aboutsummaryrefslogtreecommitdiff
path: root/src/backend/utils
Commit message (Collapse)AuthorAge
* Export xml.c's libxml-error-handling support so that contrib/xml2 can use itTom Lane2010-03-03
| | | | | | | | | too, instead of duplicating the functionality (badly). I renamed xml_init to pg_xml_init, because the former seemed just a bit too generic to be safe as a global symbol. I considered likewise renaming xml_ereport to pg_xml_ereport, but felt that the reference to ereport probably made it sufficiently PG-centric already.
* Add configuration parameter ssl_renegotiation_limit to controlMagnus Hagander2010-02-25
| | | | | | | | how often we do SSL session key renegotiation. Can be set to 0 to disable renegotiation completely, which is required if a broken SSL library is used (broken patches to CVE-2009-3555 a known cause) or when using a client library that can't do renegotiation.
* Provide some rather hokey ways for EXPLAIN to print FieldStore and assignmentTom Lane2010-02-18
| | | | | | | | | | | | | | | | | | ArrayRef expressions that are not in the immediate context of an INSERT or UPDATE targetlist. Such cases never arise in stored rules, so ruleutils.c hadn't tried to handle them. However, they do occur in the targetlists of plans derived from such statements, and now that EXPLAIN VERBOSE tries to print targetlists, we need some way to deal with the case. I chose to represent an assignment ArrayRef as "array[subscripts] := source", which is fairly reasonable and doesn't omit any information. However, FieldStore is problematic because the planner will fold multiple assignments to fields of the same composite column into one FieldStore, resulting in a structure that is hard to understand at all, let alone display comprehensibly. So in that case I punted and just made it print the source expression(s). Backpatch to 8.4 --- the lack of functionality exists in older releases, but doesn't seem to be important for lack of anything that would call it.
* Force READY portals into FAILED state when a transaction or subtransactionTom Lane2010-02-18
| | | | | | | | | | | is aborted, if they were created within the failed xact. This prevents ExecutorEnd from being run on them, which is a good idea because they may contain references to tables or other objects that no longer exist. In particular this is hazardous when auto_explain is active, but it's really rather surprising that nobody has seen an issue with this before. I'm back-patching this to 8.4, since that's the first version that contains auto_explain or an ExecutorEnd hook, but I wonder whether we shouldn't back-patch further.
* Fix assorted core dumps and Assert failures that could occur duringTom Lane2010-01-24
| | | | | | | | | | | | | | AbortTransaction or AbortSubTransaction, when trying to clean up after an error that prevented (sub)transaction start from completing: * access to TopTransactionResourceOwner that might not exist * assert failure in AtEOXact_GUC, if AtStart_GUC not called yet * assert failure or core dump in AfterTriggerEndSubXact, if AfterTriggerBeginSubXact not called yet Per testing by injecting elog(ERROR) at successive steps in StartTransaction and StartSubTransaction. It's not clear whether all of these cases could really occur in the field, but at least one of them is easily exposed by simple stress testing, as per my accidental discovery yesterday.
* Insert CHECK_FOR_INTERRUPTS calls into loops in dbsize.c, to ensure thatTom Lane2010-01-23
| | | | | | the various disk-size-reporting functions will respond to query cancel reasonably promptly even in very large databases. Per report from Kevin Grittner.
* Fix portalmem.c to avoid keeping a dangling pointer to a cached plan listTom Lane2010-01-18
| | | | | | | after it's released its reference count for the cached plan. There are code paths that might try to examine the plan list before noticing that the portal is already in aborted state. Report and diagnosis by Tatsuo Ishii, though this isn't exactly his proposed patch.
* When loading critical system indexes into the relcache, ensure we lock theTom Lane2010-01-13
| | | | | | | | | | | | | underlying catalog not only the index itself. Otherwise, if the cache load process touches the catalog (which will happen for many though not all of these indexes), we are locking index before parent table, which can result in a deadlock against processes that are trying to lock them in the normal order. Per today's failure on buildfarm member gothic_moth; it's surprising the problem hadn't been identified before. Back-patch to 8.2. Earlier releases didn't have the issue because they didn't try to lock these indexes during load (instead assuming that they couldn't change schema at all during multiuser operation).
