aboutsummaryrefslogtreecommitdiff
path: root/src/backend/executor
Commit message (Collapse)AuthorAge
* Fix check_sql_fn_retval to allow the case where a SQL function declared toTom Lane2007-04-02
| | | | | | | | return void ends with a SELECT, if that SELECT has a single result that is also of type void. Without this, it's hard to write a void function that calls another void function. Per gripe from Peter. Back-patch as far as 8.0.
* SPI_cursor_open failed to enforce that only read-only queries could beTom Lane2007-03-17
| | | | | | | executed in read_only mode. This could lead to various relatively-subtle failures, such as an allegedly stable function returning non-stable results. Bug goes all the way back to the introduction of read-only mode in 8.0. Per report from Gaetano Mendola.
* Remove typmod checking from the recent security-related patches. It turnsTom Lane2007-02-06
| | | | | | | | | | | | | out that ExecEvalVar and friends don't necessarily have access to a tuple descriptor with correct typmod: it definitely can contain -1, and possibly might contain other values that are different from the Var's value. Arguably this should be cleaned up someday, but it's not a simple change, and in any case typmod discrepancies don't pose a security hazard. Per reports from numerous people :-( I'm not entirely sure whether the failure can occur in 8.0 --- the simple test cases reported so far don't trigger it there. But back-patch the change all the way anyway.
* Repair failure to check that a table is still compatible with a previouslyTom Lane2007-02-02
| | | | | | | | | | | | | | | | | | | | | | made query plan. Use of ALTER COLUMN TYPE creates a hazard for cached query plans: they could contain Vars that claim a column has a different type than it now has. Fix this by checking during plan startup that Vars at relation scan level match the current relation tuple descriptor. Since at that point we already have at least AccessShareLock, we can be sure the column type will not change underneath us later in the query. However, since a backend's locks do not conflict against itself, there is still a hole for an attacker to exploit: he could try to execute ALTER COLUMN TYPE while a query is in progress in the current backend. Seal that hole by rejecting ALTER TABLE whenever the target relation is already open in the current backend. This is a significant security hole: not only can one trivially crash the backend, but with appropriate misuse of pass-by-reference datatypes it is possible to read out arbitrary locations in the server process's memory, which could allow retrieving database content the user should not be able to see. Our thanks to Jeff Trout for the initial report. Security: CVE-2007-0556
* Repair insufficiently careful type checking for SQL-language functions:Tom Lane2007-02-02
| | | | | | | | | | | | | | | | we should check that the function code returns the claimed result datatype every time we parse the function for execution. Formerly, for simple scalar result types we assumed the creation-time check was sufficient, but this fails if the function selects from a table that's been redefined since then, and even more obviously fails if check_function_bodies had been OFF. This is a significant security hole: not only can one trivially crash the backend, but with appropriate misuse of pass-by-reference datatypes it is possible to read out arbitrary locations in the server process's memory, which could allow retrieving database content the user should not be able to see. Our thanks to Jeff Trout for the initial report. Security: CVE-2007-0555
* Relax an Assert() that has been found to be too strict in some situationsTom Lane2007-01-24
| | | | | | | involving unions of types having typmods. Variants of the failure are known to occur in 8.1 and up; not sure if it's possible in 8.0 and 7.4, but since the code exists that far back, I'll just patch 'em all. Per report from Brian Hurt.
* Repair bug #2839: the various ExecReScan functions need to resetTom Lane2006-12-26
| | | | | | | | | ps_TupFromTlist in plan nodes that make use of it. This was being done correctly in join nodes and Result nodes but not in any relation-scan nodes. Bug would lead to bogus results if a set-returning function appeared in the targetlist of a subquery that could be rescanned after partial execution, for example a subquery within EXISTS(). Bug has been around forever :-( ... surprising it wasn't reported before.
* Repair bug #2694 concerning an ARRAY[] construct whose inputs are emptyTom Lane2006-11-06
| | | | | | | | | | sub-arrays. Per discussion, if all inputs are empty arrays then result must be an empty array too, whereas a mix of empty and nonempty arrays should (and already did) draw an error. In the back branches, the construct was strict: any NULL input immediately yielded a NULL output; so I left that behavior alone. HEAD was simply ignoring NULL sub-arrays, which doesn't seem very sensible. For lack of a better idea it now treats NULL sub-arrays the same as empty ones.
