1. 15 2月, 2008 1 次提交
    • T
      Sync our regex code with upstream changes since last time we did this, which · df1e965e
      Tom Lane 提交于
      was Tcl 8.4.8.  The main changes are to remove the never-fully-implemented
      code for multi-character collating elements, and to const-ify some stuff a
      bit more fully.  In combination with the recent security patch, this commit
      brings us into line with Tcl 8.5.0.
      
      Note that I didn't make any effort to duplicate a lot of cosmetic changes
      that they made to bring their copy into line with their own style
      guidelines, such as adding braces around single-line IF bodies.  Most of
      those we either had done already (such as ANSI-fication of function headers)
      or there is no point because pgindent would undo the change anyway.
      df1e965e
  2. 04 1月, 2008 1 次提交
    • T
      Fix assorted security-grade bugs in the regex engine. All of these problems · 98f27aae
      Tom Lane 提交于
      are shared with Tcl, since it's their code to begin with, and the patches
      have been copied from Tcl 8.5.0.  Problems:
      
      CVE-2007-4769: Inadequate check on the range of backref numbers allows
      crash due to out-of-bounds read.
      CVE-2007-4772: Infinite loop in regex optimizer for pattern '($|^)*'.
      CVE-2007-6067: Very slow optimizer cleanup for regex with a large NFA
      representation, as well as crash if we encounter an out-of-memory condition
      during NFA construction.
      
      Part of the response to CVE-2007-6067 is to put a limit on the number of
      states in the NFA representation of a regex.  This seems needed even though
      the within-the-code problems have been corrected, since otherwise the code
      could try to use very large amounts of memory for a suitably-crafted regex,
      leading to potential DOS by driving the system into swap, activating a kernel
      OOM killer, etc.
      
      Although there are certainly plenty of ways to drive the system into effective
      DOS with poorly-written SQL queries, these problems seem worth treating as
      security issues because many applications might accept regex search patterns
      from untrustworthy sources.
      
      Thanks to Will Drewry of Google for reporting these problems.  Patches by Will
      Drewry and Tom Lane.
      
      Security: CVE-2007-4769, CVE-2007-4772, CVE-2007-6067
      98f27aae
  3. 16 11月, 2007 1 次提交
  4. 07 10月, 2007 1 次提交
  5. 15 10月, 2005 1 次提交
  6. 30 11月, 2003 1 次提交
    • P
      · 969685ad
      PostgreSQL Daemon 提交于
      $Header: -> $PostgreSQL Changes ...
      969685ad
  7. 09 8月, 2003 1 次提交
  8. 04 8月, 2003 1 次提交
  9. 06 2月, 2003 1 次提交