* Fix bug #5269: ResetPlanCache mustn't invalidate cached utility statements,Tom Lane2010-01-13
| | | | | | | | | | especially not ROLLBACK. ROLLBACK might need to be executed in an already aborted transaction, when there is no safe way to revalidate the plan. But in general there's no point in marking utility statements invalid, since they have no plans in the normal sense of the word; so we might as well work a bit harder here to avoid future revalidation cycles. Back-patch to 8.4, where the bug was introduced.
* Fix relcache reload mechanism to be more robust in the face of errorsTom Lane2010-01-12
| | | | | | | | | | | | | | | | | | | | occurring during a reload, such as query-cancel. Instead of zeroing out an existing relcache entry and rebuilding it in place, build a new relcache entry, then swap its contents with the old one, then free the new entry. This avoids problems with code believing that a previously obtained pointer to a cache entry must still reference a valid entry, as seen in recent failures on buildfarm member jaguar. (jaguar is using CLOBBER_CACHE_ALWAYS which raises the probability of failure substantially, but the problem could occur in the field without that.) The previous design was okay when it was made, but subtransactions and the ResourceOwner mechanism make it unsafe now. Also, make more use of the already existing rd_isvalid flag, so that we remember that the entry requires rebuilding even if the first attempt fails. Back-patch as far as 8.2. Prior versions have enough issues around relcache reload anyway (due to inadequate locking) that fixing this one doesn't seem worthwhile.
* Make bit/varbit substring() treat any negative length as meaning "all the restTom Lane2010-01-07
| | | | | | | | | | | of the string". The previous coding treated only -1 that way, and would produce an invalid result value for other negative values. We ought to fix it so that 2-parameter bit substring() is a different C function and the 3-parameter form throws error for negative length, but that takes a pg_proc change which is impractical in the back branches; and in any case somebody might be relying on -1 working this way. So just do this as a back-patchable fix.
* Previous fix for temporary file management broke returning a set fromHeikki Linnakangas2009-12-29
| | | | | | | | | | | | | | PL/pgSQL function within an exception handler. Make sure we use the right resource owner when we create the tuplestore to hold returned tuples. Simplify tuplestore API so that the caller doesn't need to be in the right memory context when calling tuplestore_put* functions. tuplestore.c automatically switches to the memory context used when the tuplestore was created. Tuplesort was already modified like this earlier. This patch also removes the now useless MemoryContextSwitch calls from callers. Report by Aleksei on pgsql-bugs on Dec 22 2009. Backpatch to 8.1, like the previous patch that broke this.
* Fix integer-to-bit-string conversions to handle the first fractional byteTom Lane2009-12-12
| | | | | | | | | correctly when the output bit width is wider than the given integer by something other than a multiple of 8 bits. This has been wrong since I first wrote that code for 8.0 :-(. Kudos to Roman Kononov for being the first to notice, though I didn't use his patch. Per bug #5237.
* Prevent indirect security attacks via changing session-local state withinTom Lane2009-12-09
| | | | | | | | | | | | | | | | | | | | | | | | | | | an allegedly immutable index function. It was previously recognized that we had to prevent such a function from executing SET/RESET ROLE/SESSION AUTHORIZATION, or it could trivially obtain the privileges of the session user. However, since there is in general no privilege checking for changes of session-local state, it is also possible for such a function to change settings in a way that might subvert later operations in the same session. Examples include changing search_path to cause an unexpected function to be called, or replacing an existing prepared statement with another one that will execute a function of the attacker's choosing. The present patch secures VACUUM, ANALYZE, and CREATE INDEX/REINDEX against these threats, which are the same places previously deemed to need protection against the SET ROLE issue. GUC changes are still allowed, since there are many useful cases for that, but we prevent security problems by forcing a rollback of any GUC change after completing the operation. Other cases are handled by throwing an error if any change is attempted; these include temp table creation, closing a cursor, and creating or deleting a prepared statement. (In 7.4, the infrastructure to roll back GUC changes doesn't exist, so we settle for rejecting changes of "search_path" in these contexts.) Original report and patch by Gurjeet Singh, additional analysis by Tom Lane. Security: CVE-2009-4136
* Fix bug in temporary file management with subtransactions. A cursor openedHeikki Linnakangas2009-12-03
| | | | | | | | | | | | | in a subtransaction stays open even if the subtransaction is aborted, so any temporary files related to it must stay alive as well. With the patch, we use ResourceOwners to track open temporary files and don't automatically close them at subtransaction end (though in the normal case temporary files are registered with the subtransaction resource owner and will therefore be closed). At end of top transaction, we still check that there's no temporary files marked as close-at-end-of-transaction open, but that's now just a debugging cross-check as the resource owner cleanup should've closed them already.
* Fix display and dumping of UPDATE OR TRUNCATE triggers (a bizarre combinationTom Lane2009-11-20
| | | | | maybe, but we should get it right). Bug noted while reviewing TRIGGER WHEN patch. Already fixed in HEAD.
* Allow binary-coercible cases in ri_HashCompareOp; there are some such casesTom Lane2009-11-05
| | | | | | that are not handled by find_coercion_pathway, notably composite->RECORD. Now that 8.4 supports composites as primary keys, it's worth dealing with this case.
* Fix ts_stat's failure on empty tsvector.Tom Lane2009-10-13
| | | | | | Also insert a couple of Asserts that check for stack overflow. Bogus coding appears to be new in 8.4 --- older releases had a much simpler algorithm here. Per bug #5111.
* Fix off-by-one bug in bitncmp(): When comparing a number of bits divisible byHeikki Linnakangas2009-10-08
| | | | | | 8, bitncmp() may dereference a pointer one byte out of bounds. Chris Mikkelson (bug #5101)
* Fix snapshot management, take two.Alvaro Herrera2009-10-07
| | | | | | | | | | | | | | | | | | | | Partially revert the previous patch I installed and replace it with a more general fix: any time a snapshot is pushed as Active, we need to ensure that it will not be modified in the future. This means that if the same snapshot is used as CurrentSnapshot, it needs to be copied separately. This affects serializable transactions only, because CurrentSnapshot has already been copied by RegisterSnapshot and so PushActiveSnapshot does not think it needs another copy. However, CommandCounterIncrement would modify CurrentSnapshot, whereas ActiveSnapshots must not have their command counters incremented. I say "partially" because the regression test I added for the previous bug has been kept. (This restores 8.3 behavior, because before snapmgr.c existed, any snapshot set as Active was copied.) Per bug report from Stuart Bishop in 6bc73d4c0910042358k3d1adff3qa36f8df75198ecea@mail.gmail.com
* Ensure that a cursor has an immutable snapshot throughout its lifespan.Alvaro Herrera2009-10-02
| | | | | | | | | The old coding was using a regular snapshot, referenced elsewhere, that was subject to having its command counter updated. Fix by creating a private copy of the snapshot exclusively for the cursor. Backpatch to 8.4, which is when the bug was introduced during the snapshot management rewrite.
