aboutsummaryrefslogtreecommitdiff
path: root/src
Commit message (Collapse)AuthorAge
...
* Fix race condition in win32 signal handling.Magnus Hagander2010-01-31
| | | | | | | | | | | | There was a race condition where the receiving pipe could be closed by the child thread if the main thread was pre-empted before it got a chance to create a new one, and the dispatch thread ran to completion during that time. One symptom of this is that rows in pg_listener could be dropped under heavy load. Analysis and original patch by Radu Ilie, with some small modifications by Magnus Hagander.
* Avoid performing encoding conversion on command tag strings during EndCommand.Tom Lane2010-01-30
| | | | | | | | | | | | | Since all current and foreseeable future command tags will be pure ASCII, there is no need to do conversion on them. This saves a few cycles and also avoids polluting otherwise-pristine subtransaction memory contexts, which is the cause of the backend memory leak exhibited in bug #5302. (Someday we'll probably want to have a better method of determining whether subtransaction contexts need to be kept around, but today is not that day.) Backpatch to 8.0. The cycle-shaving aspect of this would work in 7.4 too, but without subtransactions the memory-leak aspect doesn't apply, so it doesn't seem worth touching 7.4.
* Fix memory leakage introduced into print_aligned_text by 8.4 changesTom Lane2010-01-30
| | | | | | | (failure to free col_lineptrs[] array elements) and exacerbated in the current devel cycle (failure to free "wrap"). This resulted in moderate bloat of psql over long script runs. Noted while testing bug #5302, although what the reporter was complaining of was backend-side leakage.
* Apply Tcl_Init() to the "hold" interpreter created by pltcl.Tom Lane2010-01-25
| | | | | | | | | | | | | | | | | | | | | | | You might think this is unnecessary since that interpreter is never used to run code --- but it turns out that's wrong. As of Tcl 8.5, the "clock" command (alone among builtin Tcl commands) is partially implemented by loaded-on-demand Tcl code, which means that it fails if there's not unknown-command support, and also that it's impossible to run it directly in a safe interpreter. The way they get around the latter is that Tcl_CreateSlave() automatically sets up an alias command that forwards any execution of "clock" in a safe slave interpreter to its parent interpreter. Thus, when attempting to execute "clock" in trusted pltcl, the command actually executes in the "hold" interpreter, where it will fail if unknown-command support hasn't been introduced by sourcing the standard init.tcl script, which is done by Tcl_Init(). (This is a pretty dubious design decision on the Tcl boys' part, if you ask me ... but they didn't.) Back-patch all the way. It's not clear that anyone would try to use ancient versions of pltcl with a recent Tcl, but it's not clear they wouldn't, either. Also add a regression test using "clock", in branches that have regression test support for pltcl. Per recent trouble report from Kyle Bateman.
* Fix assorted core dumps and Assert failures that could occur duringTom Lane2010-01-24
| | | | | | | | | | | | | | AbortTransaction or AbortSubTransaction, when trying to clean up after an error that prevented (sub)transaction start from completing: * access to TopTransactionResourceOwner that might not exist * assert failure in AtEOXact_GUC, if AtStart_GUC not called yet * assert failure or core dump in AfterTriggerEndSubXact, if AfterTriggerBeginSubXact not called yet Per testing by injecting elog(ERROR) at successive steps in StartTransaction and StartSubTransaction. It's not clear whether all of these cases could really occur in the field, but at least one of them is easily exposed by simple stress testing, as per my accidental discovery yesterday.
* Insert CHECK_FOR_INTERRUPTS calls into loops in dbsize.c, to ensure thatTom Lane2010-01-23
| | | | | | the various disk-size-reporting functions will respond to query cancel reasonably promptly even in very large databases. Per report from Kevin Grittner.
* Well, the systemtap guys moved the goalposts again: with the latest version,Tom Lane2010-01-20
| | | | | | we *must* generate probes.o or the dtrace probes don't work. Revert our workaround for their previous bug. Details at https://bugzilla.redhat.com/show_bug.cgi?id=557266
* When doing a parallel restore, we must guard against out-of-range dependencyTom Lane2010-01-19
| | | | | | | | | | | | | | | | dump IDs, because the array we're using is sized according to the highest dump ID actually defined in the archive file. In a partial dump there could be references to higher dump IDs that weren't dumped. Treat these the same as references to in-range IDs that weren't dumped. (The whole thing is a bit scary because the missing objects might have been part of dependency chains, which we won't know about. Not much we can do though --- throwing an error is probably overreaction.) Also, reject parallel restore with pre-1.8 archive version (made by pre-8.0 pg_dump). In these old versions the dependency entries are OIDs, not dump IDs, and we don't have enough information to interpret them. Per bug #5288 from Jon Erdman.
* Fix an oversight in convert_EXISTS_sublink_to_join: we can't convert anTom Lane2010-01-18
| | | | | | EXISTS that contains a WITH clause. This would usually lead to a "could not find CTE" error later in planning, because the WITH wouldn't get processed at all. Noted while playing with an example from Ken Marshall.
* Fix incorrect comparison of scan key in GIN. Per report fromTeodor Sigaev2010-01-18
| | | | Vyacheslav Kalinin <vka@mgcp.com>
* Fix portalmem.c to avoid keeping a dangling pointer to a cached plan listTom Lane2010-01-18
| | | | | | | after it's released its reference count for the cached plan. There are code paths that might try to examine the plan list before noticing that the portal is already in aborted state. Report and diagnosis by Tatsuo Ishii, though this isn't exactly his proposed patch.
* When loading critical system indexes into the relcache, ensure we lock theTom Lane2010-01-13
| | | | | | | | | | | | | underlying catalog not only the index itself. Otherwise, if the cache load process touches the catalog (which will happen for many though not all of these indexes), we are locking index before parent table, which can result in a deadlock against processes that are trying to lock them in the normal order. Per today's failure on buildfarm member gothic_moth; it's surprising the problem hadn't been identified before. Back-patch to 8.2. Earlier releases didn't have the issue because they didn't try to lock these indexes during load (instead assuming that they couldn't change schema at all during multiuser operation).
* Fix bug #5269: ResetPlanCache mustn't invalidate cached utility statements,Tom Lane2010-01-13
| | | | | | | | | | especially not ROLLBACK. ROLLBACK might need to be executed in an already aborted transaction, when there is no safe way to revalidate the plan. But in general there's no point in marking utility statements invalid, since they have no plans in the normal sense of the word; so we might as well work a bit harder here to avoid future revalidation cycles. Back-patch to 8.4, where the bug was introduced.
* Fix relcache reload mechanism to be more robust in the face of errorsTom Lane2010-01-12
| | | | | | | | | | | | | | | | | | | | occurring during a reload, such as query-cancel. Instead of zeroing out an existing relcache entry and rebuilding it in place, build a new relcache entry, then swap its contents with the old one, then free the new entry. This avoids problems with code believing that a previously obtained pointer to a cache entry must still reference a valid entry, as seen in recent failures on buildfarm member jaguar. (jaguar is using CLOBBER_CACHE_ALWAYS which raises the probability of failure substantially, but the problem could occur in the field without that.) The previous design was okay when it was made, but subtransactions and the ResourceOwner mechanism make it unsafe now. Also, make more use of the already existing rd_isvalid flag, so that we remember that the entry requires rebuilding even if the first attempt fails. Back-patch as far as 8.2. Prior versions have enough issues around relcache reload anyway (due to inadequate locking) that fixing this one doesn't seem worthwhile.
* Improve ExecEvalVar's handling of whole-row variables in cases where theTom Lane2010-01-11
| | | | | | | | | | | | | | | | | rowtype contains dropped columns. Sometimes the input tuple will be formed from a select targetlist in which dropped columns are filled with a NULL of an arbitrary type (the planner typically uses INT4, since it can't tell what type the dropped column really was). So we need to relax the rowtype compatibility check to not insist on physical compatibility if the actual column value is NULL. In principle we might need to do this for functions returning composite types, too (see tupledesc_match()). In practice there doesn't seem to be a bug there, probably because the function will be using the same cached rowtype descriptor as the caller. Fixing that code path would require significant rearrangement, so I left it alone for now. Per complaint from Filip Rembialkowski.
* Backported fix for protecting ecpg against applications freeing strings to 8.4.Michael Meskes2010-01-08
|
* Make bit/varbit substring() treat any negative length as meaning "all the restTom Lane2010-01-07
| | | | | | | | | | | of the string". The previous coding treated only -1 that way, and would produce an invalid result value for other negative values. We ought to fix it so that 2-parameter bit substring() is a different C function and the 3-parameter form throws error for negative length, but that takes a pg_proc change which is impractical in the back branches; and in any case somebody might be relying on -1 working this way. So just do this as a back-patchable fix.
