~ubuntu-branches/ubuntu/karmic/postgresql-8.4/karmic-security

Viewing changes to src/backend/optimizer/util/clauses.c

Committer: Bazaar Package Importer
Author(s): Martin Pitt
Date: 2011-02-01 22:30:52 UTC
mfrom: (0.1.7 upstream) (8.1.3 karmic-proposed)
Revision ID: james.westby@ubuntu.com-20110201223052-ikezaq42g6c3yv2e

Tags: 8.4.7-0ubuntu0.9.10

* New upstream security/bug fix release: (LP: #711318)
  - Fix buffer overrun in "contrib/intarray"'s input function for the
    query_int type.
    This bug is a security risk since the function's return address
    could be overwritten. Thanks to Apple Inc's security team for
    reporting this issue and supplying the fix. (CVE-2010-4015)
  - Avoid failures when "EXPLAIN" tries to display a simple-form CASE
    expression.
    If the CASE's test expression was a constant, the planner could
    simplify the CASE into a form that confused the expression-display
    code, resulting in "unexpected CASE WHEN clause" errors.
  - Fix assignment to an array slice that is before the existing range
    of subscripts.
    If there was a gap between the newly added subscripts and the first
    pre-existing subscript, the code miscalculated how many entries
    needed to be copied from the old array's null bitmap, potentially
    leading to data corruption or crash.
  - Avoid unexpected conversion overflow in planner for very distant
    date values.
    The date type supports a wider range of dates than can be
    represented by the timestamp types, but the planner assumed it
    could always convert a date to timestamp with impunity.
  - Fix pg_restore's text output for large objects (BLOBs) when
    standard_conforming_strings is on.
    Although restoring directly to a database worked correctly, string
    escaping was incorrect if pg_restore was asked for SQL text output
    and standard_conforming_strings had been enabled in the source
    database.
  - Fix erroneous parsing of tsquery values containing ... &
    !(subexpression) | ... .
    Queries containing this combination of operators were not executed
    correctly. The same error existed in "contrib/intarray"'s query_int
    type and "contrib/ltree"'s ltxtquery type.
  - Fix bug in "contrib/seg"'s GiST picksplit algorithm.
    This could result in considerable inefficiency, though not actually
    incorrect answers, in a GiST index on a seg column. If you have
    such an index, consider "REINDEX"ing it after installing this
    update. (This is identical to the bug that was fixed in
    "contrib/cube" in the previous update.)