* Fix RelationCacheInitializePhase2 (Phase3, in HEAD) to cope with theTom Lane2009-09-26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | possibility of shared-inval messages causing a relcache flush while it tries to fill in missing data in preloaded relcache entries. There are actually two distinct failure modes here: 1. The flush could delete the next-to-be-processed cache entry, causing the subsequent hash_seq_search calls to go off into the weeds. This is the problem reported by Michael Brown, and I believe it also accounts for bug #5074. The simplest fix is to restart the hashtable scan after we've read any new data from the catalogs. It appears that pre-8.4 branches have not suffered from this failure, because by chance there were no other catalogs sharing the same hash chains with the catalogs that RelationCacheInitializePhase2 had work to do for. However that's obviously pretty fragile, and it seems possible that derivative versions with additional system catalogs might be vulnerable, so I'm back-patching this part of the fix anyway. 2. The flush could delete the *current* cache entry, in which case the pointer to the newly-loaded data would end up being stored into an already-deleted Relation struct. As long as it was still deleted, the only consequence would be some leaked space in CacheMemoryContext. But it seems possible that the Relation struct could already have been recycled, in which case this represents a hard-to-reproduce clobber of cached data structures, with unforeseeable consequences. The fix here is to pin the entry while we work on it. In passing, also change RelationCacheInitializePhase2 to Assert that formrdesc() set up the relation's cached TupleDesc (rd_att) with the correct type OID and hasoids values. This is more appropriate than silently updating the values, because the original tupdesc might already have been copied into the catcache. However this part of the patch is not in HEAD because it fails due to some questionable recent changes in formrdesc :-(. That will be cleaned up in a subsequent patch.
* Fix encoding handling in xml binary input function. If the XML header didn'tHeikki Linnakangas2009-09-04
| | | | | | | specify an encoding explicitly, we used to treat it as being in database encoding when we parsed it, but then perform a UTF-8 -> database encoding conversion on it, which was completely bogus. It's now consistently treated as UTF-8.
* Make LOAD of an already-loaded library into a no-op, instead of attemptingTom Lane2009-09-03
| | | | | | | | | | | | | | | | | | | | | | | to unload and re-load the library. The difficulty with unloading a library is that we haven't defined safe protocols for doing so. In particular, there's no safe mechanism for getting out of a "hook" function pointer unless libraries are unloaded in reverse order of loading. And there's no mechanism at all for undefining a custom GUC variable, so GUC would be left with a pointer to an old value that might or might not still be valid, and very possibly wouldn't be in the same place anymore. While the unload and reload behavior had some usefulness in easing development of new loadable libraries, it's of no use whatever to normal users, so just disabling it isn't giving up that much. Someday we might care to expend the effort to develop safe unload protocols; but even if we did, there'd be little certainty that every third-party loadable module was following them, so some security restrictions would still be needed. Back-patch to 8.2; before that, LOAD was superuser-only anyway. Security: unprivileged users could crash backend. CVE not assigned yet
* Disallow RESET ROLE and RESET SESSION AUTHORIZATION inside security-definerTom Lane2009-09-03
| | | | | | | | | | | | | | | | functions. This extends the previous patch that forbade SETting these variables inside security-definer functions. RESET is equally a security hole, since it would allow regaining privileges of the caller; furthermore it can trigger Assert failures and perhaps other internal errors, since the code is not expecting these variables to change in such contexts. The previous patch did not cover this case because assign hooks don't really have enough information, so move the responsibility for preventing this into guc.c. Problem discovered by Heikki Linnakangas. Security: no CVE assigned yet, extends CVE-2007-6600
* Install a workaround for a longstanding gcc bug that allows SIGFPE trapsTom Lane2009-09-03
| | | | | | | | | | | to occur for division by zero, even though the code is carefully avoiding that. All available evidence is that the only functions affected are int24div, int48div, and int28div, so patch just those three functions to include a "return" after the ereport() call. Backpatch to 8.4 so that the fix can be tested in production builds. For older branches our recommendation will continue to be to use -O1 on affected platforms (which are mostly non-mainstream anyway).
* Remove duplicate variable initializations identified by clang static checker.Tom Lane2009-08-30
| | | | | | | One of these represents a nontrivial bug (a promptly-leaked palloc), so backpatch. Greg Stark
* Try to make silent_mode behave somewhat reasonably.Tom Lane2009-08-24
| | | | | | | | | | | | | | | | | | | | | | Instead of sending stdout/stderr to /dev/null after forking away from the terminal, send them to postmaster.log within the data directory. Since this opens the door to indefinite logfile bloat, recommend even more strongly that log output be redirected when using silent_mode. Move the postmaster's initial calls of load_hba() and load_ident() down to after we have started the log collector, if we are going to. This is so that errors reported by them will appear in the "usual" place. Reclassify silent_mode as a LOGGING_WHERE, not LOGGING_WHEN, parameter, since it's got absolutely nothing to do with the latter category. In passing, fix some obsolete references to -S ... this option hasn't had that switch letter for a long time. Back-patch to 8.4, since as of 8.4 load_hba() and load_ident() are more picky (and thus more likely to fail) than they used to be. This entire change was driven by a complaint about those errors disappearing into the bit bucket.
