aboutsummaryrefslogtreecommitdiff
path: root/src/include
Commit message (Collapse)AuthorAge
* Stamp releases 8.2.3, 8.1.8, 8.0.12. No release notes yet.Bruce Momjian2007-02-07
|
* Stamp release 8.1.7.REL8_1_7Tom Lane2007-02-02
| | | | Security: CVE-2007-0555, CVE-2007-0556
* Repair failure to check that a table is still compatible with a previouslyTom Lane2007-02-02
| | | | | | | | | | | | | | | | | | | | | | made query plan. Use of ALTER COLUMN TYPE creates a hazard for cached query plans: they could contain Vars that claim a column has a different type than it now has. Fix this by checking during plan startup that Vars at relation scan level match the current relation tuple descriptor. Since at that point we already have at least AccessShareLock, we can be sure the column type will not change underneath us later in the query. However, since a backend's locks do not conflict against itself, there is still a hole for an attacker to exploit: he could try to execute ALTER COLUMN TYPE while a query is in progress in the current backend. Seal that hole by rejecting ALTER TABLE whenever the target relation is already open in the current backend. This is a significant security hole: not only can one trivially crash the backend, but with appropriate misuse of pass-by-reference datatypes it is possible to read out arbitrary locations in the server process's memory, which could allow retrieving database content the user should not be able to see. Our thanks to Jeff Trout for the initial report. Security: CVE-2007-0556
* Back-port changes of Jan 16 and 17 to "revoke" pending fsync requests duringTom Lane2007-01-27
| | | | | | | | | DROP TABLE and DROP DATABASE. Should prevent unexpected "permission denied" failures on Windows, and is cleaner on other platforms too since we no longer have to take it on faith that ENOENT is okay during an fsync attempt. Patched as far back as 8.1; per recent discussion I think we are not going to worry about Windows-specific issues in 8.0 anymore.
* Stamp release 8.1.6.Bruce Momjian2007-01-05
|
* Fix regex_fixed_prefix() to cope reasonably well with regex patterns of theTom Lane2007-01-03
| | | | | | | | | | form '^(foo)$'. Before, these could never be optimized into indexscans. The recent changes to make psql and pg_dump generate such patterns (for \d commands and -t and related switches, respectively) therefore represented a big performance hit for people with large pg_class catalogs, as seen in recent gripe from Erik Jones. While at it, be more paranoid about case-sensitivity checking in multibyte encodings, and fix some other corner cases in which a regex might be interpreted too liberally.
* Mark to_number() and the numeric-type variants of to_char() as stable, notTom Lane2006-11-28
| | | | | | immutable, because their results depend on lc_numeric; this is a longstanding oversight. We cannot force initdb for this in the back branches, but we can at least provide correct catalog entries for future installations.
* Back-patch HEAD's fixes to recognize __ppc64__ as equivalent to __powerpc64__.Tom Lane2006-11-28
| | | | | Per confirmation from Brian Wipf that this is correct and necessary for Darwin 64-bit.
* Repair two related errors in heap_lock_tuple: it was failing to recognizeTom Lane2006-11-17
| | | | | | | | | cases where we already hold the desired lock "indirectly", either via membership in a MultiXact or because the lock was originally taken by a different subtransaction of the current transaction. These cases must be accounted for to avoid needless deadlocks and/or inappropriate replacement of an exclusive lock with a shared lock. Per report from Clarence Gardner and subsequent investigation.
* Fix recently-identified PITR recovery hazard: the base backup could containTom Lane2006-11-05
| | | | | | | | | | | | | stale relcache init files (pg_internal.init), and there is no mechanism for updating them during WAL replay. Easiest solution is just to delete the init files at conclusion of startup, and let the first backend started in each database take care of rebuilding the init file. Simon Riggs and Tom Lane. Back-patched to 8.1. Arguably this should be fixed in 8.0 too, but it would require significantly more code since 8.0 has no handy startup-time scan of pg_database to piggyback on. Manual solution of the problem is possible in 8.0 (just delete the pg_internal.init files before starting WAL replay), so that may be a sufficient answer.
* Sync 8.1 pg_config.h.in with expected autoheader output (looks likeTom Lane2006-10-12
| | | | someone did this manually last time ...)
* Stamp releases 7.3.16, 7.4.14, 8.0.9, and 8.1.5.Bruce Momjian2006-10-09
|
* Fix SysCacheGetAttr() to handle the case where the specified syscache has notTom Lane2006-10-06
| | | | | | | | | | | been initialized yet. This can happen because there are code paths that call SysCacheGetAttr() on a tuple originally fetched from a different syscache (hopefully on the same catalog) than the one specified in the call. It doesn't seem useful or robust to try to prevent that from happening, so just improve the function to cope instead. Per bug#2678 from Jeff Trout. The specific example shown by Jeff is new in 8.1, but to be on the safe side I'm backpatching 8.0 as well. We could patch 7.x similarly but I think that's probably overkill, given the lack of evidence of old bugs of this ilk.
* Move Win32 inline define to win32.h so it is found, rather than c.h.Bruce Momjian2006-08-10
| | | | (cleaner)
* Move "#define inline __inline" from port/win32.h to c.h because Win32Bruce Momjian2006-08-10
| | | | | | interface builds like libpq need it. Backpatch addition to 8.1.X.
* Tweak dynahash.c to avoid wasting memory space in non-shared hash tables.Tom Lane2006-06-25
| | | | | | | | palloc() will normally round allocation requests up to the next power of 2, so make dynahash choose allocation sizes that are as close to a power of 2 as possible. Back-patch to 8.1 --- the problem exists further back, but a much larger patch would be needed and it doesn't seem worth taking any risks.
* Add "inline" compile fix for MSVC/BCC:Bruce Momjian2006-05-30
| | | | | | | | #define inline __inline Backpatch to 8.1.X. Hiroshi Saito
* Add a new GUC parameter backslash_quote, which determines whether the SQLTom Lane2006-05-21
| | | | | | | | | | | | | | | | | parser will allow "\'" to be used to represent a literal quote mark. The "\'" representation has been deprecated for some time in favor of the SQL-standard representation "''" (two single quote marks), but it has been used often enough that just disallowing it immediately won't do. Hence backslash_quote allows the settings "on", "off", and "safe_encoding", the last meaning to allow "\'" only if client_encoding is a valid server encoding. That is now the default, and the reason is that in encodings such as SJIS that allow 0x5c (ASCII backslash) to be the last byte of a multibyte character, accepting "\'" allows SQL-injection attacks as per CVE-2006-2314 (further details will be published after release). The "on" setting is available for backward compatibility, but it must not be used with clients that are exposed to untrusted input. Thanks to Akio Ishida and Yasuo Ohgaki for identifying this security issue.
* Change the backend to reject strings containing invalidly-encoded multibyteTom Lane2006-05-21
| | | | | | | | | | | | | | | | | | | | characters in all cases. Formerly we mostly just threw warnings for invalid input, and failed to detect it at all if no encoding conversion was required. The tighter check is needed to defend against SQL-injection attacks as per CVE-2006-2313 (further details will be published after release). Embedded zero (null) bytes will be rejected as well. The checks are applied during input to the backend (receipt from client or COPY IN), so it no longer seems necessary to check in textin() and related routines; any string arriving at those functions will already have been validated. Conversion failure reporting (for characters with no equivalent in the destination encoding) has been cleaned up and made consistent while at it. Also, fix a few longstanding errors in little-used encoding conversion routines: win1251_to_iso, win866_to_iso, euc_tw_to_big5, euc_tw_to_mic, mic_to_euc_tw were all broken to varying extents. Patches by Tatsuo Ishii and Tom Lane. Thanks to Akio Ishida and Yasuo Ohgaki for identifying the security issues.
* Stamp 8.1.4, except configure/configure.in.Bruce Momjian2006-05-19
|
* Revise large-object access routines to avoid running with CurrentMemoryContextTom Lane2006-04-26
| | | | | | | | | | | | | set to the large object context ("fscxt"), as this is inevitably a source of transaction-duration memory leaks. Not sure why we'd not noticed it before; maybe people weren't touching a whole lot of LOs in the same transaction before the 8.1 pg_dump changes. Per report from Wayne Conrad. Backpatched as far as 8.1, but the problem doubtless goes all the way back. I'm disinclined to spend the time to try to verify that the older branches would still work if patched, seeing that this code was significantly modified for 8.0 and again for 8.1, and that we don't have any trouble reports before 8.1. (Maybe the leaks were smaller before?)
* Fixes for BCC 5.5 compile of libpq. Backpatch to 8.1.X.Bruce Momjian2006-04-24
| | | | Mark Morgan Lloyd
* Check for "msys" so it doesn't use 'con' by checking for an evironmentBruce Momjian2006-03-05
| | | | variable.
* Use DEVTTY as 'con' on Win32 as a replacement for /dev/tty.Bruce Momjian2006-03-04
|
* Adjust probe for getaddrinfo to cope with macro-ized definitions, suchTom Lane2006-02-21
| | | | as Tru64's. Per previous discussion.
