aboutsummaryrefslogtreecommitdiff
path: root/src/backend/utils
Commit message (Collapse)AuthorAge
* Fix potential access-off-the-end-of-memory in varbit_out(): it fetched theTom Lane2007-08-21
| | | | | | byte after the last full byte of the bit array, regardless of whether that byte was part of the valid data or not. Found by buildfarm testing. Thanks to Stefan Kaltenbrunner for nailing down the cause.
* Fix a memory leak in tuplestore_end(). Unlikely to be significant duringNeil Conway2007-08-02
| | | | normal operation, but tuplestore_end() ought to do what it claims to do.
* Fix security definer functions with polymorphic arguments. This case hasTom Lane2007-07-31
| | | | | never worked because fmgr_security_definer() neglected to pass the fn_expr information through. Per report from Viatcheslav Kalinin.
* Fix elog.c to avoid infinite recursion (leading to backend crash) whenTom Lane2007-07-21
| | | | | | | | | | log_min_error_statement is active and there is some problem in logging the current query string; for example, that it's too long to include in the log message without running out of memory. This problem has existed since the log_min_error_statement feature was introduced. No doubt the reason it wasn't detected long ago is that 8.2 is the first release that defaults log_min_error_statement to less than PANIC level. Per report from Bill Moran.
* Make replace(), split_part(), and string_to_array() behave somewhat sanelyTom Lane2007-07-19
| | | | | | | | | when handed an invalidly-encoded pattern. The previous coding could get into an infinite loop if pg_mb2wchar_with_len() returned a zero-length string after we'd tested for nonempty pattern; which is exactly what it will do if the string consists only of an incomplete multibyte character. This led to either an out-of-memory error or a backend crash depending on platform. Per report from Wiktor Wodecki.
* Fix a passel of ancient bugs in to_char(), including two distinct bufferTom Lane2007-06-29
| | | | | | | | | | | overruns (neither of which seem likely to be exploitable as security holes, fortunately, since the provoker can't control the data written). One of these is due to choosing to stomp on the output of a called function, which is bad news in any case; make it treat the called functions' results as read-only. Avoid some unnecessary palloc/pfree traffic too; it's not really helpful to free small temporary objects, and again this is presuming more than it ought to about the nature of the results of called functions. Per report from Patrick Welche and additional code-reading by Imad.
* Fix erroneous error reporting for overlength input in text_date(),Tom Lane2007-06-02
| | | | text_time(), and text_timetz(). 7.4-vintage bug found by Greg Stark.
* Fix dynahash.c to suppress hash bucket splits while a hash_seq_search() scanTom Lane2007-04-26
| | | | | | | | | | | | | | | | | | | | | | | is in progress on the same hashtable. This seems the least invasive way to fix the recently-recognized problem that a split could cause the scan to visit entries twice or (with much lower probability) miss them entirely. The only field-reported problem caused by this is the "failed to re-find shared lock object" PANIC in COMMIT PREPARED reported by Michel Dorochevsky, which was caused by multiply visited entries. However, it seems certain that mdsync() is vulnerable to missing required fsync's due to missed entries, and I am fearful that RelationCacheInitializePhase2() might be at risk as well. Because of that and the generalized hazard presented by this bug, back-patch all the supported branches. Along the way, fix pg_prepared_statement() and pg_cursor() to not assume that the hashtables they are examining will stay static between calls. This is risky regardless of the newly noted dynahash problem, because hash_seq_search() has never promised to cope with deletion of table entries other than the just-returned one. There may be no bug here because the only supported way to call these functions is via ExecMakeTableFunctionResult() which will cycle them to completion before doing anything very interesting, but it seems best to get rid of the assumption. This affects 8.2 and HEAD only, since those functions weren't there earlier.
* Fix pg_wchar_table's maxmblen field of EUC_CN, EUC_TW, MULE_INTERNALTatsuo Ishii2007-03-26
| | | | and GB18030. patches from ITAGAKI Takahiro.
