delta/postgresql.git, branch REL8_3_12

Tag 8.3.12

2010-10-01T13:36:12+00:00

Use a separate interpreter for each calling SQL userid in plperl and pltcl.

2010-09-30T21:21:04+00:00

There are numerous methods by which a Perl or Tcl function can subvert
the behavior of another such function executed later; for example, by
redefining standard functions or operators called by the target function.
If the target function is SECURITY DEFINER, or is called by such a
function, this means that any ordinary SQL user with Perl or Tcl language
usage rights can do essentially anything with the privileges of the target
function's owner.

To close this security hole, create a separate Perl or Tcl interpreter for
each SQL userid under which plperl or pltcl functions are executed within
a session.  However, all plperlu or pltclu functions run within a session
still share a single interpreter, since they all execute at the trust
level of a database superuser anyway.

Note: this change results in a functionality loss when libperl has been
built without the "multiplicity" option: it's no longer possible to call
plperl functions under different userids in one session, since such a
libperl can't support multiple interpreters in one process.  However, such
a libperl already failed to support concurrent use of plperl and plperlu,
so it's likely that few people use such versions with Postgres.

Security: CVE-2010-3433

Translation updates for 8.3.12

2010-09-30T19:21:39+00:00

Update release notes for releases 9.0.1, 8.4.5, 8.3.12, 8.2.18, 8.1.22,

2010-09-30T18:27:41+00:00

8.0.26, and 7.4.30.

Treat exit code 128 (ERROR_WAIT_NO_CHILDREN) as non-fatal on Win32,

2010-09-29T14:06:24+00:00

since it can happen when a process fails to start when the system
is under high load.

Per several bug reports and many peoples investigation.

Back-patch to 8.2, since testing shows no issues even though the
"deadman-switch" does not exist  in this version.

Fix incorrect usage of non-strict OR joinclauses in appendrel indexscans.

2010-09-28T20:13:09+00:00

By chance I happened to notice that bug #5076 was still broken in the
8.3 branch, though it worked everywhere else.  The reason is that 8.3's
version of adjust_appendrel_attrs_mutator neglected to adjust
RestrictInfo.nullable_relids.  This was an oversight in my patch of
2009-04-16, which I apparently corrected in the later branches on
2009-08-13 without realizing that it affected the 8.3 branch as well.
By the time the bug report was filed, it was not reproducible in 8.4.
I don't recall if I wrote it off as already fixed, or it just fell through
the cracks; but anyway it's been a live bug in 8.3 for a year.

Fix another small oversight in command_no_begin patch.

2010-09-28T18:48:57+00:00

Need a "return false" to prevent tests from continuing after we've moved
the "query" pointer.  As it stood, it'd accept "DROP DISCARD ALL" as a
match.

Only DISCARD ALL should be in the command_no_begin list.

2010-09-28T06:57:40+00:00

We allowes DISCARD PLANS and TEMP in a transaction.

Add DISCARD to the command_no_begin list for AUTOCOMMIT=off.

2010-09-28T05:27:53+00:00

Backpatch to 8.3.

Reported by Sergey Burladyan.

Further fixes to the pg_get_expr() security fix in back branches.

2010-09-25T20:19:35+00:00

It now emerges that the JDBC driver expects to be able to use pg_get_expr()
on an output of a sub-SELECT.  So extend the check logic to be able to recurse
into a sub-SELECT to see if the argument is ultimately coming from an
appropriate column.  Per report from Thomas Kellerer.