* Fix bug that allowed any logged-in user to SET ROLE to any other database userTom Lane2006-02-12
| | | | | | | | id (CVE-2006-0553). Also fix related bug in SET SESSION AUTHORIZATION that allows unprivileged users to crash the server, if it has been compiled with Asserts enabled. The escalation-of-privilege risk exists only in 8.1.0-8.1.2. However, the Assert-crash risk exists in all releases back to 7.3. Thanks to Akio Ishida for reporting this problem.
* Stamp 8.1.3, but exclude configure.in/configure change.Bruce Momjian2006-02-12
|
* Change search for default operator classes so that it examines all opclassesTom Lane2006-02-10
| | | | | | | | | | regardless of the current schema search path. Since CREATE OPERATOR CLASS only allows one default opclass per datatype regardless of schemas, this should have minimal impact, and it fixes problems with failure to find a desired opclass while restoring dump files. Per discussion at http://archives.postgresql.org/pgsql-hackers/2006-02/msg00284.php. Remove now-redundant-or-unused code in typcache.c and namespace.c, and backpatch as far as 8.0.
* Set progname early in the postmaster/postgres binary, rather than doingBruce Momjian2006-02-01
| | | | | | | | | | it later. This fixes a problem where EXEC_BACKEND didn't have progname set, causing a segfault if log_min_messages was set below debug2 and our own snprintf.c was being used. Also alway strdup() progname. Backpatch to 8.1.X and 8.0.X.
* Fix code that checks to see if an index can be considered to match the query'sTom Lane2006-01-29
| | | | | | | | | requested sort order. It was assuming that build_index_pathkeys always generates a pathkey per index column, which was not true if implied equality deduction had determined that two index columns were effectively equated to each other. Simplest fix seems to be to install an option that causes build_index_pathkeys to support this behavior as well as the original one. Per report from Brian Hirt.
* It turns out that TablespaceCreateDbspace fails badly if a relcache flushTom Lane2006-01-19
| | | | | | | | | | | | | | occurs when it tries to heap_open pg_tablespace. When control returns to smgrcreate, that routine will be holding a dangling pointer to a closed SMgrRelation, resulting in mayhem. This is of course a consequence of the violation of proper module layering inherent in having smgr.c call a tablespace command routine, but the simplest fix seems to be to change the locking mechanism. There's no real need for TablespaceCreateDbspace to touch pg_tablespace at all --- it's only opening it as a way of locking against a parallel DROP TABLESPACE command. A much better answer is to create a special-purpose LWLock to interlock these two operations. This drops TablespaceCreateDbspace quite a few layers down the food chain and makes it something reasonably safe for smgr to call.
* Modify pgstats code to reduce performance penalties from oversized stats dataTom Lane2006-01-18
| | | | | | | | | | | | | files: avoid creating stats hashtable entries for tables that aren't being touched except by vacuum/analyze, ensure that entries for dropped tables are removed promptly, and tweak the data layout to avoid storing useless struct padding. Also improve the performance of pgstat_vacuum_tabstat(), and make sure that autovacuum invokes it exactly once per autovac cycle rather than multiple times or not at all. This should cure recent complaints about 8.1 showing much higher stats I/O volume than was seen in 8.0. It'd still be a good idea to revisit the design with an eye to not re-writing the entire stats dataset every half second ... but that would be too much to backpatch, I fear.
* Fix fsync code to test whether F_FULLFSYNC is available, instead ofTom Lane2006-01-17
| | | | assuming it always is on Darwin. Per report from Neil Brandt.
* Repair "Halloween problem" in EvalPlanQual: a tuple that's been inserted byTom Lane2006-01-12
| | | | | | | | our own command (or more generally, xmin = our xact and cmin >= current command ID) should not be seen as good. Else we may try to update rows we already updated. This error was inserted last August while fixing the even bigger problem that the old coding wouldn't see *any* tuples inserted by our own transaction as good. Per report from Euler Taveira de Oliveira.
* Stamp release 8.1.2.Bruce Momjian2006-01-05
|
* Arrange to set the LC_XXX environment variables to match our locale setup.Tom Lane2006-01-05
| | | | Back-patch of previous fix in HEAD for plperl-vs-locale issue.
* Defend against crash while processing Describe Statement or Describe PortalTom Lane2005-12-14
| | | | | | messages, when client attempts to execute these outside a transaction (start one) or in a failed transaction (reject message, except for COMMIT/ROLLBACK statements which we can handle). Per report from Francisco Figueiredo Jr.
