aboutsummaryrefslogtreecommitdiff
path: root/src/backend/utils
Commit message (Collapse)AuthorAge
* Fix pg_wchar_table's maxmblen field of EUC_CN, EUC_TW, MULE_INTERNALTatsuo Ishii2007-03-26
| | | | and GB18030. patches from ITAGAKI Takahiro.
* Get pg_utf_mblen(), pg_utf2wchar_with_len(), and utf2ucs() all on the sameTom Lane2007-01-24
| | | | | | | | | | | | | | | | | | | | | page about the maximum UTF8 sequence length we support (4 bytes since 8.1, 3 before that). pg_utf2wchar_with_len never got updated to support 4-byte characters at all, and in any case had a buffer-overrun risk in that it could produce multiple pg_wchars from what mblen claims to be just one UTF8 character. The only reason we don't have a major security hole is that most callers allocate worst-case output buffers; the sole exception in released versions appears to be pre-8.2 iwchareq() (ie, ILIKE), which can be crashed due to zeroing out its return address --- but AFAICS that can't be exploited for anything more than a crash, due to inability to control what gets written there. Per report from James Russell and Michael Fuhr. Pre-8.1 the risk is much less, but I still think pg_utf2wchar_with_len's behavior given an incomplete final character risks buffer overrun, so back-patch that logic change anyway. This patch also makes sure that UTF8 sequences exceeding the supported length (whichever it is) are consistently treated as error cases, rather than being treated like a valid shorter sequence in some places.
* Fix regex_fixed_prefix() to cope reasonably well with regex patterns of theTom Lane2007-01-03
| | | | | | | | | | form '^(foo)$'. Before, these could never be optimized into indexscans. The recent changes to make psql and pg_dump generate such patterns (for \d commands and -t and related switches, respectively) therefore represented a big performance hit for people with large pg_class catalogs, as seen in recent gripe from Erik Jones. While at it, be more paranoid about case-sensitivity checking in multibyte encodings, and fix some other corner cases in which a regex might be interpreted too liberally.
* Fix string_to_array() to correctly handle the case where there areTom Lane2006-10-07
| | | | | | | | | | | overlapping possible matches for the separator string, such as string_to_array('123xx456xxx789', 'xx'). Also, revise the logic of replace(), split_part(), and string_to_array() to avoid O(N^2) work from redundant searches and conversions to pg_wchar format when there are N matches to the separator string. Backpatched the full patch as far as 8.0. 7.4 also has the bug, but the code has diverged a lot, so I just went for a quick-and-dirty fix of the bug itself in that branch.
* Fix SysCacheGetAttr() to handle the case where the specified syscache has notTom Lane2006-10-06
| | | | | | | | | | | been initialized yet. This can happen because there are code paths that call SysCacheGetAttr() on a tuple originally fetched from a different syscache (hopefully on the same catalog) than the one specified in the call. It doesn't seem useful or robust to try to prevent that from happening, so just improve the function to cope instead. Per bug#2678 from Jeff Trout. The specific example shown by Jeff is new in 8.1, but to be on the safe side I'm backpatching 8.0 as well. We could patch 7.x similarly but I think that's probably overkill, given the lack of evidence of old bugs of this ilk.
* Add a new GUC parameter backslash_quote, which determines whether the SQLTom Lane2006-05-21
| | | | | | | | | | | | | | | | | parser will allow "\'" to be used to represent a literal quote mark. The "\'" representation has been deprecated for some time in favor of the SQL-standard representation "''" (two single quote marks), but it has been used often enough that just disallowing it immediately won't do. Hence backslash_quote allows the settings "on", "off", and "safe_encoding", the last meaning to allow "\'" only if client_encoding is a valid server encoding. That is now the default, and the reason is that in encodings such as SJIS that allow 0x5c (ASCII backslash) to be the last byte of a multibyte character, accepting "\'" allows SQL-injection attacks as per CVE-2006-2314 (further details will be published after release). The "on" setting is available for backward compatibility, but it must not be used with clients that are exposed to untrusted input. Thanks to Akio Ishida and Yasuo Ohgaki for identifying this security issue.
* Change the backend to reject strings containing invalidly-encoded multibyteTom Lane2006-05-21
| | | | | | | | | | | | | | | | | | | | characters in all cases. Formerly we mostly just threw warnings for invalid input, and failed to detect it at all if no encoding conversion was required. The tighter check is needed to defend against SQL-injection attacks as per CVE-2006-2313 (further details will be published after release). Embedded zero (null) bytes will be rejected as well. The checks are applied during input to the backend (receipt from client or COPY IN), so it no longer seems necessary to check in textin() and related routines; any string arriving at those functions will already have been validated. Conversion failure reporting (for characters with no equivalent in the destination encoding) has been cleaned up and made consistent while at it. Also, fix a few longstanding errors in little-used encoding conversion routines: win1251_to_iso, win866_to_iso, euc_tw_to_big5, euc_tw_to_mic, mic_to_euc_tw were all broken to varying extents. Patches by Tatsuo Ishii and Tom Lane. Thanks to Akio Ishida and Yasuo Ohgaki for identifying the security issues.
* Change \' to '', for SQL standards compliance. Backpatch to 7.3, 7.4,Bruce Momjian2006-05-21
| | | | and 8.0. Later releases already patched.
* Fix similar_escape() so that SIMILAR TO works properly for patterns involvingTom Lane2006-04-13
| | | | | | | | | | | | | | alternatives ("|" symbol). The original coding allowed the added ^ and $ constraints to be absorbed into the first and last alternatives, producing a pattern that would match more than it should. Per report from Eric Noriega. I also changed the pattern to add an ARE director ("***:"), ensuring that SIMILAR TO patterns do not change behavior if regex_flavor is changed. This is necessary to make the non-capturing parentheses work, and seems like a good idea on general principles. Back-patched as far as 7.4. 7.3 also has the bug, but a fix seems impractical because that version's regex engine doesn't have non-capturing parens.
* Minor teak.Tatsuo Ishii2006-03-04
|
* Tighten up SJIS byte sequence check. Now we reject invalid SJIS byteTatsuo Ishii2006-03-04
| | | | sequence such as "0x95 0x27". Patches from Akio Ishida.
* Fix bug in SET SESSION AUTHORIZATION that allows unprivileged users to crashTom Lane2006-02-12
| | | | | the server, if it has been compiled with Asserts enabled (CVE-2006-0553). Thanks to Akio Ishida for reporting this problem.
* Change search for default operator classes so that it examines all opclassesTom Lane2006-02-10
| | | | | | | | | | regardless of the current schema search path. Since CREATE OPERATOR CLASS only allows one default opclass per datatype regardless of schemas, this should have minimal impact, and it fixes problems with failure to find a desired opclass while restoring dump files. Per discussion at http://archives.postgresql.org/pgsql-hackers/2006-02/msg00284.php. Remove now-redundant-or-unused code in typcache.c and namespace.c, and backpatch as far as 8.0.
* Reject out-of-range dates in date_in().Tom Lane2006-02-09
| | | | Kris Jurka
* Fix display of whole-row Var appearing at the top level of a SELECT list.Tom Lane2006-01-26
| | | | | | | | While we normally prefer the notation "foo.*" for a whole-row Var, that does not work at SELECT top level, because in that context the parser will assume that what is wanted is to expand the "*" into a list of separate target columns, yielding behavior different from a whole-row Var. We have to emit just "foo" instead in that context. Per report from Sokolov Yura.
* Avoid crashing if relcache flush occurs while trying to load data into anTom Lane2006-01-19
| | | | | | | | | | | | | | | index's support-function cache (in index_getprocinfo). Since none of that data can change for an index that's in active use, it seems sufficient to treat all open indexes the same way we were treating "nailed" system indexes --- that is, just re-read the pg_class row and leave the rest of the relcache entry strictly alone. The pg_class re-read might not be strictly necessary either, but since the reltablespace and relfilenode can change in normal operation it seems safest to do it. (We don't support changing any of the other info about an index at all, at the moment.) Back-patch as far as 8.0. It might be possible to adapt the patch to 7.4, but it would take more work than I care to expend for such a low-probability problem. 7.3 is out of luck for sure.
* Repair problems with the result of lookup_rowtype_tupdesc() possibly beingTom Lane2006-01-17
| | | | | | | discarded by cache flush while still in use. This is a minimal patch that just copies the tupdesc anywhere it could be needed across a flush. Applied to back branches only; Neil Conway is working on a better long-term solution for HEAD.
* Arrange to set the LC_XXX environment variables to match our locale setup.Tom Lane2006-01-05
| | | | Back-patch of previous fix in HEAD for plperl-vs-locale issue.
* Fix long standing Asian multibyte charsets bug.Tatsuo Ishii2005-12-24
| | | | | | | | | | | See: Subject: [HACKERS] bugs with certain Asian multibyte charsets From: Tatsuo Ishii <ishii@sraoss.co.jp> To: pgsql-hackers@postgresql.org Date: Sat, 24 Dec 2005 18:25:33 +0900 (JST) for more details.