* Alter the configure script to fail immediately if the C compiler does notTom Lane2010-01-07
| | | | | | | | | | | | | | provide a working 64-bit integer datatype. As recently noted, we've been broken on such platforms since early in the 8.4 development cycle. Since it took nearly two years for anyone to even notice, it seems that the rationale for continuing to support such platforms has reached the point of non-existence. Rather than thrashing around to try to make it work again, we'll just admit up front that this no longer works. Back-patch to 8.4 since that branch is also broken. We should go around to remove INT64_IS_BUSTED support, but just in HEAD, so that seems like material for a separate commit.
* Add support for doing FULL JOIN ON FALSE. While this is really a ratherTom Lane2010-01-05
| | | | | | | | | | peculiar variant of UNION ALL, and so wouldn't likely get written directly as-is, it's possible for it to arise as a result of simplification of less-obviously-silly queries. In particular, now that we can do flattening of subqueries that have constant outputs and are underneath an outer join, it's possible for the case to result from simplification of queries of the type exhibited in bug #5263. Back-patch to 8.4 to avoid a functionality regression for this type of query.
* Make the win32 putenv() override update *all* present versions of theMagnus Hagander2010-01-01
| | | | | | | | MSVCRxx runtime, not just the current + Visual Studio 6 (MSVCRT). Clearly there can be an almost unlimited number of runtimes loaded at the same time. Per report from Hiroshi Inoue
* Reset minRecoveryPoint at checkpoints, so that we don't uselessly updateHeikki Linnakangas2009-12-30
| | | | | | it in the control file at crash recovery following an archive recovery. Per Fujii Masao and subsequent discussion.
* Set errno to zero before invoking SSL_read or SSL_write. It appears thatTom Lane2009-12-30
| | | | | | | | | | | at least in some Windows versions, these functions are capable of returning a failure indication without setting errno. That puts us into an infinite loop if the previous value happened to be EINTR. Per report from Brendan Hill. Back-patch to 8.2. We could take it further back, but since this is only known to be an issue on Windows and we don't support Windows before 8.2, it does not seem worth the trouble.
* Previous fix for temporary file management broke returning a set fromHeikki Linnakangas2009-12-29
| | | | | | | | | | | | | | PL/pgSQL function within an exception handler. Make sure we use the right resource owner when we create the tuplestore to hold returned tuples. Simplify tuplestore API so that the caller doesn't need to be in the right memory context when calling tuplestore_put* functions. tuplestore.c automatically switches to the memory context used when the tuplestore was created. Tuplesort was already modified like this earlier. This patch also removes the now useless MemoryContextSwitch calls from callers. Report by Aleksei on pgsql-bugs on Dec 22 2009. Backpatch to 8.1, like the previous patch that broke this.
* Fix wrong WAL info value generated when gistContinueInsert() performs anTom Lane2009-12-24
| | | | | | | | index page split. This would result in index corruption, or even more likely an error during WAL replay, if we were unlucky enough to crash during end-of-recovery cleanup after having completed an incomplete GIST insertion. Yoichi Hirai
* Always pass catalog id to the options validator function specified inHeikki Linnakangas2009-12-23
| | | | | | | | | | | CREATE FOREIGN DATA WRAPPER. Arguably it wasn't a bug because the documentation said that it's passed the catalog ID or zero, but surely we should provide it when it's known. And there isn't currently any scenario where it's not known, and I can't imagine having one in the future either, so better remove the "or zero" escape hatch and always pass a valid catalog ID. Backpatch to 8.4. Martin Pihlak
* Avoid a premature coercion failure in transformSetOperationTree() whenTom Lane2009-12-16
| | | | | | | | | | | | | | | | presented with an UNKNOWN-type Var, which can happen in cases where an unknown literal appeared in a subquery. While many such cases will fail later on anyway in the planner, there are some cases where the planner is able to flatten the query and replace the Var by the constant before it has to coerce the union column to the final type. I had added this check in 8.4 to provide earlier/better error detection, but it causes a regression for some cases that worked OK before. Fix by not making the check if the input node is UNKNOWN type and not a Const or Param. If it isn't going to work, it will fail anyway at plan time, with the only real loss being inability to provide an error cursor. Per gripe from Britt Piehler. In passing, rename a couple of variables to remove confusion from an inner scope masking the same variable names in an outer scope.
* Fix a bug introduced when set-returning SQL functions were made inline-able:Tom Lane2009-12-14
| | | | | | | | | | | | | | we have to cope with the possibility that the declared result rowtype contains dropped columns. This fails in 8.4, as per bug #5240. While at it, be more paranoid about inserting binary coercions when inlining. The pre-8.4 code did not really need to worry about that because it could not inline at all in any case where an added coercion could change the behavior of the function's statement. However, when inlining a SRF we allow sorting, grouping, and set-ops such as UNION. In these cases, modifying one of the targetlist entries that the sort/group/setop depends on could conceivably change the behavior of the function's statement --- so don't inline when such a case applies.