* Fix mishandling of after-trigger state when a SQL function returns multipleTom Lane2006-10-12
| | | | | | | | | | rows --- if the surrounding query queued any trigger events between the rows, the events would be fired at the wrong time, leading to bizarre behavior. Per report from Merlin Moncure. This is a simple patch that should solve the problem fully in the back branches, but in HEAD we also need to consider the possibility of queries with RETURNING clauses. Will look into a fix for that separately.
* Fix nasty bug in nodeIndexscan.c's detection of duplicate tuples duringTom Lane2006-05-19
| | | | | | | | | | | | | | a multiple (OR'ed) indexscan. It was checking for duplicate tuple->t_data->t_ctid, when what it should be checking is tuple->t_self. The trouble situation occurs when a live tuple has t_ctid not pointing to itself, which can happen if an attempted UPDATE was rolled back. After a VACUUM, an unrelated tuple could be installed where the failed update tuple was, leading to one live tuple's t_ctid pointing to an unrelated tuple. If one of these tuples is fetched by an earlier OR'ed indexscan and the other by a later indexscan, nodeIndexscan.c would incorrectly ignore the second tuple. The bug exists in all 7.4.* and 8.0.* versions, but not in earlier or later branches because this code was only used in those releases. Per trouble report from Rafael Martinez Guerrero.
* Fix SELECT INTO and CREATE TABLE AS to create tables in the defaultBruce Momjian2006-04-26
| | | | | | tablespace, not the base directory. Kris Jurka
* Repair "Halloween problem" in EvalPlanQual: a tuple that's been inserted byTom Lane2006-01-12
| | | | | | | | our own command (or more generally, xmin = our xact and cmin >= current command ID) should not be seen as good. Else we may try to update rows we already updated. This error was inserted last August while fixing the even bigger problem that the old coding wouldn't see *any* tuples inserted by our own transaction as good. Per report from Euler Taveira de Oliveira.
* Back-patch fix for proper labeling of whole-row Datums generated fromTom Lane2005-10-19
| | | | subquery results.
* Back-patch fixes for problems with VACUUM destroying t_ctid chains too soon,Tom Lane2005-08-25
| | | | | and with insufficient paranoia in code that follows t_ctid links. This patch covers the 8.0 branch.
* SQL functions returning pass-by-reference types were copying the resultsTom Lane2005-04-10
| | | | | into the wrong memory context, resulting in a query-lifespan memory leak. Bug is new in 8.0, I believe. Per report from Rae Stiening.
* Fix SPI cursor support to allow scanning the results of utility commandsTom Lane2005-02-10
| | | | | | that return tuples (such as EXPLAIN). Per gripe from Michael Fuhr. Side effect: fix an old bug that unintentionally disabled backward scans for all SPI-created cursors.
* Improve planner's estimation of the space needed for HashAgg plans:Tom Lane2005-01-28
| | | | | | look at the actual aggregate transition datatypes and the actual overhead needed by nodeAgg.c, instead of using pessimistic round numbers. Per a discussion with Michael Tiemann.
* Check that aggregate creator has the right to execute the transitionTom Lane2005-01-27
| | | | functions of the aggregate, at both aggregate creation and execution times.
* Update obsolete comment, per Alvaro.Tom Lane2005-01-14
|
* Update copyrights that were missed.Bruce Momjian2005-01-01
|
* Tag appropriate files for rc3PostgreSQL Daemon2004-12-31
| | | | | | | | Also performed an initial run through of upgrading our Copyright date to extend to 2005 ... first run here was very simple ... change everything where: grep 1996-2004 && the word 'Copyright' ... scanned through the generated list with 'less' first, and after, to make sure that I only picked up the right entries ...
* Instead of supposing (wrongly, in the general case) that the rowtypeTom Lane2004-12-11
| | | | | | | | of an inheritance child table is binary-compatible with the rowtype of its parent, invent an expression node type that does the conversion correctly. Fixes the new bug exhibited by Kris Shannon as well as a lot of old bugs that would only show up when using multiple inheritance or after altering the parent table.
* Rethink plpgsql's way of handling SPI execution during an exception block.Tom Lane2004-11-16
| | | | | | | | | We don't really want to start a new SPI connection, just keep using the old one; otherwise we have memory management problems as illustrated by John Kennedy's bug report of today. This requires a bit of a hack to ensure the SPI stack state is properly restored, but then again what we were doing before was a hack too, strictly speaking. Add a regression test to cover this case.
