pgsql: stringToNode() and deparse_expression_pretty() crash on invalid

From: heikki(at)postgresql(dot)org (Heikki Linnakangas)
To: pgsql-committers(at)postgresql(dot)org
Subject: pgsql: stringToNode() and deparse_expression_pretty() crash on invalid
Date: 2010-06-30 18:11:43
Message-ID: 20100630181143.87B007541D4@cvs.postgresql.org
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-committers

Log Message:
-----------
stringToNode() and deparse_expression_pretty() crash on invalid input,
but we have nevertheless exposed them to users via pg_get_expr(). It would
be too much maintenance effort to rigorously check the input, so put a hack
in place instead to restrict pg_get_expr() so that the argument must come
from one of the system catalog columns known to contain valid expressions.

Per report from Rushabh Lathia. Backpatch to 7.4 which is the oldest
supported version at the moment.

Tags:
----
REL7_4_STABLE

Modified Files:
--------------
pgsql/src/backend/parser:
parse_expr.c (r1.163.2.4 -> r1.163.2.5)
(http://anoncvs.postgresql.org/cvsweb.cgi/pgsql/src/backend/parser/parse_expr.c?r1=1.163.2.4&r2=1.163.2.5)
pgsql/src/backend/tcop:
fastpath.c (r1.69 -> r1.69.2.1)
(http://anoncvs.postgresql.org/cvsweb.cgi/pgsql/src/backend/tcop/fastpath.c?r1=1.69&r2=1.69.2.1)
pgsql/src/include/catalog:
pg_constraint.h (r1.9 -> r1.9.4.1)
(http://anoncvs.postgresql.org/cvsweb.cgi/pgsql/src/include/catalog/pg_constraint.h?r1=1.9&r2=1.9.4.1)

Browse pgsql-committers by date

  From Date Subject
Next Message Bruce Momjian 2010-07-01 02:33:21 pgsql: Update 9.0 release notes so streaming replication and hot standby
Previous Message Heikki Linnakangas 2010-06-30 18:11:32 pgsql: stringToNode() and deparse_expression_pretty() crash on invalid