* Fix integer-to-bit-string conversions to handle the first fractional byteTom Lane2009-12-12
| | | | | | | | | correctly when the output bit width is wider than the given integer by something other than a multiple of 8 bits. This has been wrong since I first wrote that code for 8.0 :-(. Kudos to Roman Kononov for being the first to notice, though I didn't use his patch. Per bug #5237.
* tag for 8.4.2REL8_4_2Marc G. Fournier2009-12-10
|
* Prevent indirect security attacks via changing session-local state withinTom Lane2009-12-09
| | | | | | | | | | | | | | | | | | | | | | | | | | | an allegedly immutable index function. It was previously recognized that we had to prevent such a function from executing SET/RESET ROLE/SESSION AUTHORIZATION, or it could trivially obtain the privileges of the session user. However, since there is in general no privilege checking for changes of session-local state, it is also possible for such a function to change settings in a way that might subvert later operations in the same session. Examples include changing search_path to cause an unexpected function to be called, or replacing an existing prepared statement with another one that will execute a function of the attacker's choosing. The present patch secures VACUUM, ANALYZE, and CREATE INDEX/REINDEX against these threats, which are the same places previously deemed to need protection against the SET ROLE issue. GUC changes are still allowed, since there are many useful cases for that, but we prevent security problems by forcing a rollback of any GUC change after completing the operation. Other cases are handled by throwing an error if any change is attempted; these include temp table creation, closing a cursor, and creating or deleting a prepared statement. (In 7.4, the infrastructure to roll back GUC changes doesn't exist, so we settle for rejecting changes of "search_path" in these contexts.) Original report and patch by Gurjeet Singh, additional analysis by Tom Lane. Security: CVE-2009-4136
* Reject certificates with embedded NULLs in the commonName field. This stopsMagnus Hagander2009-12-09
| | | | | | | | | | | | | | | | | | attacks where an attacker would put <attack>\0<propername> in the field and trick the validation code that the certificate was for <attack>. This is a very low risk attack since it reuqires the attacker to trick the CA into issuing a certificate with an incorrect field, and the common PostgreSQL deployments are with private CAs, and not external ones. Also, default mode in 8.4 does not do any name validation, and is thus also not vulnerable - but the higher security modes are. Backpatch all the way. Even though versions 8.3.x and before didn't have certificate name validation support, they still exposed this field for the user to perform the validation in the application code, and there is no way to detect this problem through that API. Security: CVE-2009-4034
* Update time zone data files to tzdata release 2009s: DST law changes inTom Lane2009-12-09
| | | | | Antarctica, Argentina, Bangladesh, Fiji, Novokuznetsk, Pakistan, Palestine, Samoa, Syria. Also historical corrections for Hong Kong.
* Translation updatesPeter Eisentraut2009-12-08
|
* Fix bug in temporary file management with subtransactions. A cursor openedHeikki Linnakangas2009-12-03
| | | | | | | | | | | | | in a subtransaction stays open even if the subtransaction is aborted, so any temporary files related to it must stay alive as well. With the patch, we use ResourceOwners to track open temporary files and don't automatically close them at subtransaction end (though in the normal case temporary files are registered with the subtransaction resource owner and will therefore be closed). At end of top transaction, we still check that there's no temporary files marked as close-at-end-of-transaction open, but that's now just a debugging cross-check as the resource owner cleanup should've closed them already.
* Ignore attempts to set "application_name" in the connection startup packet.Tom Lane2009-12-02
| | | | | | | This avoids a useless connection retry and complaint in the postmaster log when receiving a connection from 8.5 or later libpq. Backpatch in all supported branches, but of course *not* HEAD.
* Avoid core dump on empty thesaurus dictionary.Tom Lane2009-11-30
| | | | Per report from Robert Gravsjö.
* Fix session-lifespan memory leak when a plperl function is redefined:Tom Lane2009-11-29
| | | | | | | | we have to tell Perl it can release its compiled copy of the function text. Noted by Alexey Klyukin. Back-patch to 8.2 --- the problem exists further back, but this patch won't work without modification, and it's probably not worth the trouble.
* Remove */ characters from declare cursor statements before putting them into aMichael Meskes2009-11-27
| | | | comment.
