Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit5f17304

Browse files
committed
Avoid repeated name lookups during table and index DDL.
If the name lookups come to different conclusions due to concurrentactivity, we might perform some parts of the DDL on a different tablethan other parts. At least in the case of CREATE INDEX, this can beused to cause the permissions checks to be performed against adifferent table than the index creation, allowing for a privilegeescalation attack.This changes the calling convention for DefineIndex, CreateTrigger,transformIndexStmt, transformAlterTableStmt, CheckIndexCompatible(in 9.2 and newer), and AlterTable (in 9.1 and older). In addition,CheckRelationOwnership is removed in 9.2 and newer and the callingconvention is changed in older branches. A field has also been addedto the Constraint node (FkConstraint in 8.4). Third-party code callingthese functions or using the Constraint node will require updating.Report by Andres Freund. Patch by Robert Haas and Andres Freund,reviewed by Tom Lane.Security:CVE-2014-0062
1 parent540b4e5 commit5f17304

File tree

18 files changed

+233
-157
lines changed

18 files changed

+233
-157
lines changed

‎src/backend/bootstrap/bootparse.y

Lines changed: 15 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@
2727
#include"bootstrap/bootstrap.h"
2828
#include"catalog/catalog.h"
2929
#include"catalog/heap.h"
30+
#include"catalog/namespace.h"
3031
#include"catalog/pg_am.h"
3132
#include"catalog/pg_attribute.h"
3233
#include"catalog/pg_authid.h"
@@ -282,6 +283,7 @@ Boot_DeclareIndexStmt:
282283
XDECLAREINDEXboot_identoidspecONboot_identUSINGboot_identLPARENboot_index_paramsRPAREN
283284
{
284285
IndexStmt *stmt = makeNode(IndexStmt);
286+
OidrelationId;
285287

286288
do_start();
287289

@@ -303,7 +305,12 @@ Boot_DeclareIndexStmt:
303305
stmt->initdeferred =false;
304306
stmt->concurrent =false;
305307

306-
DefineIndex(stmt,
308+
/* locks and races need not concern us in bootstrap mode*/
309+
relationId = RangeVarGetRelid(stmt->relation, NoLock,
310+
false);
311+
312+
DefineIndex(relationId,
313+
stmt,
307314
$4,
308315
false,
309316
false,
@@ -317,6 +324,7 @@ Boot_DeclareUniqueIndexStmt:
317324
XDECLAREUNIQUEINDEXboot_identoidspecONboot_identUSINGboot_identLPARENboot_index_paramsRPAREN
318325
{
319326
IndexStmt *stmt = makeNode(IndexStmt);
327+
OidrelationId;
320328

321329
do_start();
322330

@@ -338,7 +346,12 @@ Boot_DeclareUniqueIndexStmt:
338346
stmt->initdeferred =false;
339347
stmt->concurrent =false;
340348

341-
DefineIndex(stmt,
349+
/* locks and races need not concern us in bootstrap mode*/
350+
relationId = RangeVarGetRelid(stmt->relation, NoLock,
351+
false);
352+
353+
DefineIndex(relationId,
354+
stmt,
342355
$5,
343356
false,
344357
false,

‎src/backend/catalog/index.c

Lines changed: 3 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1215,18 +1215,13 @@ index_constraint_create(Relation heapRelation,
12151215
*/
12161216
if (deferrable)
12171217
{
1218-
RangeVar*heapRel;
12191218
CreateTrigStmt*trigger;
12201219

1221-
heapRel=makeRangeVar(get_namespace_name(namespaceId),
1222-
pstrdup(RelationGetRelationName(heapRelation)),
1223-
-1);
1224-
12251220
trigger=makeNode(CreateTrigStmt);
12261221
trigger->trigname= (constraintType==CONSTRAINT_PRIMARY) ?
12271222
"PK_ConstraintTrigger" :
12281223
"Unique_ConstraintTrigger";
1229-
trigger->relation=heapRel;
1224+
trigger->relation=NULL;
12301225
trigger->funcname=SystemFuncName("unique_key_recheck");
12311226
trigger->args=NIL;
12321227
trigger->row= true;
@@ -1239,7 +1234,8 @@ index_constraint_create(Relation heapRelation,
12391234
trigger->initdeferred=initdeferred;
12401235
trigger->constrrel=NULL;
12411236

1242-
(void)CreateTrigger(trigger,NULL,conOid,indexRelationId, true);
1237+
(void)CreateTrigger(trigger,NULL,RelationGetRelid(heapRelation),
1238+
InvalidOid,conOid,indexRelationId, true);
12431239
}
12441240

12451241
/*

‎src/backend/catalog/pg_constraint.c

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -751,6 +751,25 @@ AlterConstraintNamespaces(Oid ownerId, Oid oldNspId,
751751
heap_close(conRel,RowExclusiveLock);
752752
}
753753

754+
/*
755+
* get_constraint_relation_oids
756+
*Find the IDs of the relations to which a constraint refers.
757+
*/
758+
void
759+
get_constraint_relation_oids(Oidconstraint_oid,Oid*conrelid,Oid*confrelid)
760+
{
761+
HeapTupletup;
762+
Form_pg_constraintcon;
763+
764+
tup=SearchSysCache1(CONSTROID,ObjectIdGetDatum(constraint_oid));
765+
if (!HeapTupleIsValid(tup))/* should not happen */
766+
elog(ERROR,"cache lookup failed for constraint %u",constraint_oid);
767+
con= (Form_pg_constraint)GETSTRUCT(tup);
768+
*conrelid=con->conrelid;
769+
*confrelid=con->confrelid;
770+
ReleaseSysCache(tup);
771+
}
772+
754773
/*
755774
* get_relation_constraint_oid
756775
*Find a constraint on the specified relation with the specified name.

‎src/backend/commands/indexcmds.c

Lines changed: 14 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -112,7 +112,6 @@ static void RangeVarCallbackForReindexIndex(const RangeVar *relation,
112112
*/
113113
bool
114114
CheckIndexCompatible(OidoldId,
115-
RangeVar*heapRelation,
116115
char*accessMethodName,
117116
List*attributeList,
118117
List*exclusionOpNames)
@@ -140,7 +139,7 @@ CheckIndexCompatible(Oid oldId,
140139
Datumd;
141140

142141
/* Caller should already have the relation locked in some way. */
143-
relationId=RangeVarGetRelid(heapRelation,NoLock, false);
142+
relationId=IndexGetRelation(oldId, false);
144143

145144
/*
146145
* We can pretend isconstraint = false unconditionally. It only serves to
@@ -280,6 +279,8 @@ CheckIndexCompatible(Oid oldId,
280279
* DefineIndex
281280
*Creates a new index.
282281
*
282+
* 'relationId': the OID of the heap relation on which the index is to be
283+
*created
283284
* 'stmt': IndexStmt describing the properties of the new index.
284285
* 'indexRelationId': normally InvalidOid, but during bootstrap can be
285286
*nonzero to specify a preselected OID for the index.
@@ -293,7 +294,8 @@ CheckIndexCompatible(Oid oldId,
293294
* Returns the OID of the created index.
294295
*/
295296
Oid
296-
DefineIndex(IndexStmt*stmt,
297+
DefineIndex(OidrelationId,
298+
IndexStmt*stmt,
297299
OidindexRelationId,
298300
boolis_alter_table,
299301
boolcheck_rights,
@@ -306,7 +308,6 @@ DefineIndex(IndexStmt *stmt,
306308
Oid*collationObjectId;
307309
Oid*classObjectId;
308310
OidaccessMethodId;
309-
OidrelationId;
310311
OidnamespaceId;
311312
OidtablespaceId;
312313
List*indexColNames;
@@ -325,6 +326,7 @@ DefineIndex(IndexStmt *stmt,
325326
intn_old_snapshots;
326327
LockRelIdheaprelid;
327328
LOCKTAGheaplocktag;
329+
LOCKMODElockmode;
328330
Snapshotsnapshot;
329331
inti;
330332

@@ -343,14 +345,18 @@ DefineIndex(IndexStmt *stmt,
343345
INDEX_MAX_KEYS)));
344346

345347
/*
346-
* Open heap relation, acquire a suitable lock on it, remember its OID
347-
*
348348
* Only SELECT ... FOR UPDATE/SHARE are allowed while doing a standard
349349
* index build; but for concurrent builds we allow INSERT/UPDATE/DELETE
350350
* (but not VACUUM).
351+
*
352+
* NB: Caller is responsible for making sure that relationId refers
353+
* to the relation on which the index should be built; except in bootstrap
354+
* mode, this will typically require the caller to have already locked
355+
* the relation. To avoid lock upgrade hazards, that lock should be at
356+
* least as strong as the one we take here.
351357
*/
352-
rel=heap_openrv(stmt->relation,
353-
(stmt->concurrent ?ShareUpdateExclusiveLock :ShareLock));
358+
lockmode=stmt->concurrent ?ShareUpdateExclusiveLock :ShareLock;
359+
rel=heap_open(relationId,lockmode);
354360

355361
relationId=RelationGetRelid(rel);
356362
namespaceId=RelationGetNamespace(rel);

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp