PostgreSQL

SSL renegotiation has been disabled for some time, but the server would still cooperate with a client-initiated renegotiation request. A maliciously crafted renegotiation request could result in a server crash (see OpenSSL issue CVE-2021-3449). Disable the feature altogether on OpenSSL versions that permit doing so, which are 1.1.0h and newer.

This should be disallowed, just as FOR UPDATE with a plain GROUP BY is disallowed, but the test for that failed to handle empty grouping sets correctly. The end result would be a null-pointer dereference in the executor.

Such cases previously crashed.

The previous coding allowed ALTER EXTENSION ADD/DROP to occur concurrently with DROP EXTENSION, leading to a crash or corrupt catalog entries.

This command failed on materialized views containing columns with certain names, notably mv and newdata.

A transaction cannot be prepared if it has both session-lifespan and transaction-lifespan locks on the same advisory-lock ID value. This restriction was not fully checked, which could lead to a PANIC during PREPARE TRANSACTION.

Notably, this fixes some cases where it was necessary to be a superuser to use DROP OWNED BY.

This avoids failures when dealing with index predicates that aren’t really immutable. While that’s not considered a supported case, the original reason for using a non-transactional update here is long gone, so we may as well change it.

Previously, a walsender would show its latest SQL command, which was confusing if it’s now doing some replication operation instead. Now we show replication-protocol commands on the same footing as SQL commands.

pending_restart correctly showed the case where an entry that cannot be changed without a postmaster restart has been modified, but not where the entry had been removed altogether.

Under a narrow combination of conditions, the standby could wind up trying to follow the wrong WAL timeline.

File truncation is irreversible, so it’s no longer safe to stop recovery at a point earlier than that record. The corresponding case for transaction commit was fixed years ago, but this one was overlooked.

Logical replication workers frequently used Asserts to check for cases that could be triggered by invalid or out-of-order replication commands. This seems unwise, so promote these tests to regular error checks.

It’s likely that this doesn’t fix any observable bug on Intel hardware, but machines with weaker memory ordering rules could have problems.

One code path could attempt to free a null pointer. The case appears unreachable in the core server’s use of sorting, but perhaps it could be triggered by extensions.

In the event that INCLUDE columns take up enough space to prevent a leaf index tuple from ever fitting on a page, the text_ops operator class would get into an infinite loop vainly trying to make the tuple fit. While pre-v11 versions don’t have INCLUDE columns, back-patch this anti-looping fix to them anyway, as it seems like a good defense against bugs in operator classes.

An incorrectly-encoded multibyte character near the end of a string could cause various processing loops to run past the string’s terminating NUL, with results ranging from no detectable issue to a program crash, depending on what happens to be in the following memory. This is reminiscent of CVE-2006-2313, although these particular cases do not appear to have interesting security consequences.

Previously, the new installation’s oldestXID was set to a value old enough to (usually) force immediate anti-wraparound autovacuuming. That’s not desirable from a performance standpoint; what’s worse, installations using large values of autovacuum_freeze_max_age could suffer unwanted forced shutdowns soon after an upgrade.

A script file is now produced containing the ALTER EXTENSION UPDATE commands needed to bring extensions up to the versions that are considered default in the new installation.

While this usually worked, it’s not very safe since the error might have been one that made catalog access nonfunctional. A side effect of the fix is that messages about data conversion errors will now mention the query’s table and column aliases (if used) rather than the true underlying name of a foreign table or column.

Allow isolation test steps to be annotated to show the expected completion order. This allows getting stable results from otherwise-racy test cases, without the long delays that we previously used (not entirely successfully) to fend off race conditions. Allow non-quoted identifiers as isolation test session/step names (formerly, all such names had to be double-quoted). Detect and warn about unused steps in isolation tests. Improve display of query results in isolation tests. Remove isolationtester’s “[.quote]#dry-run”# mode. Remove memory leaks in isolationtester itself.

This should improve server robustness in corner cases, and it syncs our printf implementation with common libraries.

If there is no libldap_r library, we now silently assume that libldap is thread-safe.

These are the same as world and install-world respectively, except that they do not build or install the documentation.

The GSSAPI spec provides for a string pointer and length. It seems that in practice the next byte after the string is usually zero, so that our previous coding didn’t actually fail; but we do have a report of AddressSanitizer complaints.

Fix various incompatibilities with modern Kerberos builds.