pgsql: Repair failure to check that a table is still compatible with a - Mailing list pgsql-committers

Log Message:
-----------
Repair failure to check that a table is still compatible with a previously
made query plan.  Use of ALTER COLUMN TYPE creates a hazard for cached
query plans: they could contain Vars that claim a column has a different
type than it now has.  Fix this by checking during plan startup that Vars
at relation scan level match the current relation tuple descriptor.  Since
at that point we already have at least AccessShareLock, we can be sure the
column type will not change underneath us later in the query.  However,
since a backend's locks do not conflict against itself, there is still a
hole for an attacker to exploit: he could try to execute ALTER COLUMN TYPE
while a query is in progress in the current backend.  Seal that hole by
rejecting ALTER TABLE whenever the target relation is already open in
the current backend.

This is a significant security hole: not only can one trivially crash the
backend, but with appropriate misuse of pass-by-reference datatypes it is
possible to read out arbitrary locations in the server process's memory,
which could allow retrieving database content the user should not be able
to see.  Our thanks to Jeff Trout for the initial report.

Security: CVE-2007-0556

Tags:
----
REL8_0_STABLE

Modified Files:
--------------
    pgsql/src/backend/commands:
        tablecmds.c (r1.142.4.6 -> r1.142.4.7)

(http://developer.postgresql.org/cvsweb.cgi/pgsql/src/backend/commands/tablecmds.c.diff?r1=1.142.4.6&r2=1.142.4.7)
    pgsql/src/backend/executor:
        execQual.c (r1.171.4.2 -> r1.171.4.3)

(http://developer.postgresql.org/cvsweb.cgi/pgsql/src/backend/executor/execQual.c.diff?r1=1.171.4.2&r2=1.171.4.3)
        execScan.c (r1.34.4.1 -> r1.34.4.2)
        (http://developer.postgresql.org/cvsweb.cgi/pgsql/src/backend/executor/execScan.c.diff?r1=1.34.4.1&r2=1.34.4.2)