Commit 772c5ba3 authored by Tom Lane's avatar Tom Lane

Repair incorrect check for coercion of unknown literal to ANYARRAY, a bug

I introduced in 7.4.1 :-(.  It's correct to allow unknown to be coerced to
ANY or ANYELEMENT, since it's a real-enough data type, but it most certainly
isn't an array datatype.  This can cause a backend crash but AFAICT is not
exploitable as a security hole.  Per report from Michael Fuhr.

Note: as fixed in HEAD, this changes a constant in the pg_stats view,
resulting in a change in the expected regression outputs.  The back-branch
patches have been hacked to avoid that, so that pre-existing installations
won't start failing their regression tests.
parent 8f2f180f
......@@ -8,7 +8,7 @@
*
*
* IDENTIFICATION
* $PostgreSQL: pgsql/src/backend/parser/parse_coerce.c,v 2.144 2006/10/04 00:29:55 momjian Exp $
* $PostgreSQL: pgsql/src/backend/parser/parse_coerce.c,v 2.145 2006/10/11 20:21:03 tgl Exp $
*
*-------------------------------------------------------------------------
*/
......@@ -129,11 +129,22 @@ coerce_type(ParseState *pstate, Node *node,
return node;
}
if (targetTypeId == ANYOID ||
targetTypeId == ANYARRAYOID ||
targetTypeId == ANYELEMENTOID)
targetTypeId == ANYELEMENTOID ||
(targetTypeId == ANYARRAYOID && inputTypeId != UNKNOWNOID))
{
/* assume can_coerce_type verified that implicit coercion is okay */
/* NB: we do NOT want a RelabelType here */
/*
* Assume can_coerce_type verified that implicit coercion is okay.
*
* Note: by returning the unmodified node here, we are saying that
* it's OK to treat an UNKNOWN constant as a valid input for a
* function accepting ANY or ANYELEMENT. This should be all right,
* since an UNKNOWN value is still a perfectly valid Datum. However
* an UNKNOWN value is definitely *not* an array, and so we mustn't
* accept it for ANYARRAY. (Instead, we will call anyarray_in below,
* which will produce an error.)
*
* NB: we do NOT want a RelabelType here.
*/
return node;
}
if (inputTypeId == UNKNOWNOID && IsA(node, Const))
......
This diff is collapsed.
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment