database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-07-31 22:04:40 +03:00
Code Activity

Stamp release 7.3.10.

Browse Source
This commit is contained in:
Tom Lane
2005-05-05 20:09:12 +00:00
parent 5d0d60efe6
commit 07e3879c95
8 changed files with 277 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files

101
HISTORY
View File

@ -1,6 +1,83 @@
Release Notes
Release 7.3.10
Release date: 2005-05-05
This release contains a variety of fixes from 7.3.9, including several
security-related issues.
_________________________________________________________________
Migration to version 7.3.10
A dump/restore is not required for those running 7.3.X. However, it is
one possible way of handling a significant security problem that has
been found in the initial contents of 7.3.X system catalogs. A
dump/initdb/reload sequence using 7.3.10's initdb will automatically
correct this problem.
The security problem is that the built-in character set encoding
conversion functions can be invoked from SQL commands by unprivileged
users, but the functions were not designed for such use and are not
secure against malicious choices of arguments. The fix involves
changing the declared parameter list of these functions so that they
can no longer be invoked from SQL commands. (This does not affect
their normal use by the encoding conversion machinery.) It is strongly
recommended that all installations repair this error, either by initdb
or by following the manual repair procedure given below. The error at
least allows unprivileged database users to crash their server
process, and may allow unprivileged users to gain the privileges of a
database superuser.
If you wish not to do an initdb, perform the following procedure
instead. As the database superuser, do:
BEGIN;
UPDATE pg_proc SET proargtypes[3] = 'internal'::regtype
WHERE pronamespace = 11 AND pronargs = 5
AND proargtypes[2] = 'cstring'::regtype;
-- The command should report having updated 90 rows;
-- if not, rollback and investigate instead of committing!
COMMIT;
The above procedure must be carried out in *each* database of an
installation, including template1, and ideally including template0 as
well. If you do not fix the template databases then any subsequently
created databases will contain the same error. template1 can be fixed
in the same way as any other database, but fixing template0 requires
additional steps. First, from any database issue
UPDATE pg_database SET datallowconn = true WHERE datname = 'template0';
Next connect to template0 and perform the above repair procedure.
Finally, do
-- re-freeze template0:
VACUUM FREEZE;
-- and protect it against future alterations:
UPDATE pg_database SET datallowconn = false WHERE datname = 'template0';
_________________________________________________________________
Changes
* Change encoding function signature to prevent misuse
* Fix comparisons of TIME WITH TIME ZONE values
The comparison code was wrong in the case where the
--enable-integer-datetimes configuration switch had been used.
NOTE: if you have an index on a TIME WITH TIME ZONE column, it
will need to be "REINDEX"ed after installing this update, because
the fix corrects the sort order of column values.
* Fix EXTRACT(EPOCH) for TIME WITH TIME ZONE values
* Fix mis-display of negative fractional seconds in INTERVAL values
This error only occurred when the --enable-integer-datetimes
configuration switch had been used.
* Additional buffer overrun checks in plpgsql (Neil)
* Fix pg_dump to dump trigger names containing % correctly (Neil)
* Prevent to_char(interval) from dumping core for month-related
formats
* Fix "contrib/pgcrypto" for newer OpenSSL builds (Marko Kreen)
* Still more 64-bit fixes for "contrib/intagg"
* Prevent incorrect optimization of functions returning RECORD
_________________________________________________________________
Release 7.3.9
Release date: 2005-01-31
@ -969,6 +1046,30 @@ Contrib
* Move /contrib/pg_controldata, pg_resetxlog into main tree (Bruce)
* Fixes to /contrib/cube (Bruno Wolff)
* Improve /contrib/fulltextindex (Christopher)
_________________________________________________________________
Release 7.2.8
Release date: 2005-05-05
This release contains a variety of fixes from 7.2.7, including one
security-related issue.
_________________________________________________________________
Migration to version 7.2.8
A dump/restore is not required for those running 7.2.X.
_________________________________________________________________
Changes
* Fix EXTRACT(EPOCH) for TIME WITH TIME ZONE values
* Additional buffer overrun checks in plpgsql (Neil)
* Fix pg_dump to dump index names and trigger names containing %
correctly (Neil)
* Prevent to_char(interval) from dumping core for month-related
formats
* Fix "contrib/pgcrypto" for newer OpenSSL builds (Marko Kreen)
_________________________________________________________________
Release 7.2.7