* Get pg_utf_mblen(), pg_utf2wchar_with_len(), and utf2ucs() all on the sameTom Lane2007-01-24
| | | | | | | | | | | | | | | | | | | | | page about the maximum UTF8 sequence length we support (4 bytes since 8.1, 3 before that). pg_utf2wchar_with_len never got updated to support 4-byte characters at all, and in any case had a buffer-overrun risk in that it could produce multiple pg_wchars from what mblen claims to be just one UTF8 character. The only reason we don't have a major security hole is that most callers allocate worst-case output buffers; the sole exception in released versions appears to be pre-8.2 iwchareq() (ie, ILIKE), which can be crashed due to zeroing out its return address --- but AFAICS that can't be exploited for anything more than a crash, due to inability to control what gets written there. Per report from James Russell and Michael Fuhr. Pre-8.1 the risk is much less, but I still think pg_utf2wchar_with_len's behavior given an incomplete final character risks buffer overrun, so back-patch that logic change anyway. This patch also makes sure that UTF8 sequences exceeding the supported length (whichever it is) are consistently treated as error cases, rather than being treated like a valid shorter sequence in some places.
* Fix regex_fixed_prefix() to cope reasonably well with regex patterns of theTom Lane2007-01-03
| | | | | | | | | | form '^(foo)$'. Before, these could never be optimized into indexscans. The recent changes to make psql and pg_dump generate such patterns (for \d commands and -t and related switches, respectively) therefore represented a big performance hit for people with large pg_class catalogs, as seen in recent gripe from Erik Jones. While at it, be more paranoid about case-sensitivity checking in multibyte encodings, and fix some other corner cases in which a regex might be interpreted too liberally.
* Fix string_to_array() to correctly handle the case where there areTom Lane2006-10-07
| | | | | | | | | | | overlapping possible matches for the separator string, such as string_to_array('123xx456xxx789', 'xx'). Also, revise the logic of replace(), split_part(), and string_to_array() to avoid O(N^2) work from redundant searches and conversions to pg_wchar format when there are N matches to the separator string. Backpatched the full patch as far as 8.0. 7.4 also has the bug, but the code has diverged a lot, so I just went for a quick-and-dirty fix of the bug itself in that branch.
* Add a new GUC parameter backslash_quote, which determines whether the SQLTom Lane2006-05-21
| | | | | | | | | | | | | | | | | parser will allow "\'" to be used to represent a literal quote mark. The "\'" representation has been deprecated for some time in favor of the SQL-standard representation "''" (two single quote marks), but it has been used often enough that just disallowing it immediately won't do. Hence backslash_quote allows the settings "on", "off", and "safe_encoding", the last meaning to allow "\'" only if client_encoding is a valid server encoding. That is now the default, and the reason is that in encodings such as SJIS that allow 0x5c (ASCII backslash) to be the last byte of a multibyte character, accepting "\'" allows SQL-injection attacks as per CVE-2006-2314 (further details will be published after release). The "on" setting is available for backward compatibility, but it must not be used with clients that are exposed to untrusted input. Thanks to Akio Ishida and Yasuo Ohgaki for identifying this security issue.
* Change the backend to reject strings containing invalidly-encoded multibyteTom Lane2006-05-21
| | | | | | | | | | | | | | | | | | | | characters in all cases. Formerly we mostly just threw warnings for invalid input, and failed to detect it at all if no encoding conversion was required. The tighter check is needed to defend against SQL-injection attacks as per CVE-2006-2313 (further details will be published after release). Embedded zero (null) bytes will be rejected as well. The checks are applied during input to the backend (receipt from client or COPY IN), so it no longer seems necessary to check in textin() and related routines; any string arriving at those functions will already have been validated. Conversion failure reporting (for characters with no equivalent in the destination encoding) has been cleaned up and made consistent while at it. Also, fix a few longstanding errors in little-used encoding conversion routines: win1251_to_iso, win866_to_iso, euc_tw_to_big5, euc_tw_to_mic, mic_to_euc_tw were all broken to varying extents. Patches by Tatsuo Ishii and Tom Lane. Thanks to Akio Ishida and Yasuo Ohgaki for identifying the security issues.
* Change \' to '', for SQL standards compliance. Backpatch to 7.3, 7.4,Bruce Momjian2006-05-21
| | | | and 8.0. Later releases already patched.
* Fix similar_escape() so that SIMILAR TO works properly for patterns involvingTom Lane2006-04-13
| | | | | | | | | | | | | | alternatives ("|" symbol). The original coding allowed the added ^ and $ constraints to be absorbed into the first and last alternatives, producing a pattern that would match more than it should. Per report from Eric Noriega. I also changed the pattern to add an ARE director ("***:"), ensuring that SIMILAR TO patterns do not change behavior if regex_flavor is changed. This is necessary to make the non-capturing parentheses work, and seems like a good idea on general principles. Back-patched as far as 7.4. 7.3 also has the bug, but a fix seems impractical because that version's regex engine doesn't have non-capturing parens.
