Advance the minimum required version of "flex" from 2.5.4 to 2.5.31, and

update documentation accordingly.  This is required in order to have support
for a reentrant scanner.  I'm committing this bit separately in order to have
an easy reference if we later decide to make the minimum something different
(like 2.5.33).

config/programs.m4

-# $PostgreSQL: pgsql/config/programs.m4,v 1.24 2008/08/29 13:02:32 petere Exp $
+# $PostgreSQL: pgsql/config/programs.m4,v 1.25 2009/07/13 01:51:56 tgl Exp $
 
 
 # PGAC_PATH_BISON
@@ -42,8 +42,11 @@ AC_SUBST(BISONFLAGS)
 # PGAC_PATH_FLEX
 # --------------
 # Look for Flex, set the output variable FLEX to its path if found.
-# Avoid the buggy version 2.5.3. Also find Flex if its installed
-# under `lex', but do not accept other Lex programs.
+# Reject versions before 2.5.31, as we need a reasonably non-buggy reentrant
+# scanner.  (Note: the well-publicized security problem in 2.5.31 does not
+# affect Postgres, and there are still distros shipping patched 2.5.31,
+# so allow it.)  Also find Flex if its installed under `lex', but do not
+# accept other Lex programs.
 
 AC_DEFUN([PGAC_PATH_FLEX],
 [AC_CACHE_CHECK([for flex], pgac_cv_path_flex,
@@ -65,13 +68,16 @@ else
       then
         echo '%%'  > conftest.l
         if $pgac_candidate -t conftest.l 2>/dev/null | grep FLEX_SCANNER >/dev/null 2>&1; then
-          if $pgac_candidate --version | grep ' 2\.5\.3$' >/dev/null 2>&1; then
-            pgac_broken_flex=$pgac_candidate
-            continue
+          pgac_flex_version=`$pgac_candidate --version 2>/dev/null`
+          if echo "$pgac_flex_version" | sed ['s/[.a-z]/ /g'] | $AWK '{ if ([$]1 = 2 && [$]2 = 5 && [$]3 >= 31) exit 0; else exit 1;}'
+          then
+            pgac_cv_path_flex=$pgac_candidate
+            break 2
+          else
+            AC_MSG_WARN([
+*** The installed version of Flex, $pgac_candidate, is too old to use with PostgreSQL.
+*** Flex version 2.5.31 or later is required.])
           fi
-
-          pgac_cv_path_flex=$pgac_candidate
-          break 2
         fi
       fi
     done
@@ -82,14 +88,8 @@ fi
 ])[]dnl AC_CACHE_CHECK
 
 if test x"$pgac_cv_path_flex" = x"no"; then
-  if test -n "$pgac_broken_flex"; then
-    AC_MSG_WARN([
-*** The Flex version 2.5.3 you have at $pgac_broken_flex contains a bug. You
-*** should get version 2.5.4 or later.])
-  fi
-
   AC_MSG_WARN([
-*** Without Flex you will not be able to build PostgreSQL from CVS or
+*** Without Flex you will not be able to build PostgreSQL from CVS nor
 *** change any of the scanner definition files.  You can obtain Flex from
 *** a GNU mirror site.  (If you are using the official distribution of
 *** PostgreSQL then you do not need to worry about this because the Flex
@@ -98,7 +98,7 @@ if test x"$pgac_cv_path_flex" = x"no"; then
   FLEX=
 else
   FLEX=$pgac_cv_path_flex
-  pgac_flex_version=`$FLEX -V 2>/dev/null`
+  pgac_flex_version=`$FLEX --version 2>/dev/null`
   AC_MSG_NOTICE([using $pgac_flex_version])
 fi
 