* Adjust string comparison so that only bitwise-equal strings are consideredTom Lane2005-12-22
| | | | | | | | | | | | equal: if strcoll claims two strings are equal, check it with strcmp, and sort according to strcmp if not identical. This fixes inconsistent behavior under glibc's hu_HU locale, and probably under some other locales as well. Also, take advantage of the now-well-defined behavior to speed up texteq, textne, bpchareq, bpcharne: they may as well just do a bitwise comparison and not bother with strcoll at all. NOTE: affected databases may need to REINDEX indexes on text columns to be sure they are self-consistent.
* Fix bgwriter's failure to release buffer pins and open files after anTom Lane2005-12-08
| | | | | error. This probably explains bug #2099 and could also account for mysterious VACUUM hangups.
* Check for overflow in strtol() while parsing datetime inputs.Tom Lane2005-12-01
| | | | Michael Fuhr.
* Rearrange code in pg_atoi() to avoid assuming that isspace() cannotTom Lane2005-11-30
| | | | change errno. No reported bugs here, but why take a chance?
* Fix misspelling of 'listen_addresses', per Devrim.Tom Lane2005-11-09
|
* Repair an error introduced by log_line_prefix patch: it is not acceptableTom Lane2005-11-05
| | | | | | | | | | | to assume that the string pointer passed to set_ps_display is good forever. There's no need to anyway since ps_status.c itself saves the string, and we already had an API (get_ps_display) to return it. I believe this explains Jim Nasby's report of intermittent crashes in elog.c when %i format code is in use in log_line_prefix. While at it, repair a previously unnoticed problem: on some platforms such as Darwin, the string returned by get_ps_display was blank-padded to the maximum length, meaning that lock.c's attempt to append " waiting" to it never worked.
* Postpone pg_timezone_initialize() until after creation of postmaster.pid,Tom Lane2005-10-20
| | | | | | | since it can take a fair amount of time and this can confuse boot scripts that expect postmaster.pid to appear quickly. Move initialization of SSL library and preloaded libraries to after that point, too, just for luck. Per reports from Tony Caduto and others.
* Pass a strdup'd ident string to openlog(), to ensure that reallocationTom Lane2005-10-14
| | | | | of GUC memory doesn't cause us to start emitting a bogus ident string. Per report from Han Holl. Also some trivial code cleanup in write_syslog.
* Back-patch fixes for problems with VACUUM destroying t_ctid chains too soon,Tom Lane2005-08-25
| | | | | and with insufficient paranoia in code that follows t_ctid links. This patch covers the 8.0 branch.
* array_in() and array_recv() need to be more paranoid about validatingTom Lane2005-08-15
| | | | | | | | | their OID parameter. It was possible to crash the backend with select array_in('{123}',0,0); because that would bypass the needed step of initializing the workspace. These seem to be the only two places with a problem, though (record_in and record_recv don't have the issue, and the other array functions aren't depending on user-supplied input). Back-patch as far as 7.4; 7.3 does not have the bug.
* This patch fixes the event type used to log output from theBruce Momjian2005-08-12
| | | | | | | | | | | | stderr-in-service or output-from-syslogger-in-service code. Previously everything was flagged as ERRORs there, which caused all instances to log "LOG: logger shutting down" as error... Please apply for 8.1. I'd also like it considered for 8.0 since logging non-errors as errors can be cause for alarm amongst people who actually look at their logs... Magnus Hagander
* Check for out-of-range varoattno in deparse_context_for_subplan.Tom Lane2005-07-15
| | | | | | | I have seen this case in CVS tip due to new "physical tlist" optimization for subqueries. I believe it probably can't happen in existing releases, but the check is not going to hurt anything, so backpatch to 8.0 just in case.
* Fix config file lexer to not barf if postgresql.conf ends with a commentTom Lane2005-07-08
| | | | that has no terminating newline. Per report from maps.on at gmx.net.
* Fix date_trunct for December dates that are in the next year, e.g.:Bruce Momjian2005-07-04
| | | | | | | | SELECT date_trunc('week', '2002-12-31'::date); Backpatch to 8.0.X. Per report from Nick Johnson.
* When using C-string lookup keys in a dynahash.c hash table, use strncpy()Tom Lane2005-06-18
| | | | | | not memcpy() to copy the offered key into the hash table during HASH_ENTER. This avoids possible core dump if the passed key is located very near the end of memory. Per report from Stefan Kaltenbrunner.
* Fix bug in MIC -> EUC_JP conversion. Per Atsushi Ogawa.Tatsuo Ishii2005-06-11
|
* patternsel() was improperly stripping RelabelType from the derivedTom Lane2005-06-01
| | | | | | expressions it constructed, causing scalarineqsel to become confused if the underlying variable was of a domain type. Per report from Kevin Grittner.