* Tighten up SJIS byte sequence check. Now we reject invalid SJIS byteTatsuo Ishii2006-03-04
| | | | sequence such as "0x95 0x27". Patches from Akio Ishida.
* Fix bug in SET SESSION AUTHORIZATION that allows unprivileged users to crashTom Lane2006-02-12
| | | | | the server, if it has been compiled with Asserts enabled (CVE-2006-0553). Thanks to Akio Ishida for reporting this problem.
* Arrange to set the LC_XXX environment variables to match our locale setup.Tom Lane2006-01-05
| | | | Back-patch of previous fix in HEAD for plperl-vs-locale issue.
* Fix long standing Asian multibyte charsets bug.Tatsuo Ishii2005-12-24
| | | | | | | | | | | See: Subject: [HACKERS] bugs with certain Asian multibyte charsets From: Tatsuo Ishii <ishii@sraoss.co.jp> To: pgsql-hackers@postgresql.org Date: Sat, 24 Dec 2005 18:25:33 +0900 (JST) for more details.
* Adjust string comparison so that only bitwise-equal strings are consideredTom Lane2005-12-22
| | | | | | | | | | | | equal: if strcoll claims two strings are equal, check it with strcmp, and sort according to strcmp if not identical. This fixes inconsistent behavior under glibc's hu_HU locale, and probably under some other locales as well. Also, take advantage of the now-well-defined behavior to speed up texteq, textne, bpchareq, bpcharne: they may as well just do a bitwise comparison and not bother with strcoll at all. NOTE: affected databases may need to REINDEX indexes on text columns to be sure they are self-consistent.
* Check for overflow in strtol() while parsing datetime inputs.Tom Lane2005-12-01
| | | | Michael Fuhr.
* Don't convert debug/notice/warning messages into errors just becauseTom Lane2005-10-20
| | | | | | | they occur inside error processing. This is a back-port of a logic change already present in 8.0. Partial fix for bug#1976 --- doesn't cure the wrong-encoding problem, but at least stops it from causing unintended ERRORs.
* Pass a strdup'd ident string to openlog(), to ensure that reallocationTom Lane2005-10-14
| | | | | of GUC memory doesn't cause us to start emitting a bogus ident string. Per report from Han Holl. Also some trivial code cleanup in write_syslog.
* Back-patch fixes for problems with VACUUM destroying t_ctid chains too soon,Tom Lane2005-08-25
| | | | | and with insufficient paranoia in code that follows t_ctid links. This patch covers the 7.4 branch.
* array_in() and array_recv() need to be more paranoid about validatingTom Lane2005-08-15
| | | | | | | | | their OID parameter. It was possible to crash the backend with select array_in('{123}',0,0); because that would bypass the needed step of initializing the workspace. These seem to be the only two places with a problem, though (record_in and record_recv don't have the issue, and the other array functions aren't depending on user-supplied input). Back-patch as far as 7.4; 7.3 does not have the bug.
* When using C-string lookup keys in a dynahash.c hash table, use strncpy()Tom Lane2005-06-18
| | | | | | not memcpy() to copy the offered key into the hash table during HASH_ENTER. This avoids possible core dump if the passed key is located very near the end of memory. Per report from Stefan Kaltenbrunner.
* Fix bug in MIC -> EUC_JP conversion. Per Atsushi Ogawa.Tatsuo Ishii2005-06-11
|
* Adjust datetime parsing to be more robust. We now pass the length of theNeil Conway2005-05-26
| | | | | | | | | | | | | | | working buffer into ParseDateTime() and reject too-long input there, rather than checking the length of the input string before calling ParseDateTime(). The old method was bogus because ParseDateTime() can use a variable amount of working space, depending on the content of the input string (e.g. how many fields need to be NUL terminated). This fixes a minor stack overrun -- I don't _think_ it's exploitable, although I won't claim to be an expert. Along the way, fix a bug reported by Mark Dilger: the working buffer allocated by interval_in() was too short, which resulted in rejecting some perfectly valid interval input values. I added a regression test for this fix.
* Adjust time qual checking code so that we always check TransactionIdIsInProgressTom Lane2005-05-07
| | | | | | | before we check commit/abort status. Formerly this was done in some paths but not all, with the result that a transaction might be considered committed for some purposes before it became committed for others. Per example found by Jan Wieck.
* Make standalone backends ignore pg_database.datallowconn, so that thereTom Lane2005-05-05
| | | | is a way to recover from disabling connections to all databases at once.
* Alter the signature for encoding conversion functions to declare theTom Lane2005-05-03
| | | | | | output area as INTERNAL not CSTRING. This is to prevent people from calling the functions by hand. This is a permanent solution for the back branches but I hope it is just a stopgap for HEAD.
* GCC 4.0 includes a new warning option, -Wformat-literal, that emitsNeil Conway2005-04-30
| | | | | | | | | | | | | | | a warning when a variable is used as a format string for printf() and similar functions (if the variable is derived from untrusted data, it could include unexpected formatting sequences). This emits too many warnings to be enabled by default, but it does flag a few dubious constructs in the Postgres tree. This patch fixes up the obvious variants: functions that are passed a variable format string but no additional arguments. Most of these are harmless (e.g. the ruleutils stuff), but there is at least one actual bug here: if you create a trigger named "%sfoo", pg_dump will read uninitialized memory and fail to dump the trigger correctly.
* Repair two TIME WITH TIME ZONE bugs found by Dennis Vshivkov. ComparisonTom Lane2005-04-23
| | | | | | | of timetz values misbehaved in --enable-integer-datetime cases, and EXTRACT(EPOCH) subtracted the zone instead of adding it in all cases. Backpatch to all supported releases (except --enable-integer-datetime code does not exist in 7.2).
* Fix mis-display of negative fractional seconds in interval values forTom Lane2005-04-20
| | | | --enable-integer-datetimes case. Per report from Oliver Siegmar.
* Prevent to_char(interval) from dumping core on month-related formatsTom Lane2005-03-26
| | | | when a zero-month interval is given. Per discussion with Karel.
* array_map can't use the fn_extra field of the provided fcinfo struct asTom Lane2005-03-24
| | | | | its private storage, because that belongs to the function that it is supposed to call. Per report from Ezequiel Tolnay.
* interval_out failed to mention 'ago' for negative intervals in SQL andTom Lane2005-01-11
| | | | GERMAN datestyles. Ancient bug reported by Terry Lee Tucker.
* Make array_cat more paranoid about checking datatypes in empty arrays.Tom Lane2004-12-17
|
* array_map failed to insert correct result type in an empty array.Tom Lane2004-12-17
| | | | Per example from Florian Pflug.
* Avoid generating excess (and illegal) parentheses around an aliased JOINTom Lane2004-12-13
| | | | in prettyprint mode. Andreas Pflug
* Teach regex_fixed_prefix() the correct handling of advanced regexTom Lane2004-12-02
| | | | | | escapes --- they aren't simply quoted characters. Problem noted by Antti Salmela. Also fix problem with incorrect handling of multibyte characters when followed by a quantifier.
* Fix timestamptz_age() to do calculation in local timezone not GMT, per bug 1332.Tom Lane2004-12-01
|
* Our interface code for Spencer's regexp package was checking for regexpTom Lane2004-11-24
| | | | | | | error conditions during regexp compile, but not during regexp execution; any sort of "can't happen" errors would be treated as no-match instead of being reported as they should be. Noticed while trying to duplicate a reported Tcl bug.
* Repair possible failure to update hint bits back to disk, perTom Lane2004-10-13
| | | | | | http://archives.postgresql.org/pgsql-hackers/2004-10/msg00464.php. I plan a more permanent fix in HEAD, but for the back branches it seems best to just touch the places that actually have a problem.
* Convert pg_stat_get_backend_idset to use the existing SRF support.Tom Lane2004-10-01
| | | | | | This seems the cleanest way of fixing its lack of a shutdown callback, which was preventing it from working correctly in a query that didn't run it to completion. Per bug report from Szima GÄbor.
* Avoid crashing when restoring a saved GUC session_authorization valueTom Lane2004-08-11
| | | | that refers to a now-deleted userid. Per gripe from Chris Ochs.
* Fix broken logic for pretty-printing parenthesis-suppression in UNIONTom Lane2004-07-06
| | | | et al.
* Suppress compile warnings on machines where the INT64CONST() decorationTom Lane2004-06-13
| | | | is actually needed. Backport of Oliver Elphick's recent patch.
* Add missing check for too-few-inputs when replacing a zero-dimensionalTom Lane2004-06-08
| | | | array.
generated by cgit v1.2.3 (git 2.25.1) at 2025-07-23 15:30:18 +0000