database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-06-19 04:21:08 +03:00
Code Activity

pgindent run for 9.0, second run

Browse Source
This commit is contained in:
Bruce Momjian
2010-07-06 19:19:02 +00:00
parent 52783b212c
commit 239d769e7e
127 changed files with 1503 additions and 1417 deletions
Download Patch File Download Diff File Expand all files Collapse all files

61
src/backend/parser/parse_expr.c
View File

@ -8,7 +8,7 @@
*
*
* IDENTIFICATION
* $PostgreSQL: pgsql/src/backend/parser/parse_expr.c,v 1.255 2010/06/30 18:10:23 heikki Exp $
* $PostgreSQL: pgsql/src/backend/parser/parse_expr.c,v 1.256 2010/07/06 19:18:57 momjian Exp $
*
*-------------------------------------------------------------------------
*/
@ -1226,60 +1226,61 @@ transformFuncCall(ParseState *pstate, FuncCall *fn)
/* ... and hand off to ParseFuncOrColumn */
result = ParseFuncOrColumn(pstate,
fn->funcname,
targs,
fn->agg_order,
fn->agg_star,
fn->agg_distinct,
fn->func_variadic,
fn->over,
false,
fn->location);
fn->funcname,
targs,
fn->agg_order,
fn->agg_star,
fn->agg_distinct,
fn->func_variadic,
fn->over,
false,
fn->location);
/*
* pg_get_expr() is a system function that exposes the expression
* deparsing functionality in ruleutils.c to users. Very handy, but
* it was later realized that the functions in ruleutils.c don't check
* the input rigorously, assuming it to come from system catalogs and
* to therefore be valid. That makes it easy for a user to crash the
* backend by passing a maliciously crafted string representation of
* an expression to pg_get_expr().
* deparsing functionality in ruleutils.c to users. Very handy, but it was
* later realized that the functions in ruleutils.c don't check the input
* rigorously, assuming it to come from system catalogs and to therefore
* be valid. That makes it easy for a user to crash the backend by passing
* a maliciously crafted string representation of an expression to
* pg_get_expr().
*
* There's a lot of code in ruleutils.c, so it's not feasible to add
* water-proof input checking after the fact. Even if we did it once,
* it would need to be taken into account in any future patches too.
* water-proof input checking after the fact. Even if we did it once, it
* would need to be taken into account in any future patches too.
*
* Instead, we restrict pg_rule_expr() to only allow input from system
* catalogs instead. This is a hack, but it's the most robust and easiest
* to backpatch way of plugging the vulnerability.
*
* This is transparent to the typical usage pattern of
* "pg_get_expr(systemcolumn, ...)", but will break
* "pg_get_expr('foo', ...)", even if 'foo' is a valid expression fetched
* earlier from a system catalog. Hopefully there's isn't many clients
* doing that out there.
* "pg_get_expr(systemcolumn, ...)", but will break "pg_get_expr('foo',
* ...)", even if 'foo' is a valid expression fetched earlier from a
* system catalog. Hopefully there's isn't many clients doing that out
* there.
*/
if (result && IsA(result, FuncExpr) && !superuser())
if (result && IsA(result, FuncExpr) &&!superuser())
{
FuncExpr *fe = (FuncExpr *) result;
FuncExpr *fe = (FuncExpr *) result;
if (fe->funcid == F_PG_GET_EXPR || fe->funcid == F_PG_GET_EXPR_EXT)
{
Expr *arg = linitial(fe->args);
bool allowed = false;
Expr *arg = linitial(fe->args);
bool allowed = false;
/*
* Check that the argument came directly from one of the
* allowed system catalog columns
* Check that the argument came directly from one of the allowed
* system catalog columns
*/
if (IsA(arg, Var))
{
Var *var = (Var *) arg;
Var *var = (Var *) arg;
RangeTblEntry *rte;
rte = GetRTEByRangeTablePosn(pstate,
var->varno, var->varlevelsup);
switch(rte->relid)
switch (rte->relid)
{
case IndexRelationId:
if (var->varattno == Anum_pg_index_indexprs ||