Release date: 2014-02-20
This release contains a variety of fixes from 9.1.11. For information about new features in the 9.1 major release, see Section E.127.
A dump/restore is not required for those running 9.1.X.
However, if you are upgrading from a version earlier than 9.1.11, see Section E.116.
GRANT ... WITH ADMIN
OPTION restrictions (Noah Misch)
Granting a role without
OPTION is supposed to prevent the grantee from adding or
removing members from the granted role, but this restriction was
easily bypassed by doing
first. The security impact is mostly that a role member can revoke
the access of others, contrary to the wishes of his grantor.
Unapproved role member additions are a lesser concern, since an
uncooperative role member could provide most of his rights to
others anyway by creating views or
DEFINER functions. (CVE-2014-0060)
Prevent privilege escalation via manual calls to PL validator functions (Andres Freund)
The primary role of PL validator functions is to be called
CREATE FUNCTION, but
they are also normal SQL functions that a user can call explicitly.
Calling a validator on a function actually written in some other
language was not checked for and could be exploited for
privilege-escalation purposes. The fix involves adding a call to a
privilege-checking function in each validator function. Non-core
procedural languages will also need to make this change to their
own validator functions, if any. (CVE-2014-0061)
Avoid multiple name lookups during table and index DDL (Robert Haas, Andres Freund)
If the name lookups come to different conclusions due to
concurrent activity, we might perform some parts of the DDL on a
different table than other parts. At least in the case of
CREATE INDEX, this can be used to
cause the permissions checks to be performed against a different
table than the index creation, allowing for a privilege escalation
Prevent buffer overrun with long datetime strings (Noah Misch)
MAXDATELEN constant was too
small for the longest possible value of type
interval, allowing a buffer overrun in
interval_out(). Although the datetime input
functions were more careful about avoiding buffer overrun, the
limit was short enough to cause them to reject some valid inputs,
such as input containing a very long timezone name. The
ecpg library contained these
vulnerabilities along with some of its own. (CVE-2014-0063)
Prevent buffer overrun due to integer overflow in size calculations (Noah Misch, Heikki Linnakangas)
Several functions, mostly type input functions, calculated an allocation size without checking for overflow. If overflow did occur, a too-small buffer would be allocated and then written past. (CVE-2014-0064)
Prevent overruns of fixed-size buffers (Peter Eisentraut, Jozef Mlich)
strlcpy() and related
functions to provide a clear guarantee that fixed-size buffers are
not overrun. Unlike the preceding items, it is unclear whether
these cases really represent live issues, since in most cases there
appear to be previous constraints on the size of the input string.
Nonetheless it seems prudent to silence all Coverity warnings of
this type. (CVE-2014-0065)
Avoid crashing if
NULL (Honza Horak, Bruce Momjian)
There are relatively few scenarios in which
crypt() could return NULL, but
contrib/chkpass would crash if it did. One
practical case in which this could be an issue is if libc is configured to refuse to execute
unapproved hashing algorithms (e.g., “FIPS mode”).
Document risks of
make check in the
regression testing instructions (Noah Misch, Tom Lane)
Since the temporary server started by
check uses “trust” authentication, another user on the
same machine could connect to it as database superuser, and then
potentially exploit the privileges of the operating-system user who
started the tests. A future release will probably incorporate
changes in the testing procedure to prevent this risk, but some
public discussion is needed first. So for the moment, just warn
people against using
make check when
there are untrusted users on the same machine. (CVE-2014-0067)
Fix possible mis-replay of WAL records when some segments of a relation aren't full size (Greg Stark, Tom Lane)
The WAL update could be applied to the wrong page, potentially many pages past where it should have been. Aside from corrupting data, this error has been observed to result in significant “bloat” of standby servers compared to their masters, due to updates being applied far beyond where the end-of-file should have been. This failure mode does not appear to be a significant risk during crash recovery, only when initially synchronizing a standby created from a base backup taken from a quickly-changing master.
Fix bug in determining when recovery has reached consistency (Tomonari Katsumata, Heikki Linnakangas)
In some cases WAL replay would mistakenly conclude that the database was already consistent at the start of replay, thus possibly allowing hot-standby queries before the database was really consistent. Other symptoms such as “PANIC: WAL contains references to invalid pages” were also possible.
Fix improper locking of btree index pages while replaying a
VACUUM operation in hot-standby mode
(Andres Freund, Heikki Linnakangas, Tom Lane)
This error could result in “PANIC: WAL contains references to invalid pages” failures.