* Adjust datetime parsing to be more robust. We now pass the length of theNeil Conway2005-05-26
| | | | | | | | | | | | | | | working buffer into ParseDateTime() and reject too-long input there, rather than checking the length of the input string before calling ParseDateTime(). The old method was bogus because ParseDateTime() can use a variable amount of working space, depending on the content of the input string (e.g. how many fields need to be NUL terminated). This fixes a minor stack overrun -- I don't _think_ it's exploitable, although I won't claim to be an expert. Along the way, fix a bug reported by Mark Dilger: the working buffer allocated by interval_in() was too short, which resulted in rejecting some perfectly valid interval input values. I added a regression test for this fix.
* Adjust time qual checking code so that we always check TransactionIdIsInProgressTom Lane2005-05-07
| | | | | | | before we check commit/abort status. Formerly this was done in some paths but not all, with the result that a transaction might be considered committed for some purposes before it became committed for others. Per example found by Jan Wieck.
* Make standalone backends ignore pg_database.datallowconn, so that thereTom Lane2005-05-05
| | | | is a way to recover from disabling connections to all databases at once.
* Alter the signature for encoding conversion functions to declare theTom Lane2005-05-03
| | | | | | output area as INTERNAL not CSTRING. This is to prevent people from calling the functions by hand. This is a permanent solution for the back branches but I hope it is just a stopgap for HEAD.
* Make record_out and record_send extract type information from the passedTom Lane2005-04-30
| | | | | | | record object itself, rather than relying on a second OID argument to be correct. This patch just changes the function behavior and not the catalogs, so it's OK to back-patch to 8.0. Will remove the now-redundant second argument in pg_proc in a separate patch in HEAD only.
* GCC 4.0 includes a new warning option, -Wformat-literal, that emitsNeil Conway2005-04-30
| | | | | | | | | | | | | | | a warning when a variable is used as a format string for printf() and similar functions (if the variable is derived from untrusted data, it could include unexpected formatting sequences). This emits too many warnings to be enabled by default, but it does flag a few dubious constructs in the Postgres tree. This patch fixes up the obvious variants: functions that are passed a variable format string but no additional arguments. Most of these are harmless (e.g. the ruleutils stuff), but there is at least one actual bug here: if you create a trigger named "%sfoo", pg_dump will read uninitialized memory and fail to dump the trigger correctly.
* Repair two TIME WITH TIME ZONE bugs found by Dennis Vshivkov. ComparisonTom Lane2005-04-23
| | | | | | | of timetz values misbehaved in --enable-integer-datetime cases, and EXTRACT(EPOCH) subtracted the zone instead of adding it in all cases. Backpatch to all supported releases (except --enable-integer-datetime code does not exist in 7.2).
* Fix mis-display of negative fractional seconds in interval values forTom Lane2005-04-20
| | | | --enable-integer-datetimes case. Per report from Oliver Siegmar.
* record_in and record_recv must be careful to return a separatelyTom Lane2005-04-18
| | | | | pfree'able result, since some callers expect to be able to pfree the result of a pass-by-reference function. Per report from Chris Trawick.
* Fix interaction between materializing holdable cursors and firingTom Lane2005-04-11
| | | | | | deferred triggers: either one can create more work for the other, so we have to loop till it's all gone. Per example from andrew@supernews. Add a regression test to help spot trouble in this area in future.
* Second try at making examine_variable and friends behave sanely inTom Lane2005-04-01
| | | | | | | cases with binary-compatible relabeling. My first try was implicitly assuming that all operators scalarineqsel is used for have binary- compatible datatypes on both sides ... which is very wrong of course. Per report from Michael Fuhr.
* Fix wrong week returnded by date_trunc('week') for early dates inBruce Momjian2005-04-01
| | | | | | | | January --- would return wrong year for 2005-01-01 and 2006-01-01. per report from Robert Creager. Backpatch to 8.0.X.
* Fix a pair of related issues with estimation of inequalities that involveTom Lane2005-03-26
| | | | | | | | binary-compatible relabeling of one or both operands. examine_variable should avoid stripping RelabelType from non-variable expressions, so that they will continue to have the correct type; and convert_to_scalar should just use that type and ignore the other input type. This isn't perfect but it beats failing entirely. Per example from Michael Fuhr.
* Prevent to_char(interval) from dumping core on month-related formatsTom Lane2005-03-26
| | | | | | when a zero-month interval is given. Per discussion with Karel. Also, some desultory const-labeling of constant tables. More could be done along that line.
generated by cgit v1.2.3 (git 2.25.1) at 2025-07-15 07:41:31 +0000