PostgreSQL

Autovacuum, CLUSTER, CREATE INDEX, REINDEX, REFRESH MATERIALIZED VIEW, and pg_amcheck activated the “[.quote]#security restricted operation”# protection mechanism too late, or even not at all in some code paths. A user having permission to create non-temporary objects within a database could define an object that would execute arbitrary SQL code with superuser permissions the next time that autovacuum processed the object, or that some superuser ran one of the affected commands against it.

The PostgreSQL Project thanks Alexander Lakhin for reporting this problem. (CVE-2022-1552)

The column names in tuples produced by a whole-row variable (such as tbl.* in contexts other than the top level of a SELECT list) are now always those of the associated named composite type, if there is one. We’d previously attempted to make them track any column aliases that had been applied to the FROM entry the variable refers to. But that’s semantically dubious, because really then the output of the variable is not at all of the composite type it claims to be. Previous attempts to deal with that inconsistency had bad results up to and including storing unreadable data on disk, so just give up on the whole idea.

In cases where it’s important to be able to relabel such columns, a workaround is to introduce an extra level of sub-SELECT, so that the whole-row variable is referring to the sub-SELECT’s output and not to a plain table. Then the variable is of type `record to begin with and there’s no issue.

The xmlschema output for these types included a malformed regular expression.

The previous coding could try to read non-returnable columns in addition to the returnable ones. This was fairly harmless because it didn’t actually do anything with the bogus values, but it fell foul of a recently-added error check that rejected such a plan.

The code would touch the buffer a couple more times after releasing its pin. In theory another process could recycle the buffer (or more likely, try to defragment its free space) as soon as the pin is gone, probably leading to failure to find the newer version of the tuple.

The parallelism property change was lost if the same command also updated the function’s SET clause.

The system should just tell you that you can’t do it, but sometimes it would report “[.quote]#no owned sequence found”# instead.

The table would be rebuilt with the correct data, but in an order having little to do with the index order.

Ensure that the required table and index locks are taken in the standard order (parents before children, tables before indexes). The previous coding for DROP INDEX did it differently, and so could deadlock against concurrent queries taking these locks in the standard order.

The checkpoint forced by DROP TABLESPACE could sometimes fail to remove all dead files from the tablespace’s directory, leading to a bogus “[.quote]#tablespace is not empty”# error.

TRUNCATE must ensure that the table’s disk file is truncated before the checkpoint is allowed to complete. Otherwise, replay starting from that checkpoint might find unexpected data in the supposedly-removed pages, possibly causing replay failure.

Temporary-object deletion during server process exit could fail with “[.quote]#FATAL: cannot fetch toast data without an active snapshot”#. This was usually harmless since the next use of that temporary schema would clean up successfully.

If we run out of space in the checkpointer sync request queue (which is hopefully rare on real systems, but is common when testing with a very small buffer pool), we wait for it to drain. While waiting, we should report that as a wait event so that users know what is going on, and also watch for postmaster death, since otherwise the loop might never terminate if the checkpointer has already exited.

With unlucky timing, the WAL-applying process could get stuck while waiting for some other process to release a buffer lock.

Faulty coding of the limit check caused a restarted worker to exit immediately, leaving fewer workers than there should be.

Otherwise subscribers cannot see the values and will fail to replicate the update.

v13 and later servers support publishing partitioned tables. Older server versions cannot handle subscribing to such a table, and they gave a very misleading error message: “[.quote]#table XYZ not found on publisher”#. Arrange to deliver a more on-point message.

Perl can be convinced to execute user-defined code during compilation of a PL/Perl function. However, it’s not okay for such code to try to invoke SQL operations via SPI. That results in a crash, and if it didn’t crash it would be a security hazard, because we really don’t want code execution during function validation. Put in a check to give a friendlier error message instead.

This change synchronizes libpq’s rules for safe ownership and permissions of SSL key files with the rules the server has used since release 9.6. Namely, in addition to the current rules, allow the case where the key file is owned by root and has permissions rw-r----- or less. This is helpful for system-wide management of key files.

If we’d detected a write failure, PQisBusy() would always return true, which is the wrong thing: we want input processing to carry on normally until we’ve read whatever is available from the server. The practical effect of this error is that applications using libpq’s async-query API would typically detect connection loss only when PQconsumeInput() returns a hard failure. With this fix, a connection loss will normally be reported via an error PGresult object, which is a much cleaner behavior for most applications.

pg_ctl would verify that the postmaster is alive as a side-effect of sending the stop or promote signal, but then it just naively waited to see the on-disk state change. If the postmaster died uncleanly without having removed its PID file or updated the control file, pg_ctl would wait until timeout. Instead make it recheck every so often that the postmaster process is still there.

While trying to read a WAL file to determine the WAL segment size, pg_waldump would report an incorrect error for the case of a too-short file. In addition, the file name reported in this and related error messages could be garbage.

This is a legitimate edge case, but the module was mostly unprepared for it. Arrange to return nulls, or no rows, as appropriate; that seems more useful than raising an error.

These changes make it less likely that the module will crash on bad data.

This fix prevents situations where the remote server might sort in a different order than we intend. While sometimes that would be only cosmetic, it could produce thoroughly wrong results if the remote data is used as input for a locally-performed merge join.

Most of these changes are just for pro-forma compliance with the letter of the C and POSIX standards, and are unlikely to have any effect on production builds.

This adapts the build process to work on recent MSys tool chains.

For some reason the C library provided by MinGW will expand shell wildcard characters in a program’s command-line arguments by default. This is confusing, not least because it doesn’t happen under MSVC, so turn it off.