Ensure that insertions into non-leaf GIN index pages write a full-page WAL record when appropriate (Heikki Linnakangas)
The previous coding risked index corruption in the event of a partial-page write during a system crash.
recovery_target_inclusive are both
set, ensure the target record is applied before pausing, not after
Fix race conditions during server process exit (Robert Haas)
Ensure that signal handlers don't attempt to use the process's
MyProc pointer after it's no longer
Fix race conditions in walsender shutdown logic and walreceiver SIGHUP signal handler (Tom Lane)
Fix unsafe references to
within error reporting logic (Christian Kruse)
This would typically lead to odd behaviors such as missing or
Fix possible crashes from using
ereport() too early during server startup (Tom
The principal case we've seen in the field is a crash if the server is started in a directory it doesn't have permission to read.
Clear retry flags properly in OpenSSL socket write function (Alexander Kukushkin)
This omission could result in a server lockup after unexpected loss of an SSL-encrypted connection.
Fix length checking for Unicode identifiers (
U&"..." syntax) containing escapes (Tom
A spurious truncation warning would be printed for such identifiers if the escaped form of the identifier was too long, but the identifier actually didn't need truncation after de-escaping.
Allow keywords that are type names to be used in lists of roles (Stephen Frost)
A previous patch allowed such keywords to be used without
quoting in places such as role identifiers; but it missed cases
where a list of role identifiers was permitted, such as
Fix parser crash for
EXISTS(SELECT * FROM
zero_column_table) (Tom Lane)
Fix possible crash due to invalid plan for nested sub-selects,
WHERE (... x IN (SELECT ...) ...) IN
(SELECT ...) (Tom Lane)
statistics for a table column even when all the values in it are
ANALYZE intentionally omits very
wide values from its histogram and most-common-values calculations,
but it neglected to do something sane in the case that all the
sampled entries are too wide.
ALTER TABLE ... SET TABLESPACE,
allow the database's default tablespace to be used without a
permissions check (Stephen Frost)
CREATE TABLE has always allowed
such usage, but
ALTER TABLE didn't get
Fix “cannot accept a
set” error when some arms of a
CASE return a set and others don't (Tom Lane)
Fix checks for all-zero client addresses in pgstat functions (Kevin Grittner)
Fix possible misclassification of multibyte characters by the text search parser (Tom Lane)
Non-ASCII characters could be misclassified when using C locale with a multibyte encoding. On Cygwin, non-C locales could fail as well.
Fix possible misbehavior in
plainto_tsquery() (Heikki Linnakangas)
memcpy() for copying overlapping memory regions.
There have been no field reports of this actually causing trouble,
but it's certainly risky.
Fix placement of permissions checks in
pg_stop_backup() (Andres Freund, Magnus
The previous coding might attempt to do catalog access when it shouldn't.
SHIFT_JIS as an encoding
name for locale checking purposes (Tatsuo Ishii)
Fix misbehavior of
Windows (Fujii Masao)
It should return
localhost if no
host has been specified.
Improve error handling in libpq
and psql for failures during
COPY TO STDOUT/FROM STDIN (Tom
In particular this fixes an infinite loop that could occur in
9.2 and up if the server connection was lost during
COPY FROM STDIN. Variants of that scenario might
be possible in older versions, or with other client
Fix possible incorrect printing of filenames in pg_basebackup's verbose mode (Magnus Hagander)
Avoid including tablespaces inside PGDATA twice in base backups (Dimitri Fontaine, Magnus Hagander)
Fix misaligned descriptors in ecpg (MauMau)
In ecpg, handle lack of a hostname in the connection parameters properly (Michael Meskes)
Fix performance regression in
contrib/dblink connection startup (Joe
Avoid an unnecessary round trip when client and server encodings match.
contrib/isn, fix incorrect
calculation of the check digit for ISMN values (Fabien Coelho)
Ensure client-code-only installation procedure works as documented (Peter Eisentraut)
In Mingw and Cygwin builds, install the libpq DLL in the
bin directory (Andrew Dunstan)
This duplicates what the MSVC build has long done. It should fix problems with programs like psql failing to start because they can't find the DLL.
Avoid using the deprecated
tool in Cygwin builds (Marco Atzeri)
Don't generate plain-text
anymore (Tom Lane)
These text files duplicated the main HTML and PDF documentation
formats. The trouble involved in maintaining them greatly outweighs
the likely audience for plain-text format. Distribution tarballs
will still contain files by these names, but they'll just be stubs
directing the reader to consult the main documentation. The
INSTALL file will still be
maintained, as there is arguably a use-case for that.
Update time zone data files to tzdata release 2013i for DST law changes in Jordan and historical changes in Cuba.
In addition, the zones
Asia/Riyadh89 have been removed, as they are no
longer maintained by IANA, and never represented actual civil
If you see anything in the documentation that is not correct, does not match your experience with the particular feature or requires further clarification, please use this form to report a documentation issue.