aboutsummaryrefslogtreecommitdiff
path: root/src
Commit message (Collapse)AuthorAge
* Tag 8.1.22REL8_1_22Marc G. Fournier2010-10-01
|
* Use a separate interpreter for each calling SQL userid in plperl and pltcl.Tom Lane2010-09-30
| | | | | | | | | | | | | | | | | | | | | | | | | There are numerous methods by which a Perl or Tcl function can subvert the behavior of another such function executed later; for example, by redefining standard functions or operators called by the target function. If the target function is SECURITY DEFINER, or is called by such a function, this means that any ordinary SQL user with Perl or Tcl language usage rights can do essentially anything with the privileges of the target function's owner. To close this security hole, create a separate Perl or Tcl interpreter for each SQL userid under which plperl or pltcl functions are executed within a session. However, all plperlu or pltclu functions run within a session still share a single interpreter, since they all execute at the trust level of a database superuser anyway. Note: this change results in a functionality loss when libperl has been built without the "multiplicity" option: it's no longer possible to call plperl functions under different userids in one session, since such a libperl can't support multiple interpreters in one process. However, such a libperl already failed to support concurrent use of plperl and plperlu, so it's likely that few people use such versions with Postgres. Security: CVE-2010-3433
* Translation updates for 8.1.22Peter Eisentraut2010-09-30
|
* Further fixes to the pg_get_expr() security fix in back branches.Tom Lane2010-09-25
| | | | | | | It now emerges that the JDBC driver expects to be able to use pg_get_expr() on an output of a sub-SELECT. So extend the check logic to be able to recurse into a sub-SELECT to see if the argument is ultimately coming from an appropriate column. Per report from Thomas Kellerer.
* Still more .gitignore cleanup.Tom Lane2010-09-24
| | | | | Fix overly-enthusiastic ignores, as identified by git ls-files -i --exclude-standard
* Prevent show_session_authorization from crashing when session_authorizationTom Lane2010-09-23
| | | | | | | | | | | | | | | hasn't been set. The only known case where this can happen is when show_session_authorization is invoked in an autovacuum process, which is possible if an index function calls it, as for example in bug #5669 from Andrew Geery. We could perhaps try to return a sensible value, such as the name of the cluster-owning superuser; but that seems like much more trouble than the case is worth, and in any case it could create new possible failure modes. Simply returning an empty string seems like the most appropriate fix. Back-patch to all supported versions, even those before autovacuum, just in case there's another way to provoke this crash.
* More fixes for libpq's .gitignore file.Tom Lane2010-09-22
| | | | | | The previous patches failed to cover a lot of symlinks that are only added in platform-specific cases. Make the lists match what's in the Makefile for each branch.
* Some more gitignore cleanups: cover contrib and PL regression test outputs.Tom Lane2010-09-22
| | | | | Also do some further work in the back branches, where quite a bit wasn't covered by Magnus' original back-patch.
* Convert cvsignore to gitignore, and add .gitignore for build targets.Magnus Hagander2010-09-22
|
* Update time zone data files to tzdata release 2010l: DST law changes inTom Lane2010-08-26
| | | | | | | Egypt and Palestine. Added new names for two Micronesian timezones: Pacific/Chuuk is now preferred over Pacific/Truk (and the preferred abbreviation is CHUT not TRUT) and Pacific/Pohnpei is preferred over Pacific/Ponape. Historical corrections for Finland.
* Fix ExecMakeTableFunctionResult to verify that all rows returned by a SRFTom Lane2010-08-26
| | | | | | | | | | | returning "record" actually do have the same rowtype. This is needed because the parser can't realistically enforce that they will all have the same typmod, as seen in a recent example from David Wheeler. Back-patch to 8.0, which is as far back as we have the notion of RECORD subtypes being distinguished by typmod. Wheeler's example depends on 8.4-and-up features, but I suspect there may be ways to provoke similar failures before 8.4.
* Catch null pointer returns from PyCObject_AsVoidPtr and PyCObject_FromVoidPtrPeter Eisentraut2010-08-25
| | | | | | | | This is reproducibly possible in Python 2.7 if the user turned PendingDeprecationWarning into an error, but it's theoretically also possible in earlier versions in case of exceptional conditions. backpatched to 8.0
* Arrange to fsync the contents of lockfiles (both postmaster.pid and theTom Lane2010-08-16
| | | | | | | | | | socket lockfile) when writing them. The lack of an fsync here may well explain two different reports we've seen of corrupted lockfile contents, which doesn't particularly bother the running server but can prevent a new server from starting if the old one crashes. Per suggestion from Alvaro. Back-patch to all supported versions.
* Fix psql's copy of utf2ucs() to match the backend's copy exactly;Tom Lane2010-08-16
| | | | | | | | | | in particular, propagate a fix in the test to see whether a UTF8 character has length 4 bytes. This is likely of little real-world consequence because 5-or-more-byte UTF8 sequences are not supported by Postgres nor seen anywhere in the wild, but still we may as well get it right. Problem found by Joseph Adams. Bug is aboriginal, so back-patch all the way.
* Fix incorrect logic in plpgsql for cleanup after evaluation of non-simpleTom Lane2010-08-09
| | | | | | | | | | | | | expressions. We need to deal with this when handling subscripts in an array assignment, and also when catching an exception. In an Assert-enabled build these omissions led to Assert failures, but I think in a normal build the only consequence would be short-term memory leakage; which may explain why this wasn't reported from the field long ago. Back-patch to all supported versions. 7.4 doesn't have exceptions, but otherwise these bugs go all the way back. Heikki Linnakangas and Tom Lane
* Improved version of patch to protect pg_get_expr() against misuse:Tom Lane2010-07-30
| | | | | | | | | | look through join alias Vars to avoid breaking join queries, and move the test to someplace where it will catch more possible ways of calling a function. We still ought to throw away the whole thing in favor of a data-type-based solution, but that's not feasible in the back branches. Completion of back-port of my patch of yesterday.
* Fix another longstanding problem in copy_relation_data: it was blithelyTom Lane2010-07-29
| | | | | | | | | | | assuming that a local char[] array would be aligned on at least a word boundary. There are architectures on which that is pretty much guaranteed to NOT be the case ... and those arches also don't like non-aligned memory accesses, meaning that log_newpage() would crash if it ever got invoked. Even on Intel-ish machines there's a potential for a large performance penalty from doing I/O to an inadequately aligned buffer. So palloc it instead. Backpatch to 8.0 --- 7.4 doesn't have this code.
* Fix possible page corruption by ALTER TABLE .. SET TABLESPACE.Robert Haas2010-07-29
| | | | | | | | | | | | | | If a zeroed page is present in the heap, ALTER TABLE .. SET TABLESPACE will set the LSN and TLI while copying it, which is wrong, and heap_xlog_newpage() will do the same thing during replay, so the corruption propagates to any standby. Note, however, that the bug can't be demonstrated unless archiving is enabled, since in that case we skip WAL logging altogether, and the LSN/TLI are not set. Back-patch to 8.0; prior releases do not have tablespaces. Analysis and patch by Jeff Davis. Adjustments for back-branches and minor wordsmithing by me.
* Fix potential failure when hashing the output of a subplan that producesTom Lane2010-07-28
| | | | | | | | | | | | | | | a pass-by-reference datatype with a nontrivial projection step. We were using the same memory context for the projection operation as for the temporary context used by the hashtable routines in execGrouping.c. However, the hashtable routines feel free to reset their temp context at any time, which'd lead to destroying input data that was still needed. Report and diagnosis by Tao Ma. Back-patch to 8.1, where the problem was introduced by the changes that allowed us to work with "virtual" tuples instead of materializing intermediate tuple values everywhere. The earlier code looks quite similar, but it doesn't suffer the problem because the data gets copied into another context as a result of having to materialize ExecProject's output tuple.
* Avoid deep recursion when assigning XIDs to multiple levels of subxacts.Robert Haas2010-07-23
| | | | | | Backpatch to 8.0. Andres Freund, with cleanup and adjustment for older branches by me.
* Oops, in the previous fix to prevent a cursor that's being used in a FORHeikki Linnakangas2010-07-13
| | | | | | | | | loop from being dropped, I missed subtransaction cleanup. Pinned portals must be dropped at subtransaction cleanup just as they are at main transaction cleanup. Per bug #5556 by Robert Walker. Backpatch to 8.0, 7.4 didn't have subtransactions.
* Avoid an Assert failure in deconstruct_array() by making get_attstatsslot()Tom Lane2010-07-09
| | | | | | | | | | | | | | | | use the actual element type of the array it's disassembling, rather than trusting the type OID passed in by its caller. This is needed because sometimes the planner passes in a type OID that's only binary-compatible with the target column's type, rather than being an exact match. Per an example from Bernd Helmle. Possibly we should refactor get_attstatsslot/free_attstatsslot to not expect the caller to supply type ID data at all, but for now I'll just do the minimum-change fix. Back-patch to 7.4. Bernd's test case only crashes back to 8.0, but since these subroutines are the same in 7.4, I suspect there may be variant cases that would crash 7.4 as well.
* Fix "cannot handle unplanned sub-select" error that can occur when aTom Lane2010-07-08
| | | | | | | | | sub-select contains a join alias reference that expands into an expression containing another sub-select. Per yesterday's report from Merlin Moncure and subsequent off-list investigation. Back-patch to 7.4. Older versions didn't attempt to flatten sub-selects in ways that would trigger this problem.
* The previous fix in CVS HEAD and 8.4 for handling the case where a cursorHeikki Linnakangas2010-07-05
| | | | | | | | | | | being used in a PL/pgSQL FOR loop is closed was inadequate, as Tom Lane pointed out. The bug affects FOR statement variants too, because you can close an implicitly created cursor too by guessing the "<unnamed portal X>" name created for it. To fix that, "pin" the portal to prevent it from being dropped while it's being used in a PL/pgSQL FOR loop. Backpatch all the way to 7.4 which is the oldest supported version.
* Allow ALTER TABLE .. SET TABLESPACE to be interrupted.Robert Haas2010-07-01
| | | | | | Backpatch to 8.0, where tablespaces were introduced. Guillaume Lelarge
* stringToNode() and deparse_expression_pretty() crash on invalid input,Heikki Linnakangas2010-06-30
| | | | | | | | | | but we have nevertheless exposed them to users via pg_get_expr(). It would be too much maintenance effort to rigorously check the input, so put a hack in place instead to restrict pg_get_expr() so that the argument must come from one of the system catalog columns known to contain valid expressions. Per report from Rushabh Lathia. Backpatch to 7.4 which is the oldest supported version at the moment.
* Change ps_status.c to explicitly track the current logical length of ps_buffer.Tom Lane2010-05-27
| | | | | | | | | | | This saves cycles in get_ps_display() on many popular platforms, and more importantly ensures that get_ps_display() will correctly return an empty string if init_ps_display() hasn't been called yet. Per trouble report from Ray Stell, in which log_line_prefix %i produced junk early in backend startup. Back-patch to 8.0. 7.4 doesn't have %i and its version of get_ps_display() makes no pretense of avoiding pad junk anyhow.
* > Follow up a visit from the style police.Andrew Dunstan2010-05-17
|
* tag 8.1.21REL8_1_21Marc G. Fournier2010-05-14
|
* Prevent PL/Tcl from loading the "unknown" module from pltcl_modules unlessTom Lane2010-05-13
| | | | | | | | | | | | | | | | | | | that is a regular table or view owned by a superuser. This prevents a trojan horse attack whereby any unprivileged SQL user could create such a table and insert code into it that would then get executed in other users' sessions whenever they call pltcl functions. Worse yet, because the code was automatically loaded into both the "normal" and "safe" interpreters at first use, the attacker could execute unrestricted Tcl code in the "normal" interpreter without there being any pltclu functions anywhere, or indeed anyone else using pltcl at all: installing pltcl is sufficient to open the hole. Change the initialization logic so that the "unknown" code is only loaded into an interpreter when the interpreter is first really used. (That doesn't add any additional security in this particular context, but it seems a prudent change, and anyway the former behavior violated the principle of least astonishment.) Security: CVE-2010-1170
* Abandon the use of Perl's Safe.pm to enforce restrictions in plperl, as it isAndrew Dunstan2010-05-13
| | | | | | | | | | | | | | | | | | | | | | | | fundamentally insecure. Instead apply an opmask to the whole interpreter that imposes restrictions on unsafe operations. These restrictions are much harder to subvert than is Safe.pm, since there is no container to be broken out of. Backported to release 7.4. In releases 7.4, 8.0 and 8.1 this also includes the necessary backporting of the two interpreters model for plperl and plperlu adopted in release 8.2. In versions 8.0 and up, the use of Perl's POSIX module to undo its locale mangling on Windows has become insecure with these changes, so it is replaced by our own routine, which is also faster. Nice side effects of the changes include that it is now possible to use perl's "strict" pragma in a natural way in plperl, and that perl's $a and $b variables now work as expected in sort routines, and that function compilation is significantly faster. Tim Bunce and Andrew Dunstan, with reviews from Alex Hunsaker and Alexey Klyukin. Security: CVE-2010-1169
* Translation updatePeter Eisentraut2010-05-13
|
* Update time zone data files to tzdata release 2010j: DST law changes inTom Lane2010-05-11
| | | | | Argentina, Australian Antarctic, Bangladesh, Mexico, Morocco, Pakistan, Palestine, Russia, Syria, Tunisia. Historical corrections for Taiwan.
* Work around a subtle portability problem in use of printf %s format.Tom Lane2010-05-08
| | | | | | | | | | | | | Depending on which spec you read, field widths and precisions in %s may be counted either in bytes or characters. Our code was assuming bytes, which is wrong at least for glibc's implementation, and in any case libc might have a different idea of the prevailing encoding than we do. Hence, for portable results we must avoid using anything more complex than just "%s" unless the string to be printed is known to be all-ASCII. This patch fixes the cases I could find, including the psql formatting failure reported by Hernan Gonzalez. In HEAD only, I also added comments to some places where it appears safe to continue using "%.*s".
* Fix psql to not go into infinite recursion when expanding a variable thatTom Lane2010-05-05
| | | | | | | | | | refers to itself (directly or indirectly). Instead, print a message when recursion is detected, and don't expand the repeated reference. Per bug #5448 from Francis Markham. Back-patch to 8.0. Although the issue exists in 7.4 as well, it seems impractical to fix there because of the lack of any state stack that could be used to track active expansions.
* Fix backpatching error in recent patch for ALTER USER f RESET ALL behavior.Tom Lane2010-05-05
| | | | | | | The argument list for array_set() changed in 8.2 (in connection with allowing nulls in arrays) but the newer argument list was used in the patches applied to 8.1 and 8.0 branches. The patch for 7.4 was OK though. Per compiler warnings.
* Add code to InternalIpcMemoryCreate() to handle the case where shmget()Tom Lane2010-05-01
| | | | | | | | | | | | | | | | returns EINVAL for an existing shared memory segment. Although it's not terribly sensible, that behavior does meet the POSIX spec because EINVAL is the appropriate error code when the existing segment is smaller than the requested size, and the spec explicitly disclaims any particular ordering of error checks. Moreover, it does in fact happen on OS X and probably other BSD-derived kernels. (We were able to talk NetBSD into changing their code, but purging that behavior from the wild completely seems unlikely to happen.) We need to distinguish collision with a pre-existing segment from invalid size request in order to behave sensibly, so it's worth some extra code here to get it right. Per report from Gavin Kistner and subsequent investigation. Back-patch to all supported versions, since any of them could get used with a kernel having the debatable behavior.
* Fix multiple memory leaks in PLy_spi_execute_fetch_result: it would leakTom Lane2010-04-30
| | | | | | | | | | memory if the result had zero rows, and also if there was any sort of error while converting the result tuples into Python data. Reported and partially fixed by Andres Freund. Back-patch to all supported versions. Note: I haven't tested the 7.4 fix. 7.4's configure check for python is so obsolete it doesn't work on my current machines :-(. The logic change is pretty straightforward though.
* Sync perl's ppport.h on all branches back to 7.4 with recent update on HEAD, ↵Andrew Dunstan2010-04-03
| | | | ensuring we can build older branches with modern Perl installations.
* Prevent ALTER USER f RESET ALL from removing the settings that were put thereAlvaro Herrera2010-03-25
| | | | | | | | by a superuser -- "ALTER USER f RESET setting" already disallows removing such a setting. Apply the same treatment to ALTER DATABASE d RESET ALL when run by a database owner that's not superuser.
* Clear error_context_stack and debug_query_string at the beginning of proc_exit,Tom Lane2010-03-20
| | | | | | | | | | | | | so that we won't try to attach any context printouts to messages that get emitted while exiting. Per report from Dennis Koegel, the context functions won't necessarily work after we've started shutting down the backend, and it seems possible that debug_query_string could be pointing at freed storage as well. The context information doesn't seem particularly relevant to such messages anyway, so there's little lost by suppressing it. Back-patch to all supported branches. I can only demonstrate a crash with log_disconnections messages back to 8.1, but the risk seems real in 8.0 and before anyway.
* tag 8.1.20REL8_1_20Marc G. Fournier2010-03-12
|
* Use SvROK(sv) rather than directly checking SvTYPE(sv) == SVt_RV in plperl.Tom Lane2010-03-09
| | | | | | | | The latter is considered unwarranted chumminess with the implementation, and can lead to crashes with recent Perl versions. Report and fix by Tim Bunce. Back-patch to all versions containing the questionable coding pattern.
* Update time zone data files to tzdata release 2010d: DST law changes in Fiji,Alvaro Herrera2010-03-09
| | | | Samoa, Chile; corrections to recent changes in Paraguay and Bangladesh.
* Update time zone data files to tzdata release 2010c: DST law changes inTom Lane2010-03-08
| | | | Bangladesh, Mexico, Paraguay.
* When reading pg_hba.conf and similar files, do not treat @file as an inclusionTom Lane2010-03-06
| | | | | | | | | | | | | | | | | | | | | | | unless (1) the @ isn't quoted and (2) the filename isn't empty. This guards against unexpectedly treating usernames or other strings in "flat files" as inclusion requests, as seen in a recent trouble report from Ed L. The empty-filename case would be guaranteed to misbehave anyway, because our subsequent path-munging behavior results in trying to read the directory containing the current input file. I think this might finally explain the report at http://archives.postgresql.org/pgsql-bugs/2004-05/msg00132.php of a crash after printing "authentication file token too long, skipping", since I was able to duplicate that message (though not a crash) on a platform where stdio doesn't refuse to read directories. We never got far in investigating that problem, but now I'm suspicious that the trigger condition was an @ in the flat password file. Back-patch to all active branches since the problem can be demonstrated in all branches except HEAD. The test case, creating a user named "@", doesn't cause a problem in HEAD since we got rid of the flat password file. Nonetheless it seems like a good idea to not consider quoted @ as a file inclusion spec, so I changed HEAD too.
* Fix a couple of places that would loop forever if attempts to read a stdio fileTom Lane2010-03-03
| | | | | | | set ferror() but never set feof(). This is known to be the case for recent glibc when trying to read a directory as a file, and might be true for other platforms/cases too. Per report from Ed L. (There is more that we ought to do about his report, but this is one easily identifiable issue.)
* Fix numericlocale psql option when used with a null string and latex and troffHeikki Linnakangas2010-03-01
| | | | | | | | | | formats; a null string must not be formatted as a numeric. The more exotic formats latex and troff also incorrectly formatted all strings as numerics when numericlocale was on. Backpatch to 8.1 where numericlocale option was added. This fixes bug #5355 reported by Andy Lester.
* Back-patch addition of ssl_renegotiation_limit into 7.4 through 8.1.Tom Lane2010-02-25
|
* Fix STOP WAL LOCATION in backup history files no to return the nextItagaki Takahiro2010-02-19
| | | | | | | | | | | segment of XLOG_BACKUP_END record even if the the record is placed at a segment boundary. Furthermore the previous implementation could return nonexistent segment file name when the boundary is in segments that has "FE" suffix; We never use segments with "FF" suffix. Backpatch to 8.0, where hot backup was introduced. Reported by Fujii Masao.
generated by cgit v1.2.3 (git 2.25.1) at 2025-05-24 22:05:17 +0000