* Fix overflow for INTERVAL 'x ms' where x is more than a couple million,Tom Lane2009-08-18
| | | | | | | and integer datetimes are in use. Per bug report from Hubert Depesz Lubaczewski. Alex Hunsaker
* Fix time_part and timetz_part (ie, EXTRACT() for those datatypes) toTom Lane2009-07-29
| | | | | | | | | | | | | | | | include a fractional part in the output for MILLISECOND and SECOND cases, rather than truncating the source value. This is what the float-timestamp code has always done, and it was clearly the code author's intent to do the same for integer timestamps, but he forgot about integer division in C. The other datatypes supported by EXTRACT() already do this correctly. Backpatch to 8.4, so that the default (integer) behavior of that branch will match the default (float) behavior of older branches. Arguably we should patch further back, but it's possible that applications are expecting the broken behavior in older branches. 8.4 is new enough that expectations shouldn't be too settled. Per report from Greg Stark.
* Fix incorrect cleanup of tsquery in ts_rewrite(). Per bug #4933 byTeodor Sigaev2009-07-28
| | | | Aaron Marcuse-Kubitza <aaronmk@blackducksoftware.com>
* In a non-hashed Agg node, reset the "aggcontext" at group boundaries, insteadTom Lane2009-07-23
| | | | | | | | | | | of individually pfree'ing pass-by-reference transition values. This should be at least as fast as the prior coding, and it has the major advantage of clearing out any working data an aggregate function may have stored in or underneath the aggcontext. This avoids memory leakage when an aggregate such as array_agg() is used in GROUP BY mode. Per report from Chris Spotts. Back-patch to 8.4. In principle the problem could arise in prior versions, but since they didn't have array_agg the issue seems not critical.
* Do a conditional SPI_push/SPI_pop when replanning a query inTom Lane2009-07-14
| | | | | | | | | | | | | RevalidateCachedPlan. This is to avoid a "SPI_ERROR_CONNECT" failure when the planner calls a SPI-using function and we are already inside one. The alternative fix is to expect callers of RevalidateCachedPlan to do this, which seems likely to result in additional hard-to-detect bugs of omission. Per reports from Frank van Vugt and Marek Lewczuk. Back-patch to 8.3. It's much harder to trigger the bug in 8.3, due to a smaller set of cases in which plans can be invalidated, but it could happen. (I think perhaps only a SI reset event could make 8.3 fail here, but that's certainly within the realm of possibility.)
* Need to use pg_perm_setlocale when setting LC_CTYPE and LC_COLLATE at startup.Heikki Linnakangas2009-07-08
| | | | | | | | Otherwise, the LC_CTYPE/COLLATE setting gets reverted when using plperl, which leads to incorrect query results and index corruption. This was accidentally broken in the per-database locale patch in 8.4. Pointed out by Andrew Gierth.
* Fix ancient bug in handling of to_char modifier 'TH', when used with HH.Heikki Linnakangas2009-07-06
| | | | | In what seems like an oversight, we used to treat 'TH' the same as lowercase 'th', but only with HH/HH12.
* Add __attribute__((format_arg(1))) to the declaration of err_gettext(),Tom Lane2009-06-25
| | | | | to restore gcc's ability to crosscheck format arguments within elog.c. Noted in a test compilation with -Wformat-nonliteral enabled.
* Fix an ancient error in dist_ps (distance from point to line segment), whichTom Lane2009-06-23
| | | | | | | | | | | | a number of other geometric operators also depend on. It miscalculated the slope of the perpendicular to the given line segment anytime that slope was other than 0, infinite, or +/-1. In some cases the error would be masked because the true closest point on the line segment was one of its endpoints rather than the intersection point, but in other cases it could give an arbitrarily bad answer. Per bug #4872 from Nick Roosevelt. Bug goes clear back to Berkeley days, so patch all supported branches. Make a couple of cosmetic adjustments while at it.