* I reconfirmed MS-VC6. Thank you for wonderful correspondence.Bruce Momjian2005-12-09
| | | | | | | | | However, Another problem newly occurred. This solves the problem of snprintf and vsnprintf. Patch to HEAD and 8.1.X. Hiroshi Saito
* Stamp 8.1.1.Bruce Momjian2005-12-08
|
* Disble some Win32-specific code in win32-client-only builds:Bruce Momjian2005-12-08
| | | | | | | | | | | | | | | | | | | | | | | | | | I have the problem, when building by MS-VC6. An error occurs in the 8.1.0 present source codes. nmake -f win32.mak ..\..\port\getaddrinfo.c(244) : error C2065: 'WSA_NOT_ENOUGH_MEMORY' ..\..\port\getaddrinfo.c(342) : error C2065: 'WSATYPE_NOT_FOUND' This is used by winsock2.h. However, Construction of a windows base is winsock.h. Then, Since MinGW has special environment, this is right. but, it is not found in VC6. Furthermore, in getaddrinfo.c, IPV6-API is used by LoadLibraryA("ws2_32"); Referring to of dll the external memory generates this violation by VC6 specification. I considered whether the whole should have been converted into winsock2. However, Now, DLL of MinGW creation operates wonderfully as it is. That's right, it has pliability by replacement of simple DLL. Then, I propose the system using winsock(non IPV6) in construction of VC6. Hiroshi Saito
* Add documentation on the use of *printf() macros and libintl.Bruce Momjian2005-12-06
| | | | Backpatch to 8.1.X.
* Put undef's before extern declarations that need 'em, per Andrew Dunstan.Tom Lane2005-12-06
|
* Make Win32 build use our port/snprintf.c routines, instead of dependingTom Lane2005-12-06
| | | | | on libintl which may or may not provide what we need. Make a few marginal cleanups to ensure this works. Andrew Dunstan and Tom Lane.
* Tweak hash join code to use an additional heuristic for deciding whetherTom Lane2005-11-28
| | | | | | | | it's worth probing the outer relation for emptiness before building the hash table. To wit, if we're rescanning a join previously performed, remember whether we found it nonempty the previous time, and don't bother with the probe if it was nonempty. This buys back the performance lost in examples like Mario Weilguni's.
* Get rid of ExecAssignResultTypeFromOuterPlan() and make all plan node typesTom Lane2005-11-23
| | | | | | | | | | | generate their output tuple descriptors from their target lists (ie, using ExecAssignResultTypeFromTL()). We long ago fixed things so that all node types have minimally valid tlists, so there's no longer any good reason to have two different ways of doing it. This change is needed to fix bug reported by Hayden James: the fix of 2005-11-03 to emit the correct column names after optimizing away a SubqueryScan node didn't work if the new top-level plan node used ExecAssignResultTypeFromOuterPlan to generate its tupdesc, since the next plan node down won't have the correct column labels.
* Re-run pgindent, fixing a problem where comment lines after a blankBruce Momjian2005-11-22
| | | | | | | | | comment line where output as too long, and update typedefs for /lib directory. Also fix case where identifiers were used as variable names in the backend, but as typedefs in ecpg (favor the backend for indenting). Backpatch to 8.1.X.
* Modify tuptoaster's API so that it does not try to modify the passedTom Lane2005-11-20
| | | | | | | | | tuple in-place, but instead passes back an all-new tuple structure if any changes are needed. This is a much cleaner and more robust solution for the bug discovered by Alexey Beschiokov; accordingly, revert the quick hack I installed yesterday. With this change, HeapTupleData.t_datamcxt is no longer needed; will remove it in a separate commit in HEAD only.
* DropRelFileNodeBuffers failed to fix the state of the lookup hash tableTom Lane2005-11-17
| | | | | | | | that was added to localbuf.c in 8.1; therefore, applying it to a temp table left corrupt lookup state in memory. The only case where this had a significant chance of causing problems was an ON COMMIT DELETE ROWS temp table; the other possible paths left bogus state that was unlikely to be used again. Per report from Csaba Nagy.
* Restore the former RestrictInfo field valid_everywhere (but invert the flagTom Lane2005-11-14
| | | | | | | | | | sense and rename to "outerjoin_delayed" to more clearly reflect what it means). I had decided that it was redundant in 8.1, but the folly of this is exposed by a bug report from Sebastian Böck. The place where it's needed is to prevent orindxpath.c from cherry-picking arms of an outer-join OR clause to form a relation restriction that isn't actually legal to push down to the relation scan level. There may be some legal cases that this forbids optimizing, but we'd need much closer analysis to determine it.
* Prevent ExecInsert() and ExecUpdate() from scribbling on the result tupleTom Lane2005-11-14
| | | | | | | slot of the topmost plan node when a trigger returns a modified tuple. These appear to be the only places where a plan node's caller did not treat the result slot as read-only, which is an assumption that nodeUnique makes as of 8.1. Fixes trigger-vs-DISTINCT bug reported by Frank van Vugt.
generated by cgit v1.2.3 (git 2.25.1) at 2025-06-03 10:05:31 +0000