1. 21 May, 2006 1 commit
    • Tom Lane's avatar
      Change the backend to reject strings containing invalidly-encoded multibyte · c61a2f58
      Tom Lane authored
      characters in all cases.  Formerly we mostly just threw warnings for invalid
      input, and failed to detect it at all if no encoding conversion was required.
      The tighter check is needed to defend against SQL-injection attacks as per
      CVE-2006-2313 (further details will be published after release).  Embedded
      zero (null) bytes will be rejected as well.  The checks are applied during
      input to the backend (receipt from client or COPY IN), so it no longer seems
      necessary to check in textin() and related routines; any string arriving at
      those functions will already have been validated.  Conversion failure
      reporting (for characters with no equivalent in the destination encoding)
      has been cleaned up and made consistent while at it.
      
      Also, fix a few longstanding errors in little-used encoding conversion
      routines: win1251_to_iso, win866_to_iso, euc_tw_to_big5, euc_tw_to_mic,
      mic_to_euc_tw were all broken to varying extents.
      
      Patches by Tatsuo Ishii and Tom Lane.  Thanks to Akio Ishida and Yasuo Ohgaki
      for identifying the security issues.
      c61a2f58
  2. 19 May, 2006 13 commits
  3. 18 May, 2006 14 commits
  4. 17 May, 2006 6 commits
  5. 13 May, 2006 2 commits
  6. 12 May, 2006 2 commits
  7. 11 May, 2006 2 commits