files modified:
HISTORY

INSTALL

configure

configure.in

contrib/cube/cube.c

contrib/dblink/dblink.c

contrib/intarray/_int_bool.c

contrib/ltree/ltxtquery_io.c

contrib/pgcrypto/pgp-pubenc.c

contrib/seg/seg.c

contrib/xml2/xpath.c

debian/changelog

debian/control

doc/bug.template

doc/man.tar.gz

doc/postgres.tar.gz

doc/src/sgml/acronyms.sgml

doc/src/sgml/catalogs.sgml

doc/src/sgml/config.sgml

doc/src/sgml/queries.sgml

doc/src/sgml/ref/create_view.sgml

doc/src/sgml/ref/grant.sgml

doc/src/sgml/release-8.1.sgml

doc/src/sgml/release-8.2.sgml

doc/src/sgml/release-8.3.sgml

doc/src/sgml/release-8.4.sgml

doc/src/sgml/rules.sgml

doc/src/sgml/wal.sgml

src/backend/access/gin/ginxlog.c

src/backend/access/gist/gist.c

src/backend/access/gist/gistutil.c

src/backend/access/gist/gistvacuum.c

src/backend/access/heap/rewriteheap.c

src/backend/access/transam/xlog.c

src/backend/catalog/dependency.c

src/backend/catalog/index.c

src/backend/commands/analyze.c

src/backend/executor/functions.c

src/backend/libpq/pqcomm.c

src/backend/nodes/copyfuncs.c

src/backend/nodes/outfuncs.c

src/backend/optimizer/path/costsize.c

src/backend/optimizer/util/clauses.c

src/backend/parser/analyze.c

src/backend/po/de.po

src/backend/po/es.po

src/backend/po/fr.po

src/backend/po/pt_BR.po

src/backend/po/zh_CN.po

src/backend/postmaster/autovacuum.c

src/backend/postmaster/postmaster.c

src/backend/storage/file/fd.c

src/backend/tcop/postgres.c

src/backend/utils/adt/arrayfuncs.c

src/backend/utils/adt/date.c

src/backend/utils/adt/geo_ops.c

src/backend/utils/adt/ruleutils.c

src/backend/utils/adt/selfuncs.c

src/backend/utils/adt/tsquery.c

src/backend/utils/misc/postgresql.conf.sample

src/backend/utils/sort/tuplestore.c

src/bin/initdb/po/zh_CN.po

src/bin/pg_config/po/zh_CN.po

src/bin/pg_controldata/po/zh_CN.po

src/bin/pg_ctl/po/zh_CN.po

src/bin/pg_dump/dumputils.c

src/bin/pg_dump/dumputils.h

src/bin/pg_dump/pg_backup_archiver.c

src/bin/pg_dump/pg_backup_archiver.h

src/bin/pg_dump/pg_backup_null.c

src/bin/pg_dump/po/de.po

src/bin/pg_dump/po/it.po

src/bin/pg_dump/po/zh_CN.po

src/bin/pg_resetxlog/po/zh_CN.po

src/bin/pgevent/Makefile

src/bin/psql/po/de.po

src/bin/psql/po/zh_CN.po

src/bin/scripts/po/zh_CN.po

src/include/access/gist_private.h

src/include/access/xlogdefs.h

src/include/getopt_long.h

src/include/pg_config.h.win32

src/include/port/linux.h

src/include/port/win32.h

src/include/utils/date.h

src/interfaces/ecpg/ecpglib/misc.c

src/interfaces/ecpg/ecpglib/po/zh_CN.po

src/interfaces/ecpg/preproc/po/zh_CN.po

src/interfaces/ecpg/test/Makefile

src/interfaces/ecpg/test/Makefile.regress

src/interfaces/libpq/libpq-dist.rc

src/interfaces/libpq/libpq.rc.in

src/interfaces/libpq/po/zh_CN.po

src/pl/plperl/po/de.po

src/pl/plperl/po/es.po

src/pl/plperl/po/fr.po

src/pl/plperl/po/pt_BR.po

src/pl/plperl/po/zh_CN.po

src/pl/plpgsql/src/pl_exec.c

src/pl/plpgsql/src/plpgsql.h

src/pl/plpgsql/src/po/zh_CN.po

src/pl/plpython/expected/plpython_function.out

src/pl/plpython/expected/plpython_test.out

src/pl/plpython/plpython.c

src/pl/plpython/po/zh_CN.po

src/pl/plpython/sql/plpython_function.sql

src/pl/plpython/sql/plpython_test.sql

src/pl/tcl/po/zh_CN.po

src/port/getopt.c

src/port/getopt_long.c

src/port/win32ver.rc

src/test/regress/expected/plpgsql.out

src/test/regress/expected/rangefuncs.out

src/test/regress/sql/plpgsql.sql

src/test/regress/sql/rangefuncs.sql

src/timezone/data/asia

src/timezone/data/australasia

src/timezone/data/zone.tab

src/tools/fsync/test_fsync.c

src/tools/msvc/Install.pm

src/tools/msvc/Project.pm

src/tools/msvc/Solution.pm

Show diffs side-by-side

added added

removed removed

src/backend/optimizer/util/clauses.c

2570

* placeholder nodes, so that we have the opportunity to reduce

2571

* constant test conditions. For example this allows

2572

* CASE 0 WHEN 0 THEN 1 ELSE 1/0 END

2573

* to reduce to 1 rather than drawing a divide-by-0 error.

2573

* to reduce to 1 rather than drawing a divide-by-0 error. Note

2574

* that when the test expression is constant, we don't have to

2575

* include it in the resulting CASE; for example

2576

* CASE 0 WHEN x THEN y ELSE z END

2577

* is transformed by the parser to

2578

* CASE 0 WHEN CaseTestExpr = x THEN y ELSE z END

2579

* which we can simplify to

2580

* CASE WHEN 0 = x THEN y ELSE z END

2581

* It is not necessary for the executor to evaluate the "arg"

2582

* expression when executing the CASE, since any contained

2583

* CaseTestExprs that might have referred to it will have been

2584

* replaced by the constant.

2574

2585

*----------

2575

2586

2576

2587

CaseExpr *caseexpr = (CaseExpr *) node;

2589

2600

/* Set up for contained CaseTestExpr nodes */

2590

2601

save_case_val = context->case_val;

2591

2602

if (newarg && IsA(newarg, Const))

2603

{

2592

2604

context->case_val = newarg;

2605

newarg = NULL; /* not needed anymore, see comment above */

2606

}

2593

2607

else

2594

2608

context->case_val = NULL;

2595

2609

2733

2747

2734

2748

* We can remove null constants from the list. For a non-null

2735

2749

* constant, if it has not been preceded by any other

2736

* non-null-constant expressions then that is the result.

2750

* non-null-constant expressions then it is the result. Otherwise,

2751

* it's the next argument, but we can drop following arguments

2752

* since they will never be reached.

2737

2753

2738

2754

if (IsA(e, Const))

2739

2755

{

2741

2757

continue; /* drop null constant */

2742

2758

if (newargs == NIL)

2743

2759

return e; /* first expr */

2760

newargs = lappend(newargs, e);

2761

break;

2744

2762

}

2745

2763

newargs = lappend(newargs, e);

2746

2764

}

3489

3507

* We must also beware of changing the volatility or strictness status of

3490

3508

* functions by inlining them.

3491

3509

3510

* Also, at the moment we can't inline functions returning RECORD. This

3511

* doesn't work in the general case because it discards information such

3512

* as OUT-parameter declarations.

3513

3492

3514

* Returns a simplified expression if successful, or NULL if cannot

3493

3515

* simplify the function.

3494

3516

3521

3543

if (funcform->prolang != SQLlanguageId ||

3522

3544

funcform->prosecdef ||

3523

3545

funcform->proretset ||

3546

funcform->prorettype == RECORDOID ||

3524

3547

!heap_attisnull(func_tuple, Anum_pg_proc_proconfig) ||

3525

3548

funcform->pronargs != list_length(args))

3526

3549

return NULL;

Older »