Be more wary about constant's datatype in scalarineqsel().

The special case here for estimating conditions involving a ctid
column failed to check that the RHS constant is of type tid.
While that'd always be true for the built-in operators that
reference this selectivity estimator, a maliciously constructed
operator could provide a user-controlled Datum value that would
get interpreted as an ItemPointer pointer.  That at least risks
SIGSEGV, and perhaps with a bit of sweat it could be used for
server memory disclosure.

Reported-by: Hcamael <baiyjrh@gmail.com>
Author: Tom Lane <tgl@sss.pgh.pa.us>
Reviewed-by: Noah Misch <noah@leadboat.com>
Backpatch-through: 14
Security: CVE-2026-14668

diff --git a/src/backend/utils/adt/selfuncs.c b/src/backend/utils/adt/selfuncs.c
index 9a6effe206fbef360fb1e1d5e731a4c28d5ba221..3abc6c1ca7dbcb2fcdfade8b00864dbef2832840 100644 (file)
--- a/src/backend/utils/adt/selfuncs.c
+++ b/src/backend/utils/adt/selfuncs.c
@@ -604,7 +604,8 @@ scalarineqsel(PlannerInfo *root, Oid operator, bool isgt, bool iseq,
         * make an estimate based on comparing the constant to the table size.
         */
        if (vardata->var && IsA(vardata->var, Var) &&
-           ((Var *) vardata->var)->varattno == SelfItemPointerAttributeNumber)
+           ((Var *) vardata->var)->varattno == SelfItemPointerAttributeNumber &&
+           consttype == TIDOID)
        {
            ItemPointer itemptr;
            double      block;