4
INSTALL
View File

@ -182,7 +182,7 @@ Substitute your paths appropriately.
if you need to do this.
To make the backup, you can use the "pg_dumpall" command from the version
you are currently running. For best results, however, try to use the
"pg_dumpall" command from PostgreSQL 7.3.9, since this version contains
"pg_dumpall" command from PostgreSQL 7.3.10, since this version contains
bug fixes and improvements over older versions. While this advice might
seem idiosyncratic since you haven't installed the new version yet, it is
advisable to follow it if you plan to install the new version in parallel
@ -214,7 +214,7 @@ Substitute your paths appropriately.
mv /usr/local/pgsql /usr/local/pgsql.old
After you have installed PostgreSQL 7.3.9, create a new database directory and
After you have installed PostgreSQL 7.3.10, create a new database directory and
start the new server. Remember that you must execute these commands while
logged in to the special database user account (which you already have if you
are upgrading).

18
configure vendored
View File

@ -1,6 +1,6 @@
#! /bin/sh
# Guess values for system-dependent variables and create Makefiles.
# Generated by GNU Autoconf 2.53 for PostgreSQL 7.3.9.
# Generated by GNU Autoconf 2.53 for PostgreSQL 7.3.10.
#
# Report bugs to <pgsql-bugs@postgresql.org>.
#
@ -258,8 +258,8 @@ SHELL=${CONFIG_SHELL-/bin/sh}
# Identity of this package.
PACKAGE_NAME='PostgreSQL'
PACKAGE_TARNAME='postgresql'
PACKAGE_VERSION='7.3.9'
PACKAGE_STRING='PostgreSQL 7.3.9'
PACKAGE_VERSION='7.3.10'
PACKAGE_STRING='PostgreSQL 7.3.10'
PACKAGE_BUGREPORT='pgsql-bugs@postgresql.org'
ac_unique_file="src/backend/access/common/heaptuple.c"
@ -769,7 +769,7 @@ if test "$ac_init_help" = "long"; then
# Omit some internal or obsolete options to make the list less imposing.
# This message is too long to be a string in the A/UX 3.1 sh.
cat <<_ACEOF
\`configure' configures PostgreSQL 7.3.9 to adapt to many kinds of systems.
\`configure' configures PostgreSQL 7.3.10 to adapt to many kinds of systems.
Usage: $0 [OPTION]... [VAR=VALUE]...
@ -830,7 +830,7 @@ fi
if test -n "$ac_init_help"; then
case $ac_init_help in
short | recursive ) echo "Configuration of PostgreSQL 7.3.9:";;
short | recursive ) echo "Configuration of PostgreSQL 7.3.10:";;
esac
cat <<\_ACEOF
@ -949,7 +949,7 @@ fi
test -n "$ac_init_help" && exit 0
if $ac_init_version; then
cat <<\_ACEOF
PostgreSQL configure 7.3.9
PostgreSQL configure 7.3.10
generated by GNU Autoconf 2.53
Copyright 1992, 1993, 1994, 1995, 1996, 1998, 1999, 2000, 2001, 2002
@ -966,7 +966,7 @@ cat >&5 <<_ACEOF
This file contains any messages produced by compilers while
running configure, to aid debugging if configure makes a mistake.
It was created by PostgreSQL $as_me 7.3.9, which was
It was created by PostgreSQL $as_me 7.3.10, which was
generated by GNU Autoconf 2.53. Invocation command line was
$ $0 $@
@ -16175,7 +16175,7 @@ _ASBOX
} >&5
cat >&5 <<_CSEOF
This file was extended by PostgreSQL $as_me 7.3.9, which was
This file was extended by PostgreSQL $as_me 7.3.10, which was
generated by GNU Autoconf 2.53. Invocation command line was
CONFIG_FILES = $CONFIG_FILES
@ -16237,7 +16237,7 @@ _ACEOF
cat >>$CONFIG_STATUS <<_ACEOF
ac_cs_version="\\
PostgreSQL config.status 7.3.9
PostgreSQL config.status 7.3.10
configured by $0, generated by GNU Autoconf 2.53,
with options \\"`echo "$ac_configure_args" | sed 's/[\\""\`\$]/\\\\&/g'`\\"

