PostgreSQL

Any authenticated user could cause a stack-based buffer overflow by changing their own password to a purpose-crafted value. In addition to the ability to crash the PostgreSQL server, this could suffice for executing arbitrary code as the PostgreSQL operating system account.

A similar overflow hazard existed in libpq, which could allow a rogue server to crash a client or perhaps execute arbitrary code as the client’s operating system account.

The PostgreSQL Project thanks Alexander Lakhin for reporting this problem. (CVE-2019-10164)

This mistake could lead to “[.quote]#could not find pathkey item to sort”# errors.

This oversight caused a dump/restore failure for views containing such queries.

Such cases should produce the literal as a standalone JSON value, but the code misbehaved if the literal contained any characters requiring escaping.

Such quantifiers were treated as no-ops and optimized away; but the documentation specifies that they impose greediness, or non-greediness in the case of the non-greedy variant {1,1}?, on the subexpression they’re attached to, and this did not happen. The misbehavior occurred only if the subexpression contained capturing parentheses or a back-reference.

Certain operations that could fail, such as converting strings extracted from an SSL certificate into the database encoding, were being performed inside a critical section. Failure there would result in database-wide lockup due to violating the access protocol for shared pg_stat_activity data.

This avoids rare problems in which the walreceiver process would crash or deadlock when commanded to shut down.

This error could result in failures like “[.quote]#cannot read pg_class without having selected a database”#.

Make initdb examine the /etc/localtime symbolic link, if that exists, to break ties between equivalent names for the system time zone. This makes initdb more likely to select the time zone name that the user would expect when multiple identical time zones exist. It will not change the behavior if /etc/localtime is not a symlink to a zone data file, nor if the time zone is determined from the TZ environment variable.

Separately, prefer UTC over other spellings of that time zone, when neither TZ nor /etc/localtime provide a hint. This fixes an annoyance introduced by tzdata 2019a’s change to make the UCT and UTC zone names equivalent: initdb was then preferring UCT, which almost nobody wants.

If cascading grants had been issued, restore might fail due to the GRANT commands being given in an order that didn’t respect their interdependencies.

This avoids problems with the partition’s column order possibly being changed to match the parent’s. Also, a partition is now restorable from the dump (as a standalone table) even if its parent table isn’t restored; the ATTACH will fail, but that can just be ignored.

Previously, a parallel worker might try to log its query even if the parent query were not being logged by auto_explain. This would work sometimes, but it’s confusing, and in some cases it resulted in failures like “[.quote]#could not find key N in shm TOC”#.

Also, fix an off-by-one error that resulted in not necessarily logging every query even when the sampling rate is set to 1.0.

If a trigger modified a column that was otherwise not changed by the UPDATE, the new value was not transmitted to the remote server.

The code had been assuming that such strings must be in UTF-8, and would throw an error if they didn’t appear to be validly encoded. Now, just transmit the untranslated bytes to the log.