* Make to_timestamp and friends skip leading spaces before an integer field,Tom Lane2009-06-22
| | | | | | | | | | | | | even when not in FM mode. This improves compatibility with Oracle and with our pre-8.4 behavior, as per bug #4862. Brendan Jurd Add a couple of regression test cases for this. In passing, get rid of the labeling of the individual test cases; doesn't seem to be good for anything except causing extra work when inserting a test... Tom Lane
* Revert dubious message wording change.Tom Lane2009-06-22
|
* Message fixesPeter Eisentraut2009-06-21
|
* Fix things so that array_agg_finalfn does not modify or free its inputTom Lane2009-06-20
| | | | | | | ArrayBuildState, per trouble report from Merlin Moncure. By adopting this fix, we are essentially deciding that aggregate final-functions should not modify their inputs ever. Adjust documentation and comments to match that conclusion.
* 8.4 pgindent run, with new combined Linux/FreeBSD/MinGW typedef listBruce Momjian2009-06-11
| | | | provided by Andrew.
* Fix cash_in() to behave properly in locales where frac_digits is zero,Tom Lane2009-06-10
| | | | | | | eg Japan. Report and fix by Itagaki Takahiro. Also fix CASHDEBUG printout format for branches with 64-bit money type, and some minor comment cleanup. Back-patch to 7.4, because it's broken all the way back.
* Make handling of INTERVAL DAY TO MINUTE and INTERVAL DAY TO SECOND inputTom Lane2009-06-10
| | | | | | | | | | | | more consistent with other cases, by having an unlabeled integer field be treated as a number of minutes or seconds respectively. These cases are outside the spec (which insists on full "dd hh:mm" or "dd hh:mm:ss" input respectively), so it's not much help to us in deciding what to do. But with this change, it's uniformly the case that an unlabeled integer will be considered as being a number of the interval's rightmost field. The change also takes us back to the 8.3 behavior of throwing error for certain ambiguous inputs such as INTERVAL '1 2' DAY TO MINUTE. Per recent discussion.
* Ensure xmlFree(NULL) is a no-op instead of a core dump. Per report fromTom Lane2009-06-10
| | | | | | | | | Sergey Burladyan, there are at least some dank corners of libxml2 that assume this behavior, even though their published documentation suggests they shouldn't. This is only really a live problem in 8.3, but the code is still there for possible debugging use in HEAD, so patch both branches.
* Fix xmlattribute escaping XML special characters twice (bug #4822).Peter Eisentraut2009-06-09
| | | | Author: Itagaki Takahiro <itagaki.takahiro@oss.ntt.co.jp>
* Switch order of tests to avoid possible Assert failure forTom Lane2009-06-09
| | | | | | "array_agg_finalfn(null)". We should modify pg_proc entries to prevent this query from being accepted, but let's just make the function itself secure too. Per my note of today.
* Fix failure to double-quote function argument names when needed, inTom Lane2009-06-09
| | | | | pg_get_function_arguments() and related functions. Per report from Andreas Nolte.
* Fix map_sql_table_to_xmlschema() with dropped attributes.Peter Eisentraut2009-06-08
| | | | also backpatched to 8.3
* Improve the recently-added support for properly pluralized error messagesTom Lane2009-06-04
| | | | | | | | | | by extending the ereport() API to cater for pluralization directly. This is better than the original method of calling ngettext outside the elog.c code because (1) it avoids double translation, which wastes cycles and in the worst case could give a wrong result; and (2) it avoids having to use a different coding method in PL code than in the core backend. The client-side uses of ngettext are not touched since neither of these concerns is very pressing in the client environment. Per my proposal of yesterday.
generated by cgit v1.2.3 (git 2.25.1) at 2025-08-07 21:03:42 +0000