projects / users / heikki / postgres.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: b12ca1d) | patch
stringToNode() and deparse_expression_pretty() crash on invalid input,
authorHeikki Linnakangas <heikki.linnakangas@iki.fi>
Wed, 30 Jun 2010 18:11:04 +0000 (18:11 +0000)
committerHeikki Linnakangas <heikki.linnakangas@iki.fi>
Wed, 30 Jun 2010 18:11:04 +0000 (18:11 +0000)
commit578a0d3fcde12c6f16d123bc5abc56dab93390fa
tree083164feb2e1f7fc52263bedcbf2de752276f1catree
parentb12ca1d56136db61d141ad160236b9f745bb354fcommit | diff
stringToNode() and deparse_expression_pretty() crash on invalid input,
but we have nevertheless exposed them to users via pg_get_expr(). It would
be too much maintenance effort to rigorously check the input, so put a hack
in place instead to restrict pg_get_expr() so that the argument must come
from one of the system catalog columns known to contain valid expressions.

Per report from Rushabh Lathia. Backpatch to 7.4 which is the oldest
supported version at the moment.
src/backend/parser/parse_expr.c diff | blob | blame | history
src/backend/tcop/fastpath.c diff | blob | blame | history
Heikki's random PostgreSQL patches