4
configure.in
View File

@ -1,5 +1,5 @@
dnl Process this file with autoconf to produce a configure script.
dnl $Header: /cvsroot/pgsql/configure.in,v 1.217.2.16 2005/01/30 20:08:14 tgl Exp $
dnl $Header: /cvsroot/pgsql/configure.in,v 1.217.2.17 2005/05/05 20:09:10 tgl Exp $
dnl
dnl Developers, please strive to achieve this order:
dnl
@ -21,7 +21,7 @@ dnl The GNU folks apparently haven't heard that some people don't use
dnl Texinfo. Use this sorcery to use "docdir" instead of "infodir".
m4_define([info], [doc])
m4_define([infodir], [docdir])
AC_INIT([PostgreSQL], [7.3.9], [pgsql-bugs@postgresql.org])
AC_INIT([PostgreSQL], [7.3.10], [pgsql-bugs@postgresql.org])
m4_undefine([infodir])
m4_undefine([info])
AC_SUBST(docdir)

2
doc/bug.template
View File

@ -31,7 +31,7 @@ System Configuration:
Operating System (example: Linux 2.4.18) :
PostgreSQL version (example: PostgreSQL 7.3.9): PostgreSQL 7.3.9
PostgreSQL version (example: PostgreSQL 7.3.10): PostgreSQL 7.3.10
Compiler used (example: gcc 3.3.5) :

157
doc/src/sgml/release.sgml
View File

@ -1,10 +1,125 @@
<!--
$Header: /cvsroot/pgsql/doc/src/sgml/release.sgml,v 1.163.2.20 2005/01/30 20:08:14 tgl Exp $
$Header: /cvsroot/pgsql/doc/src/sgml/release.sgml,v 1.163.2.21 2005/05/05 20:09:11 tgl Exp $
-->
<appendix id="release">
<title>Release Notes</title>
<sect1 id="release-7-3-10">
<title>Release 7.3.10</title>
<note>
<title>Release date</title>
<simpara>2005-05-05</simpara>
</note>
<para>
This release contains a variety of fixes from 7.3.9, including several
security-related issues.
</para>
<sect2>
<title>Migration to version 7.3.10</title>
<para>
A dump/restore is not required for those running 7.3.X. However,
it is one possible way of handling a significant security problem
that has been found in the initial contents of 7.3.X system
catalogs. A dump/initdb/reload sequence using 7.3.10's initdb will
automatically correct this problem.
</para>
<para>
The security problem is that the built-in character set encoding
conversion functions can be invoked from SQL commands by unprivileged
users, but the functions were not designed for such use and are not
secure against malicious choices of arguments. The fix involves changing
the declared parameter list of these functions so that they can no longer
be invoked from SQL commands. (This does not affect their normal use
by the encoding conversion machinery.)
It is strongly recommended that all installations repair this error,
either by initdb or by following the manual repair procedure given
below. The error at least allows unprivileged database users to crash
their server process, and may allow unprivileged users to gain the
privileges of a database superuser.
</para>
<para>
If you wish not to do an initdb, perform the following procedure instead.
As the database superuser, do:
<programlisting>
BEGIN;
UPDATE pg_proc SET proargtypes[3] = 'internal'::regtype
WHERE pronamespace = 11 AND pronargs = 5
AND proargtypes[2] = 'cstring'::regtype;
-- The command should report having updated 90 rows;
-- if not, rollback and investigate instead of committing!
COMMIT;
</programlisting>
</para>
<para>
The above procedure must be carried out in <emphasis>each</> database
of an installation, including <literal>template1</>, and ideally
including <literal>template0</> as well. If you do not fix the
template databases then any subsequently created databases will contain
the same error. <literal>template1</> can be fixed in the same way
as any other database, but fixing <literal>template0</> requires
additional steps. First, from any database issue
<programlisting>
UPDATE pg_database SET datallowconn = true WHERE datname = 'template0';
</programlisting>
Next connect to <literal>template0</> and perform the above repair
procedure. Finally, do
<programlisting>
-- re-freeze template0:
VACUUM FREEZE;
-- and protect it against future alterations:
UPDATE pg_database SET datallowconn = false WHERE datname = 'template0';
</programlisting>
</para>
</sect2>
<sect2>
<title>Changes</title>
<itemizedlist>
<listitem><para>Change encoding function signature to prevent
misuse</para></listitem>
<listitem><para>Fix comparisons of <type>TIME WITH TIME ZONE</> values</para>
<para>
The comparison code was wrong in the case where the
<literal>--enable-integer-datetimes</> configuration switch had been used.
NOTE: if you have an index on a <type>TIME WITH TIME ZONE</> column,
it will need to be <command>REINDEX</>ed after installing this update, because
the fix corrects the sort order of column values.
</para></listitem>
<listitem><para>Fix <function>EXTRACT(EPOCH)</> for
<type>TIME WITH TIME ZONE</> values</para></listitem>
<listitem><para>Fix mis-display of negative fractional seconds in
<type>INTERVAL</> values</para>
<para>
This error only occurred when the
<literal>--enable-integer-datetimes</> configuration switch had been used.
</para></listitem>
<listitem><para>Additional buffer overrun checks in plpgsql
(Neil)</para></listitem>
<listitem><para>Fix pg_dump to dump trigger names containing <literal>%</>
correctly (Neil)</para></listitem>
<listitem><para>Prevent <function>to_char(interval)</> from dumping core for
month-related formats</para></listitem>
<listitem><para>Fix <filename>contrib/pgcrypto</> for newer OpenSSL builds
(Marko Kreen)</para></listitem>
<listitem><para>Still more 64-bit fixes for
<filename>contrib/intagg</></para></listitem>
<listitem><para>Prevent incorrect optimization of functions returning
<type>RECORD</></para></listitem>
</itemizedlist>
</sect2>
</sect1>
<sect1 id="release-7-3-9">
<title>Release 7.3.9</title>
@ -1166,6 +1281,46 @@ operations on bytea columns (Joe)</para></listitem>
</sect2>
</sect1>
<sect1 id="release-7-2-8">
<title>Release 7.2.8</title>
<note>
<title>Release date</title>
<simpara>2005-05-05</simpara>
</note>
<para>
This release contains a variety of fixes from 7.2.7, including one
security-related issue.
</para>
<sect2>
<title>Migration to version 7.2.8</title>
<para>
A dump/restore is not required for those running 7.2.X.
</para>
</sect2>
<sect2>
<title>Changes</title>
<itemizedlist>
<listitem><para>Fix <function>EXTRACT(EPOCH)</> for
<type>TIME WITH TIME ZONE</> values</para></listitem>
<listitem><para>Additional buffer overrun checks in plpgsql
(Neil)</para></listitem>
<listitem><para>Fix pg_dump to dump index names and trigger names containing
<literal>%</> correctly (Neil)</para></listitem>
<listitem><para>Prevent <function>to_char(interval)</> from dumping core for
month-related formats</para></listitem>
<listitem><para>Fix <filename>contrib/pgcrypto</> for newer OpenSSL builds
(Marko Kreen)</para></listitem>
</itemizedlist>
</sect2>
</sect1>
<sect1 id="release-7-2-7">
<title>Release 7.2.7</title>

