1. 02 Feb, 2007 1 commit
    • Tom Lane's avatar
      Repair insufficiently careful type checking for SQL-language functions: · f8eb75b6
      Tom Lane authored
      we should check that the function code returns the claimed result datatype
      every time we parse the function for execution.  Formerly, for simple
      scalar result types we assumed the creation-time check was sufficient, but
      this fails if the function selects from a table that's been redefined since
      then, and even more obviously fails if check_function_bodies had been OFF.
      
      This is a significant security hole: not only can one trivially crash the
      backend, but with appropriate misuse of pass-by-reference datatypes it is
      possible to read out arbitrary locations in the server process's memory,
      which could allow retrieving database content the user should not be able
      to see.  Our thanks to Jeff Trout for the initial report.
      
      Security: CVE-2007-0555
      f8eb75b6
  2. 01 Feb, 2007 21 commits
  3. 31 Jan, 2007 15 commits
  4. 30 Jan, 2007 3 commits