diff options
Diffstat (limited to 'src/backend/parser/parse_expr.c')
| -rw-r--r-- | src/backend/parser/parse_expr.c | 61 |
1 files changed, 31 insertions, 30 deletions
diff --git a/src/backend/parser/parse_expr.c b/src/backend/parser/parse_expr.c index 3d960089c3..5d4a3244c1 100644 --- a/src/backend/parser/parse_expr.c +++ b/src/backend/parser/parse_expr.c @@ -8,7 +8,7 @@ * * * IDENTIFICATION - * $PostgreSQL: pgsql/src/backend/parser/parse_expr.c,v 1.255 2010/06/30 18:10:23 heikki Exp $ + * $PostgreSQL: pgsql/src/backend/parser/parse_expr.c,v 1.256 2010/07/06 19:18:57 momjian Exp $ * *------------------------------------------------------------------------- */ @@ -1226,60 +1226,61 @@ transformFuncCall(ParseState *pstate, FuncCall *fn) /* ... and hand off to ParseFuncOrColumn */ result = ParseFuncOrColumn(pstate, - fn->funcname, - targs, - fn->agg_order, - fn->agg_star, - fn->agg_distinct, - fn->func_variadic, - fn->over, - false, - fn->location); + fn->funcname, + targs, + fn->agg_order, + fn->agg_star, + fn->agg_distinct, + fn->func_variadic, + fn->over, + false, + fn->location); /* * pg_get_expr() is a system function that exposes the expression - * deparsing functionality in ruleutils.c to users. Very handy, but - * it was later realized that the functions in ruleutils.c don't check - * the input rigorously, assuming it to come from system catalogs and - * to therefore be valid. That makes it easy for a user to crash the - * backend by passing a maliciously crafted string representation of - * an expression to pg_get_expr(). + * deparsing functionality in ruleutils.c to users. Very handy, but it was + * later realized that the functions in ruleutils.c don't check the input + * rigorously, assuming it to come from system catalogs and to therefore + * be valid. That makes it easy for a user to crash the backend by passing + * a maliciously crafted string representation of an expression to + * pg_get_expr(). * * There's a lot of code in ruleutils.c, so it's not feasible to add - * water-proof input checking after the fact. Even if we did it once, - * it would need to be taken into account in any future patches too. + * water-proof input checking after the fact. Even if we did it once, it + * would need to be taken into account in any future patches too. * * Instead, we restrict pg_rule_expr() to only allow input from system * catalogs instead. This is a hack, but it's the most robust and easiest * to backpatch way of plugging the vulnerability. * * This is transparent to the typical usage pattern of - * "pg_get_expr(systemcolumn, ...)", but will break - * "pg_get_expr('foo', ...)", even if 'foo' is a valid expression fetched - * earlier from a system catalog. Hopefully there's isn't many clients - * doing that out there. + * "pg_get_expr(systemcolumn, ...)", but will break "pg_get_expr('foo', + * ...)", even if 'foo' is a valid expression fetched earlier from a + * system catalog. Hopefully there's isn't many clients doing that out + * there. */ - if (result && IsA(result, FuncExpr) && !superuser()) + if (result && IsA(result, FuncExpr) &&!superuser()) { - FuncExpr *fe = (FuncExpr *) result; + FuncExpr *fe = (FuncExpr *) result; + if (fe->funcid == F_PG_GET_EXPR || fe->funcid == F_PG_GET_EXPR_EXT) { - Expr *arg = linitial(fe->args); - bool allowed = false; + Expr *arg = linitial(fe->args); + bool allowed = false; /* - * Check that the argument came directly from one of the - * allowed system catalog columns + * Check that the argument came directly from one of the allowed + * system catalog columns */ if (IsA(arg, Var)) { - Var *var = (Var *) arg; + Var *var = (Var *) arg; RangeTblEntry *rte; rte = GetRTEByRangeTablePosn(pstate, var->varno, var->varlevelsup); - switch(rte->relid) + switch (rte->relid) { case IndexRelationId: if (var->varattno == Anum_pg_index_indexprs || |