diff options
| author | Tom Lane <tgl@sss.pgh.pa.us> | 2007-02-02 00:07:28 +0000 |
|---|---|---|
| committer | Tom Lane <tgl@sss.pgh.pa.us> | 2007-02-02 00:07:28 +0000 |
| commit | 23326cd18bbb9f9a237f65a4d54c66869c99aef2 (patch) | |
| tree | a53c88f1e98c38505f977080851f001aba2a888c /src/backend/executor/nodeAgg.c | |
| parent | 78e039cc2c6f474a8cf16840a9b316447f6ebb7a (diff) | |
| download | postgresql-23326cd18bbb9f9a237f65a4d54c66869c99aef2.tar.gz postgresql-23326cd18bbb9f9a237f65a4d54c66869c99aef2.zip | |
Repair failure to check that a table is still compatible with a previously
made query plan. Use of ALTER COLUMN TYPE creates a hazard for cached
query plans: they could contain Vars that claim a column has a different
type than it now has. Fix this by checking during plan startup that Vars
at relation scan level match the current relation tuple descriptor. Since
at that point we already have at least AccessShareLock, we can be sure the
column type will not change underneath us later in the query. However,
since a backend's locks do not conflict against itself, there is still a
hole for an attacker to exploit: he could try to execute ALTER COLUMN TYPE
while a query is in progress in the current backend. Seal that hole by
rejecting ALTER TABLE whenever the target relation is already open in
the current backend.
This is a significant security hole: not only can one trivially crash the
backend, but with appropriate misuse of pass-by-reference datatypes it is
possible to read out arbitrary locations in the server process's memory,
which could allow retrieving database content the user should not be able
to see. Our thanks to Jeff Trout for the initial report.
Security: CVE-2007-0556
Diffstat (limited to 'src/backend/executor/nodeAgg.c')
| -rw-r--r-- | src/backend/executor/nodeAgg.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/src/backend/executor/nodeAgg.c b/src/backend/executor/nodeAgg.c index 44609bb40b7..2c276b33c96 100644 --- a/src/backend/executor/nodeAgg.c +++ b/src/backend/executor/nodeAgg.c @@ -61,7 +61,7 @@ * Portions Copyright (c) 1994, Regents of the University of California * * IDENTIFICATION - * $PostgreSQL: pgsql/src/backend/executor/nodeAgg.c,v 1.146 2006/10/04 00:29:52 momjian Exp $ + * $PostgreSQL: pgsql/src/backend/executor/nodeAgg.c,v 1.146.2.1 2007/02/02 00:07:28 tgl Exp $ * *------------------------------------------------------------------------- */ @@ -1243,7 +1243,7 @@ ExecInitAgg(Agg *node, EState *estate, int eflags) * Initialize result tuple type and projection info. */ ExecAssignResultTypeFromTL(&aggstate->ss.ps); - ExecAssignProjectionInfo(&aggstate->ss.ps); + ExecAssignProjectionInfo(&aggstate->ss.ps, NULL); /* * get the count of aggregates in targetlist and quals |