aboutsummaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAge
* Change ps_status.c to explicitly track the current logical length of ps_buffer.Tom Lane2010-05-27
| | | | | | | | | | | This saves cycles in get_ps_display() on many popular platforms, and more importantly ensures that get_ps_display() will correctly return an empty string if init_ps_display() hasn't been called yet. Per trouble report from Ray Stell, in which log_line_prefix %i produced junk early in backend startup. Back-patch to 8.0. 7.4 doesn't have %i and its version of get_ps_display() makes no pretense of avoiding pad junk anyhow.
* > Follow up a visit from the style police.Andrew Dunstan2010-05-17
|
* Fix longstanding typo in V1 calling conventions documentation.Robert Haas2010-05-16
| | | | Erik Rijkers
* Improve documentation of pg_restore's -l and -L switches to point out theirTom Lane2010-05-15
| | | | | interactions with filtering switches, such as -n and -t. Per a complaint from Russell Smith.
* tag 8.0.25REL8_0_25Marc G. Fournier2010-05-14
|
* Update release notes with security issues.Tom Lane2010-05-13
| | | | Security: CVE-2010-1169, CVE-2010-1170
* Use an entity instead of non-ASCII letter. Thom BrownTom Lane2010-05-13
|
* Prevent PL/Tcl from loading the "unknown" module from pltcl_modules unlessTom Lane2010-05-13
| | | | | | | | | | | | | | | | | | | that is a regular table or view owned by a superuser. This prevents a trojan horse attack whereby any unprivileged SQL user could create such a table and insert code into it that would then get executed in other users' sessions whenever they call pltcl functions. Worse yet, because the code was automatically loaded into both the "normal" and "safe" interpreters at first use, the attacker could execute unrestricted Tcl code in the "normal" interpreter without there being any pltclu functions anywhere, or indeed anyone else using pltcl at all: installing pltcl is sufficient to open the hole. Change the initialization logic so that the "unknown" code is only loaded into an interpreter when the interpreter is first really used. (That doesn't add any additional security in this particular context, but it seems a prudent change, and anyway the former behavior violated the principle of least astonishment.) Security: CVE-2010-1170
* Abandon the use of Perl's Safe.pm to enforce restrictions in plperl, as it isAndrew Dunstan2010-05-13
| | | | | | | | | | | | | | | | | | | | | | | | fundamentally insecure. Instead apply an opmask to the whole interpreter that imposes restrictions on unsafe operations. These restrictions are much harder to subvert than is Safe.pm, since there is no container to be broken out of. Backported to release 7.4. In releases 7.4, 8.0 and 8.1 this also includes the necessary backporting of the two interpreters model for plperl and plperlu adopted in release 8.2. In versions 8.0 and up, the use of Perl's POSIX module to undo its locale mangling on Windows has become insecure with these changes, so it is replaced by our own routine, which is also faster. Nice side effects of the changes include that it is now possible to use perl's "strict" pragma in a natural way in plperl, and that perl's $a and $b variables now work as expected in sort routines, and that function compilation is significantly faster. Tim Bunce and Andrew Dunstan, with reviews from Alex Hunsaker and Alexey Klyukin. Security: CVE-2010-1169
* Translation updatePeter Eisentraut2010-05-13
|
* Preliminary release notes for releases 8.4.4, 8.3.11, 8.2.17, 8.1.21, 8.0.25,Tom Lane2010-05-12
| | | | 7.4.29.
* Update time zone data files to tzdata release 2010j: DST law changes inTom Lane2010-05-11
| | | | | Argentina, Australian Antarctic, Bangladesh, Mexico, Morocco, Pakistan, Palestine, Russia, Syria, Tunisia. Historical corrections for Taiwan.
* Work around a subtle portability problem in use of printf %s format.Tom Lane2010-05-08
| | | | | | | | | | | | | Depending on which spec you read, field widths and precisions in %s may be counted either in bytes or characters. Our code was assuming bytes, which is wrong at least for glibc's implementation, and in any case libc might have a different idea of the prevailing encoding than we do. Hence, for portable results we must avoid using anything more complex than just "%s" unless the string to be printed is known to be all-ASCII. This patch fixes the cases I could find, including the psql formatting failure reported by Hernan Gonzalez. In HEAD only, I also added comments to some places where it appears safe to continue using "%.*s".
* Fix psql to not go into infinite recursion when expanding a variable thatTom Lane2010-05-05
| | | | | | | | | | refers to itself (directly or indirectly). Instead, print a message when recursion is detected, and don't expand the repeated reference. Per bug #5448 from Francis Markham. Back-patch to 8.0. Although the issue exists in 7.4 as well, it seems impractical to fix there because of the lack of any state stack that could be used to track active expansions.
* Fix backpatching error in recent patch for ALTER USER f RESET ALL behavior.Tom Lane2010-05-05
| | | | | | | The argument list for array_set() changed in 8.2 (in connection with allowing nulls in arrays) but the newer argument list was used in the patches applied to 8.1 and 8.0 branches. The patch for 7.4 was OK though. Per compiler warnings.
* Add code to InternalIpcMemoryCreate() to handle the case where shmget()Tom Lane2010-05-01
| | | | | | | | | | | | | | | | returns EINVAL for an existing shared memory segment. Although it's not terribly sensible, that behavior does meet the POSIX spec because EINVAL is the appropriate error code when the existing segment is smaller than the requested size, and the spec explicitly disclaims any particular ordering of error checks. Moreover, it does in fact happen on OS X and probably other BSD-derived kernels. (We were able to talk NetBSD into changing their code, but purging that behavior from the wild completely seems unlikely to happen.) We need to distinguish collision with a pre-existing segment from invalid size request in order to behave sensibly, so it's worth some extra code here to get it right. Per report from Gavin Kistner and subsequent investigation. Back-patch to all supported versions, since any of them could get used with a kernel having the debatable behavior.
* Fix multiple memory leaks in PLy_spi_execute_fetch_result: it would leakTom Lane2010-04-30
| | | | | | | | | | memory if the result had zero rows, and also if there was any sort of error while converting the result tuples into Python data. Reported and partially fixed by Andres Freund. Back-patch to all supported versions. Note: I haven't tested the 7.4 fix. 7.4's configure check for python is so obsolete it doesn't work on my current machines :-(. The logic change is pretty straightforward though.
* Sync perl's ppport.h on all branches back to 7.4 with recent update on HEAD, ↵Andrew Dunstan2010-04-03
| | | | ensuring we can build older branches with modern Perl installations.
* Ensure that contrib/pgstattuple functions respond to cancel interruptsTom Lane2010-04-02
| | | | | | reasonably promptly, by adding CHECK_FOR_INTERRUPTS in the per-page loops. Tatsuhito Kasahara
* Prevent ALTER USER f RESET ALL from removing the settings that were put thereAlvaro Herrera2010-03-25
| | | | | | | | by a superuser -- "ALTER USER f RESET setting" already disallows removing such a setting. Apply the same treatment to ALTER DATABASE d RESET ALL when run by a database owner that's not superuser.
* Clear error_context_stack and debug_query_string at the beginning of proc_exit,Tom Lane2010-03-20
| | | | | | | | | | | | | so that we won't try to attach any context printouts to messages that get emitted while exiting. Per report from Dennis Koegel, the context functions won't necessarily work after we've started shutting down the backend, and it seems possible that debug_query_string could be pointing at freed storage as well. The context information doesn't seem particularly relevant to such messages anyway, so there's little lost by suppressing it. Back-patch to all supported branches. I can only demonstrate a crash with log_disconnections messages back to 8.1, but the risk seems real in 8.0 and before anyway.
* Typo fixes.Magnus Hagander2010-03-17
| | | | Fujii Masao
* tag 8.0.24, not .23REL8_0_24Marc G. Fournier2010-03-12
|
* Preliminary release notes for releases 8.4.3, 8.3.10, 8.2.16, 8.1.20, 8.0.24,Tom Lane2010-03-10
| | | | 7.4.28.
* Use SvROK(sv) rather than directly checking SvTYPE(sv) == SVt_RV in plperl.Tom Lane2010-03-09
| | | | | | | | The latter is considered unwarranted chumminess with the implementation, and can lead to crashes with recent Perl versions. Report and fix by Tim Bunce. Back-patch to all versions containing the questionable coding pattern.
* Update time zone data files to tzdata release 2010d: DST law changes in Fiji,Alvaro Herrera2010-03-09
| | | | Samoa, Chile; corrections to recent changes in Paraguay and Bangladesh.
* Add missing space in example.Magnus Hagander2010-03-08
| | | | Tim Landscheidt
* Update time zone data files to tzdata release 2010c: DST law changes inTom Lane2010-03-08
| | | | Bangladesh, Mexico, Paraguay.
* When reading pg_hba.conf and similar files, do not treat @file as an inclusionTom Lane2010-03-06
| | | | | | | | | | | | | | | | | | | | | | | unless (1) the @ isn't quoted and (2) the filename isn't empty. This guards against unexpectedly treating usernames or other strings in "flat files" as inclusion requests, as seen in a recent trouble report from Ed L. The empty-filename case would be guaranteed to misbehave anyway, because our subsequent path-munging behavior results in trying to read the directory containing the current input file. I think this might finally explain the report at http://archives.postgresql.org/pgsql-bugs/2004-05/msg00132.php of a crash after printing "authentication file token too long, skipping", since I was able to duplicate that message (though not a crash) on a platform where stdio doesn't refuse to read directories. We never got far in investigating that problem, but now I'm suspicious that the trigger condition was an @ in the flat password file. Back-patch to all active branches since the problem can be demonstrated in all branches except HEAD. The test case, creating a user named "@", doesn't cause a problem in HEAD since we got rid of the flat password file. Nonetheless it seems like a good idea to not consider quoted @ as a file inclusion spec, so I changed HEAD too.
* Fix a couple of places that would loop forever if attempts to read a stdio fileTom Lane2010-03-03
| | | | | | | set ferror() but never set feof(). This is known to be the case for recent glibc when trying to read a directory as a file, and might be true for other platforms/cases too. Per report from Ed L. (There is more that we ought to do about his report, but this is one easily identifiable issue.)
* Make contrib/xml2 use core xml.c's error handler, when available (that is,Tom Lane2010-03-03
| | | | | | | | | | | | | in versions >= 8.3). The core code is more robust and efficient than what was there before, and this also reduces risks involved in swapping different libxml error handler settings. Before 8.3, there is still some risk of problems if add-on modules such as Perl invoke libxml without setting their own error handler. Given the lack of reports I'm not sure there's a risk in practice, so I didn't take the step of actually duplicating the core code into older contrib/xml2 branches. Instead I just tweaked the existing code to ensure it didn't leave a dangling pointer to short-lived memory when throwing an error.
* Fix contrib/xml2 so regression test still works when it's built without libxslt.Tom Lane2010-03-01
| | | | | | | This involves modifying the module to have a stable ABI, that is, the xslt_process() function still exists even without libxslt. It throws a runtime error if called, but doesn't prevent executing the CREATE FUNCTION call. This is a good thing anyway to simplify cross-version upgrades.
* Remove xmlCleanupParser calls from contrib/xml2.Tom Lane2010-03-01
| | | | | | | These are unnecessary and probably dangerous. I don't see any immediate risk situations in the core XML support or contrib/xml2 itself, but there could be issues with external uses of libxml2, and in any case it's an accident waiting to happen.
* Back-patch today's memory management fixups in contrib/xml2.Tom Lane2010-03-01
| | | | | | | | | | | Prior to 8.3, these changes are not critical for compatibility with core Postgres, since core had no libxml2 calls then. However there is still a risk if contrib/xml2 is used along with libxml2 functionality in Perl or other loadable modules. So back-patch to all versions. Also back-patch addition of regression tests. I'm not sure how many of the cases are interesting without the interaction with core xml code, but a silly regression test is still better than none at all.
* Back-patch addition of ssl_renegotiation_limit into 7.4 through 8.1.Tom Lane2010-02-25
|
* Fix STOP WAL LOCATION in backup history files no to return the nextItagaki Takahiro2010-02-19
| | | | | | | | | | | segment of XLOG_BACKUP_END record even if the the record is placed at a segment boundary. Furthermore the previous implementation could return nonexistent segment file name when the boundary is in segments that has "FE" suffix; We never use segments with "FF" suffix. Backpatch to 8.0, where hot backup was introduced. Reported by Fujii Masao.
* Volatile-ize all five places where we expect a PG_TRY block to restoreTom Lane2010-02-18
| | | | | | old memory context in plpython. Before only one of them was marked volatile, but per report from Zdenek Kotala, some compilers do the wrong thing here.
* Don't choke when exec_move_row assigns a synthesized null to a columnTom Lane2010-02-12
| | | | | | | that happens to be composite itself. Per bug #5314 from Oleg Serov. Backpatch to 8.0 --- 7.4 has got too many other shortcomings in composite-type support to make this worth worrying about in that branch.
* Check to ensure the number of primary key fields supplied does notJoe Conway2010-02-03
| | | | | | | exceed the total number of non-dropped source table fields for dblink_build_sql_*(). Addresses bug report from Rushabh Lathia. Backpatch all the way to the 7.3 branch.
* Change regexp engine's ccondissect/crevdissect routines to perform DFATom Lane2010-02-01
| | | | | | | | | | | | | | | | | matching before recursing instead of after. The DFA match eliminates unworkable midpoint choices a lot faster than the recursive check, in most cases, so doing it first can speed things up; particularly in pathological cases such as recently exhibited by Michael Glaesemann. In addition, apply some cosmetic changes that were applied upstream (in the Tcl project) at the same time, in order to sync with upstream version 1.15 of regexec.c. Upstream apparently intends to backpatch this, so I will too. The pathological behavior could be unpleasant if encountered in the field, which seems to justify any risk of introducing new bugs. Tom Lane, reviewed by Donal K. Fellows of Tcl project
* Avoid performing encoding conversion on command tag strings during EndCommand.Tom Lane2010-01-30
| | | | | | | | | | | | | Since all current and foreseeable future command tags will be pure ASCII, there is no need to do conversion on them. This saves a few cycles and also avoids polluting otherwise-pristine subtransaction memory contexts, which is the cause of the backend memory leak exhibited in bug #5302. (Someday we'll probably want to have a better method of determining whether subtransaction contexts need to be kept around, but today is not that day.) Backpatch to 8.0. The cycle-shaving aspect of this would work in 7.4 too, but without subtransactions the memory-leak aspect doesn't apply, so it doesn't seem worth touching 7.4.
* Apply Tcl_Init() to the "hold" interpreter created by pltcl.Tom Lane2010-01-25
| | | | | | | | | | | | | | | | | | | | | | | You might think this is unnecessary since that interpreter is never used to run code --- but it turns out that's wrong. As of Tcl 8.5, the "clock" command (alone among builtin Tcl commands) is partially implemented by loaded-on-demand Tcl code, which means that it fails if there's not unknown-command support, and also that it's impossible to run it directly in a safe interpreter. The way they get around the latter is that Tcl_CreateSlave() automatically sets up an alias command that forwards any execution of "clock" in a safe slave interpreter to its parent interpreter. Thus, when attempting to execute "clock" in trusted pltcl, the command actually executes in the "hold" interpreter, where it will fail if unknown-command support hasn't been introduced by sourcing the standard init.tcl script, which is done by Tcl_Init(). (This is a pretty dubious design decision on the Tcl boys' part, if you ask me ... but they didn't.) Back-patch all the way. It's not clear that anyone would try to use ancient versions of pltcl with a recent Tcl, but it's not clear they wouldn't, either. Also add a regression test using "clock", in branches that have regression test support for pltcl. Per recent trouble report from Kyle Bateman.
