E.16. Release 14.5
Prev | Up | Appendix E. Release Notes | Home | Next

## E.16. Release 14.5

Release date: 2022-08-11

This release contains a variety of fixes from 14.4. For information about new features in major release 14, see Section E.21.

### E.16.1. Migration to Version 14.5

A dump/restore is not required for those running 14.X.

However, if you are upgrading from a version earlier than 14.4, see Section E.17.

### E.16.2. Changes

- Do not let extension scripts replace objects not already belonging to the extension (Tom Lane) §

  This change prevents extension scripts from doing `CREATE OR REPLACE` if there is an existing object that does not belong to the extension. It also prevents `CREATE IF NOT EXISTS` in the same situation. This prevents a form of trojan-horse attack in which a hostile database user could become the owner of an extension object and then modify it to compromise future uses of the object by other users. As a side benefit, it also reduces the risk of accidentally replacing objects one did not mean to.

  The PostgreSQL Project thanks Sven Klemm for reporting this problem. (CVE-2022-2625)

- Fix replay of `CREATE DATABASE` WAL records on standby servers (Kyotaro Horiguchi, Asim R Praveen, Paul Guo) § § § §

  Standby servers may encounter missing tablespace directories when replaying database-creation WAL records. Prior to this patch, a standby would fail to recover in such a case; however, such directories could be legitimately missing. Create the tablespace (as a plain directory), then check that it has been dropped again once replay reaches a consistent state.

- Support “in place” tablespaces (Thomas Munro, Michael Paquier, Álvaro Herrera) § § §

  Normally a Postgres tablespace is a symbolic link to a directory on some other filesystem. This change allows it to just be a plain directory. While this has no use for separating tables onto different filesystems, it is a convenient setup for testing. Moreover, it is necessary to support the `CREATE DATABASE` replay fix, which transiently creates a missing tablespace as an “in place” tablespace.

- Fix permissions checks in `CREATE INDEX` (Nathan Bossart, Noah Misch) §

  The fix for CVE-2022-1552 caused `CREATE INDEX` to apply the table owner's permissions while performing lookups of operator classes and other objects, where formerly the calling user's permissions were used. This broke dump/restore scenarios, because pg_dump issues `CREATE INDEX` before re-granting permissions.

- In extended query protocol, force an immediate commit after `CREATE DATABASE` and other commands that can't run in a transaction block (Tom Lane) §

  If the client does not send a Sync message immediately after such a command, but instead sends another command, any failure in that command would lead to rolling back the preceding command, typically leaving inconsistent state on-disk (such as a missing or extra database directory). The mechanisms intended to prevent that situation turn out to work for multiple commands in a simple-Query message, but not for a series of extended-protocol messages. To prevent inconsistency without breaking use-cases that work today, force an implicit commit after such commands.

- Fix race condition when checking transaction visibility (Simon Riggs) §

  `TransactionIdIsInProgress` could report `false` before the subject transaction is considered visible, leading to various misbehaviors. The race condition window is normally very narrow, but use of synchronous replication makes it much wider, because the wait for a synchronous replica happens in that window.

- Fix incorrect plans when sorting by an expression that contains a non-top-level set-returning function (Richard Guo, Tom Lane) § §

- Fix incorrect permissions-checking code for extended statistics (Richard Guo) §

  If there are extended statistics on a table that the user has only partial `SELECT` permissions on, some queries would fail with “unrecognized node type” errors.

- Fix extended statistics machinery to handle MCV-type statistics on boolean-valued expressions (Tom Lane) §

  Statistics collection worked fine, but a query containing such an expression in `WHERE` would fail with “unknown clause type”.

- Avoid planner core dump with ``constant` = ANY(`array`)` clauses when there are MCV-type extended statistics on the `array` variable (Tom Lane) § §

- Fix `ALTER TABLE ... ENABLE/DISABLE TRIGGER` to handle recursion correctly for triggers on partitioned tables (Álvaro Herrera, Amit Langote) § §

  In certain cases, a “trigger does not exist” failure would occur because the command would try to adjust the trigger on a child partition that doesn't have it.

- Allow cancellation of `ANALYZE` while it is computing extended statistics (Tom Lane, Justin Pryzby) §

  In some scenarios with high statistics targets, it was possible to spend many seconds in an un-cancellable sort operation.

- Improve syntax error messages for type `jsonpath` (Andrew Dunstan) §

- Ensure that `pg_stop_backup()` cleans up session state properly (Fujii Masao) §

  This omission could lead to assertion failures or crashes later in the session.

- Fix `trim_array()` to handle a zero-dimensional array argument sanely (Martin Kalcher) §

- Fix join alias matching in `FOR [KEY] UPDATE/SHARE` clauses (Dean Rasheed) §

  In corner cases, a misleading error could be reported.

