 2026-05-30T06:17:00.000Z
These could overflow on 32-bit systems. Backpatch-through: 14 Security: CVE-2026-6473 (cherry picked from commit e42598a41e76ff12293e3aaeeeb5c5696a93f642)
diff --git a/contrib/hstore_plperl/hstore_plperl.c b/contrib/hstore_plperl/hstore_plperl.c
@@ -118,7 +118,7 @@ plperl_to_hstore(PG_FUNCTION_ARGS)
 
 	pcount = hv_iterinit(hv);
 
-	pairs = palloc(pcount * sizeof(Pairs));
+	pairs = palloc_array(Pairs, pcount);
 
 	i = 0;
 	while ((he = hv_iternext(hv)))
diff --git a/contrib/hstore_plpython/hstore_plpython.c b/contrib/hstore_plpython/hstore_plpython.c
@@ -147,7 +147,7 @@ plpython_to_hstore(PG_FUNCTION_ARGS)
 		Py_ssize_t	i;
 		Pairs	   *pairs;
 
-		pairs = palloc(pcount * sizeof(*pairs));
+		pairs = palloc_array(Pairs, pcount);
 
 		for (i = 0; i < pcount; i++)
 		{

Original file line number	Diff line number	Diff line change
`@@ -147,7 +147,7 @@ plpython_to_hstore(PG_FUNCTION_ARGS)`
`147`	`147`	`Py_ssize_t i;`
`148`	`148`	`Pairs *pairs;`
`149`	`149`
`150`		`- pairs = palloc(pcount * sizeof(*pairs));`
	`150`	`+ pairs = palloc_array(Pairs, pcount);`
`151`	`151`
`152`	`152`	`for (i = 0; i < pcount; i++)`
`153`	`153`	`{`