* Fix assorted core dumps and Assert failures that could occur duringTom Lane2010-01-24
| | | | | | | | | | | | | | AbortTransaction or AbortSubTransaction, when trying to clean up after an error that prevented (sub)transaction start from completing: * access to TopTransactionResourceOwner that might not exist * assert failure in AtEOXact_GUC, if AtStart_GUC not called yet * assert failure or core dump in AfterTriggerEndSubXact, if AfterTriggerBeginSubXact not called yet Per testing by injecting elog(ERROR) at successive steps in StartTransaction and StartSubTransaction. It's not clear whether all of these cases could really occur in the field, but at least one of them is easily exposed by simple stress testing, as per my accidental discovery yesterday.
* Make bit/varbit substring() treat any negative length as meaning "all the restTom Lane2010-01-07
| | | | | | | | | | | of the string". The previous coding treated only -1 that way, and would produce an invalid result value for other negative values. We ought to fix it so that 2-parameter bit substring() is a different C function and the 3-parameter form throws error for negative length, but that takes a pg_proc change which is impractical in the back branches; and in any case somebody might be relying on -1 working this way. So just do this as a back-patchable fix.
* Fix integer-to-bit-string conversions to handle the first fractional byteTom Lane2009-12-12
| | | | | | | | | correctly when the output bit width is wider than the given integer by something other than a multiple of 8 bits. This has been wrong since I first wrote that code for 8.0 :-(. Kudos to Roman Kononov for being the first to notice, though I didn't use his patch. Per bug #5237.
* tag 8.0.23REL8_0_23Marc G. Fournier2009-12-10
|
* Update release notes for releases 8.4.2, 8.3.9, 8.2.15, 8.1.19, 8.0.23,Tom Lane2009-12-10
| | | | 7.4.27.
* Prevent indirect security attacks via changing session-local state withinTom Lane2009-12-09
| | | | | | | | | | | | | | | | | | | | | | | | | | | an allegedly immutable index function. It was previously recognized that we had to prevent such a function from executing SET/RESET ROLE/SESSION AUTHORIZATION, or it could trivially obtain the privileges of the session user. However, since there is in general no privilege checking for changes of session-local state, it is also possible for such a function to change settings in a way that might subvert later operations in the same session. Examples include changing search_path to cause an unexpected function to be called, or replacing an existing prepared statement with another one that will execute a function of the attacker's choosing. The present patch secures VACUUM, ANALYZE, and CREATE INDEX/REINDEX against these threats, which are the same places previously deemed to need protection against the SET ROLE issue. GUC changes are still allowed, since there are many useful cases for that, but we prevent security problems by forcing a rollback of any GUC change after completing the operation. Other cases are handled by throwing an error if any change is attempted; these include temp table creation, closing a cursor, and creating or deleting a prepared statement. (In 7.4, the infrastructure to roll back GUC changes doesn't exist, so we settle for rejecting changes of "search_path" in these contexts.) Original report and patch by Gurjeet Singh, additional analysis by Tom Lane. Security: CVE-2009-4136
* Reject certificates with embedded NULLs in the commonName field. This stopsMagnus Hagander2009-12-09
| | | | | | | | | | | | | | | | | | attacks where an attacker would put <attack>\0<propername> in the field and trick the validation code that the certificate was for <attack>. This is a very low risk attack since it reuqires the attacker to trick the CA into issuing a certificate with an incorrect field, and the common PostgreSQL deployments are with private CAs, and not external ones. Also, default mode in 8.4 does not do any name validation, and is thus also not vulnerable - but the higher security modes are. Backpatch all the way. Even though versions 8.3.x and before didn't have certificate name validation support, they still exposed this field for the user to perform the validation in the application code, and there is no way to detect this problem through that API. Security: CVE-2009-4034
* Update time zone data files to tzdata release 2009s: DST law changes inTom Lane2009-12-09
| | | | | Antarctica, Argentina, Bangladesh, Fiji, Novokuznetsk, Pakistan, Palestine, Samoa, Syria. Also historical corrections for Hong Kong.
generated by cgit v1.2.3 (git 2.25.1) at 2025-08-04 19:47:40 +0000