- Reject `ROW()` expressions and functions in `FROM` that have too many columns (Tom Lane) § §

  Cases with more than about 1600 columns are unsupported, and have always failed at execution. However, it emerges that some earlier code could be driven to assertion failures or crashes by queries with more than 32K columns. Add a parse-time check to prevent that.

- Fix dumping of a view using a function in `FROM` that returns a composite type, when column(s) of the composite type have been dropped since the view was made (Tom Lane) §

  This oversight could lead to dump/reload or pg_upgrade failures, as the dumped view would have too many column aliases for the function.

- Disallow nested backup operations in logical replication walsenders (Fujii Masao) §

- Fix memory leak in logical replication subscribers (Hou Zhijie) §

- Fix logical replication's checking of replica identity when the target table is partitioned (Shi Yu, Hou Zhijie) § §

  The replica identity columns have to be re-identified for the child partition.

- Fix failures to update cached schema data in a logical replication subscriber after a schema change on the publisher (Shi Yu, Hou Zhijie) § §

- Fix WAL consistency checking logic to correctly handle `BRIN_EVACUATE_PAGE` flags (Haiyang Wang) § §

- Fix erroneous assertion checks in shared hashtable management (Thomas Munro) §

- Avoid assertion failure when `min_dynamic_shared_memory` is set to a non-default value (Thomas Munro) §

- Arrange to clean up after commit-time errors within `SPI_commit()`, rather than expecting callers to do that (Peter Eisentraut, Tom Lane) § §

  Proper cleanup is complicated and requires use of low-level facilities, so it's not surprising that no known caller got it right. This led to misbehaviors when a PL procedure issued `COMMIT` but a failure occurred (such as a deferred constraint check). To improve matters, redefine `SPI_commit()` as starting a new transaction, so that it becomes equivalent to `SPI_commit_and_chain()` except that you get default transaction characteristics instead of preserving the prior transaction's characteristics. To make this somewhat transparent API-wise, redefine `SPI_start_transaction()` as a no-op. All known callers of `SPI_commit()` immediately call `SPI_start_transaction()`, so they will not notice any change. Similar remarks apply to `SPI_rollback()`.

  Also fix PL/Python, which omitted any handling of such errors at all, resulting in jumping out of the Python interpreter. This is reported to crash Python 3.11. Older Python releases leak some memory but seem okay with it otherwise.

- Improve libpq's handling of idle states in pipeline mode (Álvaro Herrera, Kyotaro Horiguchi) § §

  This fixes “message type 0x33 arrived from server while idle” warnings, as well as possible loss of end-of-query NULL results from `PQgetResult()`.

- Avoid core dump in ecpglib with unexpected orders of operations (Tom Lane) §

  Certain operations such as `EXEC SQL PREPARE` would crash (rather than reporting an error as expected) if called before establishing any database connection.

- In ecpglib, avoid redundant `newlocale()` calls (Noah Misch) § §

  Allocate a C locale object once per process when first connecting, rather than creating and freeing locale objects once per query. This mitigates a libc memory leak on AIX, and may offer some performance benefit everywhere.

- In psql's `\watch` command, echo a newline after cancellation with control-C (Pavel Stehule) §

  This prevents libedit (and possibly also libreadline) from becoming confused about which column the cursor is in.

- Fix pg_upgrade to detect non-upgradable usages of functions taking `anyarray` (Justin Pryzby) § §

  Version 14 changed some built-in functions to take type `anycompatiblearray` instead of `anyarray`. While this is mostly transparent, user-defined aggregates and operators built atop these functions have to be declared with exactly matching types. The presence of an object referencing the old signature will cause pg_upgrade to fail, so change it to detect and report such cases before beginning the upgrade.

- Fix possible report of wrong error condition after `clone()` failure in pg_upgrade with `--clone` option (Justin Pryzby) §

- Fix `contrib/pg_stat_statements` to avoid problems with very large query-text files on 32-bit platforms (Tom Lane) §

- In `contrib/postgres_fdw`, prevent batch insertion when there are `WITH CHECK OPTION` constraints (Etsuro Fujita) §

  Such constraints cannot be checked properly if more than one row is inserted at a time.

- Fix `contrib/postgres_fdw` to detect failure to send an asynchronous data fetch query (Fujii Masao) §

- Ensure that `contrib/postgres_fdw` sends constants of `regconfig` and other `reg*` types with proper schema qualification (Tom Lane) §

- Block signals while allocating dynamic shared memory on Linux (Thomas Munro) § § §

  This avoids problems when a signal interrupts `posix_fallocate()`.

- Detect unexpected `EEXIST` error from `shm_open()` (Thomas Munro) §

  This avoids a possible crash on Solaris.

- Avoid using `signalfd()` on illumos systems (Thomas Munro) §

  This appears to trigger hangs and kernel panics, so avoid the function until a fix is available.

Prev | Up | Next
E.15. Release 14.6 | Home | E.17. Release 14.4