4
src/include/pg_config.h.win32
View File

@ -3,8 +3,8 @@
/*
* Parts of pg_config.h that you get with autoconf on other systems
*/
#define PG_VERSION "7.3.9"
#define PG_VERSION_STR "7.3.9 (win32)"
#define PG_VERSION "7.3.10"
#define PG_VERSION_STR "7.3.10 (win32)"
#define SYSCONFDIR ""

8
src/interfaces/libpq/libpq.rc
View File

@ -1,8 +1,8 @@
#include <winver.h>
VS_VERSION_INFO VERSIONINFO
FILEVERSION 7,3,9,0
PRODUCTVERSION 7,3,9,0
FILEVERSION 7,3,10,0
PRODUCTVERSION 7,3,10,0
FILEFLAGSMASK 0x3fL
FILEFLAGS 0
FILEOS VOS__WINDOWS32
@ -15,13 +15,13 @@ BEGIN
BEGIN
VALUE "CompanyName", "\0"
VALUE "FileDescription", "PostgreSQL Access Library\0"
VALUE "FileVersion", "7, 3, 9, 0\0"
VALUE "FileVersion", "7, 3, 10, 0\0"
VALUE "InternalName", "libpq\0"
VALUE "LegalCopyright", "Copyright (C) 2003\0"
VALUE "LegalTrademarks", "\0"
VALUE "OriginalFilename", "libpq.dll\0"
VALUE "ProductName", "PostgreSQL\0"
VALUE "ProductVersion", "7, 3, 9, 0\0"
VALUE "ProductVersion", "7, 3, 10, 0\0"
END
END
BLOCK "VarFileInfo"