configure

@@ -6779,13 +6779,19 @@ else
       then
         echo '%%'  > conftest.l
         if $pgac_candidate -t conftest.l 2>/dev/null | grep FLEX_SCANNER >/dev/null 2>&1; then
-          if $pgac_candidate --version | grep ' 2\.5\.3$' >/dev/null 2>&1; then
-            pgac_broken_flex=$pgac_candidate
-            continue
+          pgac_flex_version=`$pgac_candidate --version 2>/dev/null`
+          if echo "$pgac_flex_version" | sed 's/[.a-z]/ /g' | $AWK '{ if ($1 = 2 && $2 = 5 && $3 >= 31) exit 0; else exit 1;}'
+          then
+            pgac_cv_path_flex=$pgac_candidate
+            break 2
+          else
+            { $as_echo "$as_me:$LINENO: WARNING:
+*** The installed version of Flex, $pgac_candidate, is too old to use with PostgreSQL.
+*** Flex version 2.5.31 or later is required." >&5
+$as_echo "$as_me: WARNING:
+*** The installed version of Flex, $pgac_candidate, is too old to use with PostgreSQL.
+*** Flex version 2.5.31 or later is required." >&2;}
           fi
-
-          pgac_cv_path_flex=$pgac_candidate
-          break 2
         fi
       fi
     done
@@ -6798,23 +6804,14 @@ fi
 { $as_echo "$as_me:$LINENO: result: $pgac_cv_path_flex" >&5
 $as_echo "$pgac_cv_path_flex" >&6; }
 if test x"$pgac_cv_path_flex" = x"no"; then
-  if test -n "$pgac_broken_flex"; then
-    { $as_echo "$as_me:$LINENO: WARNING:
-*** The Flex version 2.5.3 you have at $pgac_broken_flex contains a bug. You
-*** should get version 2.5.4 or later." >&5
-$as_echo "$as_me: WARNING:
-*** The Flex version 2.5.3 you have at $pgac_broken_flex contains a bug. You
-*** should get version 2.5.4 or later." >&2;}
-  fi
-
   { $as_echo "$as_me:$LINENO: WARNING:
-*** Without Flex you will not be able to build PostgreSQL from CVS or
+*** Without Flex you will not be able to build PostgreSQL from CVS nor
 *** change any of the scanner definition files.  You can obtain Flex from
 *** a GNU mirror site.  (If you are using the official distribution of
 *** PostgreSQL then you do not need to worry about this because the Flex
 *** output is pre-generated.)" >&5
 $as_echo "$as_me: WARNING:
-*** Without Flex you will not be able to build PostgreSQL from CVS or
+*** Without Flex you will not be able to build PostgreSQL from CVS nor
 *** change any of the scanner definition files.  You can obtain Flex from
 *** a GNU mirror site.  (If you are using the official distribution of
 *** PostgreSQL then you do not need to worry about this because the Flex
@@ -6823,7 +6820,7 @@ $as_echo "$as_me: WARNING:
   FLEX=
 else
   FLEX=$pgac_cv_path_flex
-  pgac_flex_version=`$FLEX -V 2>/dev/null`
+  pgac_flex_version=`$FLEX --version 2>/dev/null`
   { $as_echo "$as_me:$LINENO: using $pgac_flex_version" >&5
 $as_echo "$as_me: using $pgac_flex_version" >&6;}
 fi

doc/src/sgml/install-win32.sgml

-<!-- $PostgreSQL: pgsql/doc/src/sgml/install-win32.sgml,v 1.52 2009/04/27 16:27:35 momjian Exp $ -->
+<!-- $PostgreSQL: pgsql/doc/src/sgml/install-win32.sgml,v 1.53 2009/07/13 01:51:56 tgl Exp $ -->
 
 <chapter id="install-win32">
  <title>Installation from Source Code on <productname>Windows</productname></title>
@@ -102,7 +102,8 @@
      <listitem><para>
       Bison and Flex are required to build from CVS, but not required when
       building from a release file. Note that only Bison 1.875 or versions
-      2.2 and later will work. Bison and Flex can be
+      2.2 and later will work. Also, Flex version 2.5.31 or later is required.
+      Bison and Flex can be
       downloaded from <ulink url="http://gnuwin32.sourceforge.net"></>.
      </para></listitem>
     </varlistentry>

doc/src/sgml/installation.sgml

-<!-- $PostgreSQL: pgsql/doc/src/sgml/installation.sgml,v 1.325 2009/06/23 03:46:00 tgl Exp $ -->
+<!-- $PostgreSQL: pgsql/doc/src/sgml/installation.sgml,v 1.326 2009/07/13 01:51:56 tgl Exp $ -->
 
 <chapter id="installation">
  <title><![%standalone-include[<productname>PostgreSQL</>]]>
@@ -296,7 +296,7 @@ su - postgres
       GNU <application>Flex</> and <application>Bison</>
       are needed to build from a CVS checkout, or if you changed the actual
       scanner and parser definition files. If you need them, be sure
-      to get <application>Flex</> 2.5.4 or later and
+      to get <application>Flex</> 2.5.31 or later and
       <application>Bison</> 1.875 or later. Other <application>lex</>
       and <application>yacc</> programs cannot be used.
      </para>