* Fix an old bug in multixact and two-phase commit. Prepared transactions canHeikki Linnakangas2009-11-23
| | | | | | | | | | | | | be part of multixacts, so allocate a slot for each prepared transaction in the "oldest member" array in multixact.c. On PREPARE TRANSACTION, transfer the oldest member value from the current backends slot to the prepared xact slot. Also save and recover the value from the 2pc state file. The symptom of the bug was that after a transaction prepared, a shared lock still held by the prepared transaction was sometimes ignored by other transactions. Fix back to 8.1, where both 2PC and multixact were introduced.
* Refactor ecpg grammar so that it uses the core grammar's unreserved_keywordTom Lane2009-11-21
| | | | | | | | | | | list, minus a few specific words that have to be treated specially. This replaces a hard-wired list of keywords that would have needed manual maintenance, and was not getting it. The 8.4 coding was already missing these words, causing ecpg to incorrectly treat them as reserved words: CALLED, CATALOG, DEFINER, ENUM, FOLLOWING, INVOKER, OPTIONS, PARTITION, PRECEDING, RANGE, SECURITY, SERVER, UNBOUNDED, WRAPPER. In HEAD we were additionally missing COMMENTS, FUNCTIONS, SEQUENCES, TABLES. Per gripe from Bosco Rama.
* Fix display and dumping of UPDATE OR TRUNCATE triggers (a bizarre combinationTom Lane2009-11-20
| | | | | maybe, but we should get it right). Bug noted while reviewing TRIGGER WHEN patch. Already fixed in HEAD.
* Typo: dump -> restorePeter Eisentraut2009-11-19
| | | | | | fixed in 8.4 and 8.5 Author: Guillaume Lelarge <guillaume@lelarge.info>
* Fix memory leak in syslogger: logfile_rotate() would leak a copy of theTom Lane2009-11-19
| | | | | | | | | output filename if CSV logging was enabled and only one of the two possible output files got rotated during a particular call (which would, in fact, typically be the case during a size-based rotation). This would amount to about MAXPGPATH (1KB) per rotation, and it's been there since the CSV code was put in, so it's surprising that nobody noticed it before. Per bug #5196 from Thomas Poindessous.
* While doing the final setrefs.c pass over a plan tree, try to match upTom Lane2009-11-16
| | | | | | | | | | | | | | | non-Var sort/group expressions using ressortgroupref labels instead of depending entirely on equal()-ity of the upper node's tlist expressions to the lower node's. This avoids emitting the wrong outputs in cases where there are textually identical volatile sort/group expressions, as for example select distinct random(),random() from generate_series(1,10); Per report from Andrew Gierth. Backpatch to 8.4. Arguably this is wrong all the way back, but the only known case where there's an observable problem is when using hash aggregation to implement DISTINCT, which is new as of 8.4. So for the moment I'll refrain from backpatching further.
* Make text search parser accept underscores in XML attributes (bug #5075)Peter Eisentraut2009-11-15
|
* Add inheritable ACE when creating a restricted token for execution onMagnus Hagander2009-11-14
| | | | | | | | Win32. Also refactor the code around it to be more clear. Jesse Morris
* A better fix for the "ARRAY[...]::domain" problem. The previous patch worked,Heikki Linnakangas2009-11-13
| | | | | | | but the transformed ArrayExpr claimed to have a return type of "domain", even though the domain constraint was only checked by the enclosing CoerceToDomain node. With this fix, the ArrayExpr is correctly labeled with the base type of the domain. Per gripe by Tom Lane.
* When you do "ARRAY[...]::domain", where domain is a domain over an array type,Heikki Linnakangas2009-11-13
| | | | | | | | | we need to check domain constraints. We used to do it correctly, but 8.4 introduced a separate code path for the "ARRAY[]::arraytype" case to infer the type of an empty ARRAY construct from the cast target, and forgot to take domains into account. Per report from Florian G. Pflug.
* Fix multicolumn GIN's wrong results with fastupdate enabled.Teodor Sigaev2009-11-13
| | | | | | | | User-defined consistent functions believes the check array contains at least one true element which was not a true for scanning pending list. Per report from Yury Don <yura@vpcit.ru>
* Do not build psql's flex module on its own, but instead include it inTom Lane2009-11-10
| | | | | | | | | mainloop.c. This ensures that postgres_fe.h is read before including any system headers, which is necessary to avoid problems on some platforms where we make nondefault selections of feature macros for stdio.h or other headers. We have had this policy for flex modules in the backend for many years, but for some reason it was not applied to psql. Per trouble report from Alexandra Roy and diagnosis by Albe Laurenz.
generated by cgit v1.2.3 (git 2.25.1) at 2025-08-03 01:24:16 +0000