* Modify hash_create() to elog(ERROR) if an error occurs, rather thanNeil Conway2004-10-25
| | | | | | | | returning a NULL pointer (some callers remembered to check the return value, but some did not -- it is safer to just bail out). Also, cleanup pgstat.c to use elog(ERROR) rather than elog(LOG) followed by exit().
* Allow functions returning void or cstring to appear in FROM clause,Tom Lane2004-10-20
| | | | | | to make life cushy for the JDBC driver. Centralize the decision-making that affects this by inventing a get_type_func_class() function, rather than adding special cases in half a dozen places.
* More minor cosmetic improvements:Neil Conway2004-10-13
| | | | | | | | | | - remove another senseless "extern" keyword that was applied to a function definition - change a foo more function signatures from "some_type foo()" to "some_type foo(void)" - rewrite another K&R style function definition - make the type of the "action" function pointer in the KeyWord struct in src/backend/utils/adt/formatting.c more precise
* Message style revisionsPeter Eisentraut2004-10-12
|
* Fix typo in comment.Neil Conway2004-10-11
|
* Fix problems with SQL functions returning rowtypes that have droppedTom Lane2004-10-07
| | | | | | | | | | | | columns. The returned tuple needs to have appropriate NULL columns inserted so that it actually matches the declared rowtype. It seemed convenient to use a JunkFilter for this, so I made some cleanups and simplifications in the JunkFilter code to allow it to support this additional functionality. (That in turn exposed a latent bug in nodeAppend.c, which is that it was returning a tuple slot whose descriptor didn't match its data.) Also, move check_sql_fn_retval out of pg_proc.c and into functions.c, where it seems to more naturally belong.
* Adjust index locking rules as per my proposal of earlier today. YouTom Lane2004-09-30
| | | | | | now are supposed to take some kind of lock on an index whenever you are going to access the index contents, rather than relying only on a lock on the parent table.
* ExecProcAppend() wasn't called ExecAppend() because the latter name wasNeil Conway2004-09-24
| | | | | formerly used in execMain. Since that is no longer the case, this patch renames ExecProcAppend() to ExecAppend() for the sake of consistency.
* Arrange for hash join to skip scanning the outer relation if it detectsTom Lane2004-09-22
| | | | | that the inner one is completely empty. Per recent discussion. Also some cosmetic cleanups in nearby code.
* Adjust ExecMakeTableFunctionResult to produce a single all-nulls rowTom Lane2004-09-22
| | | | | | | | when a function that returns a single tuple (not a setof tuple) returns NULL. This seems to be the most consistent behavior. It would have taken a bit less code to make it return an empty table (zero rows) but ISTM a non-SETOF function ought always return exactly one row. Per bug report from Ivan-Sun1.
* Hashed LEFT JOIN would miss outer tuples with no inner match if the joinTom Lane2004-09-17
| | | | | | was large enough to be batched and the tuples fell into a batch where there were no inner tuples at all. Thanks to Xiaoyu Wang for finding a test case that exposed this long-standing bug.
* Add some marginal tweaks to eliminate memory leakages associated withTom Lane2004-09-16
| | | | | subtransactions. Trivial subxacts (such as a plpgsql exception block containing no database access) now demonstrably leak zero bytes.
* Restructure subtransaction handling to reduce resource consumption,Tom Lane2004-09-16
| | | | | | | | | | | | | | | | | as per recent discussions. Invent SubTransactionIds that are managed like CommandIds (ie, counter is reset at start of each top transaction), and use these instead of TransactionIds to keep track of subtransaction status in those modules that need it. This means that a subtransaction does not need an XID unless it actually inserts/modifies rows in the database. Accordingly, don't assign it an XID nor take a lock on the XID until it tries to do that. This saves a lot of overhead for subtransactions that are only used for error recovery (eg plpgsql exceptions). Also, arrange to release a subtransaction's XID lock as soon as the subtransaction exits, in both the commit and abort cases. This avoids holding many unique locks after a long series of subtransactions. The price is some additional overhead in XactLockTableWait, but that seems acceptable. Finally, restructure the state machine in xact.c to have a more orthogonal set of states for subtransactions.
* Redesign query-snapshot timing so that volatile functions in READ COMMITTEDTom Lane2004-09-13
| | | | | | | | | | | | | mode see a fresh snapshot for each command in the function, rather than using the latest interactive command's snapshot. Also, suppress fresh snapshots as well as CommandCounterIncrement inside STABLE and IMMUTABLE functions, instead using the snapshot taken for the most closely nested regular query. (This behavior is only sane for read-only functions, so the patch also enforces that such functions contain only SELECT commands.) As per my proposal of 6-Sep-2004; I note that I floated essentially the same proposal on 19-Jun-2002, but that discussion tailed off without any action. Since 8.0 seems like the right place to be taking possibly nontrivial backwards compatibility hits, let's get it done now.
* Renumber SnapshotNow and the other special snapshot codes so thatTom Lane2004-09-11
| | | | | | | | ((Snapshot) NULL) can no longer be confused with a valid snapshot, as per my recent suggestion. Define a macro InvalidSnapshot for 0. Use InvalidSnapshot instead of SnapshotAny as the do-nothing special case for heap_update and heap_delete crosschecks; this seems a little cleaner even though the behavior is really the same.
* Fire non-deferred AFTER triggers immediately upon query completion,Tom Lane2004-09-10
| | | | | | | | | | | | | rather than when returning to the idle loop. This makes no particular difference for interactively-issued queries, but it makes a big difference for queries issued within functions: trigger execution now occurs before the calling function is allowed to proceed. This responds to numerous complaints about nonintuitive behavior of foreign key checking, such as http://archives.postgresql.org/pgsql-bugs/2004-09/msg00020.php, and appears to be required by the SQL99 spec. Also take the opportunity to simplify the data structures used for the pending-trigger list, rename them for more clarity, and squeeze out a bit of space.
* Guard against transaction control statements in SQL functions. ThisTom Lane2004-09-06
| | | | never worked, but it particularly doesn't work now.
* Pgindent run for 8.0.Bruce Momjian2004-08-29
|
* Update copyright to 2004.Bruce Momjian2004-08-29
|
* Standardize on the assumption that the arguments of a RowExpr correspondTom Lane2004-08-17
| | | | | | | to the physical layout of the rowtype, ie, there are dummy arguments corresponding to any dropped columns in the rowtype. We formerly had a couple of places that did it this way and several others that did not. Fixes Gaetano Mendola's "cache lookup failed for type 0" bug of 5-Aug.
* Allow DECLARE CURSOR to take parameters from the portal in which it isTom Lane2004-08-02
| | | | | | | | | | executed. Previously, the DECLARE would succeed but subsequent FETCHes would fail since the parameter values supplied to DECLARE were not propagated to the portal created for the cursor. In support of this, add type Oids to ParamListInfo entries, which seems like a good idea anyway since code that extracts a value can double-check that it got the type of value it was expecting. Oliver Jowett, with minor editorialization by Tom Lane.
* Be more consistent about reporting SPI errors in the various PLs.Tom Lane2004-07-31
| | | | | | Create a shared function to convert a SPI error code into a string (replacing near-duplicate code in several PLs), and use it anywhere that a SPI function call error is reported.
* Replace nested-BEGIN syntax for subtransactions with spec-compliantTom Lane2004-07-27
| | | | | | | SAVEPOINT/RELEASE/ROLLBACK-TO syntax. (Alvaro) Cause COMMIT of a failed transaction to report ROLLBACK instead of COMMIT in its command tag. (Tom) Fix a few loose ends in the nested-transactions stuff.
* For a SQL function declared to return a named composite type, makeTom Lane2004-07-15
| | | | sure the tuple datums it returns actually show that type and not RECORD.
* Test HAVING condition before computing targetlist of an Aggregate node.Tom Lane2004-07-10
| | | | | | | This is required by SQL spec to avoid failures in cases like SELECT sum(win)/sum(lose) FROM ... GROUP BY ... HAVING sum(lose) > 0; AFAICT we have gotten this wrong since day one. Kudos to Holger Jakobs for being the first to notice.
* More paranoia in AtEOSubXact_SPI: don't assume we can safely use SPI_finishTom Lane2004-07-01
| | | | | | | for cleaning up. It seems possible that the memory contexts SPI_finish would try to touch are already gone; and there's no need for SPI itself to delete them, since the containing contexts will surely be going away anyway at transaction end.
* Nested transactions. There is still much left to do, especially on theTom Lane2004-07-01
| | | | | | | performance front, but with feature freeze upon us I think it's time to drive a stake in the ground and say that this will be in 7.5. Alvaro Herrera, with some help from Tom Lane.
generated by cgit v1.2.3 (git 2.25.1) at 2025-07-18 05:23:40 +0000