Linux SRV-16 6.18.44-paas #1 SMP PREEMPT_DYNAMIC Thu Aug 13 10:08:12 UTC 2026 x86_64
/proc/thread-self/root/opt/postgresql-11/doc/html/
//proc/thread-self/root/opt/postgresql-11/doc/html/release-7-4-8.html
 <?xml version="1.0" encoding="UTF-8" standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><title>E.303. Release 7.4.8</title><link rel="stylesheet" type="text/css" href="stylesheet.css" /><link rev="made" href="pgsql-docs@postgresql.org" /><meta name="generator" content="DocBook XSL Stylesheets V1.79.1" /><link rel="prev" href="release-7-4-9.html" title="E.302. Release 7.4.9" /><link rel="next" href="release-7-4-7.html" title="E.304. Release 7.4.7" /></head><body><div xmlns="http://www.w3.org/TR/xhtml1/transitional" class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="5" align="center">E.303. Release 7.4.8</th></tr><tr><td width="10%" align="left"><a accesskey="p" href="release-7-4-9.html" title="E.302. Release 7.4.9">Prev</a> </td><td width="10%" align="left"><a accesskey="u" href="release.html" title="Appendix E. Release Notes">Up</a></td><th width="60%" align="center">Appendix E. Release Notes</th><td width="10%" align="right"><a accesskey="h" href="index.html" title="PostgreSQL 11.1 Documentation">Home</a></td><td width="10%" align="right"> <a accesskey="n" href="release-7-4-7.html" title="E.304. Release 7.4.7">Next</a></td></tr></table><hr></hr></div><div class="sect1" id="RELEASE-7-4-8"><div class="titlepage"><div><div><h2 class="title" style="clear: both">E.303. Release 7.4.8</h2></div></div></div><div class="toc"><dl class="toc"><dt><span class="sect2"><a href="release-7-4-8.html#id-1.11.6.307.4">E.303.1. Migration to Version 7.4.8</a></span></dt><dt><span class="sect2"><a href="release-7-4-8.html#id-1.11.6.307.5">E.303.2. Changes</a></span></dt></dl></div><p><strong>Release date: </strong>2005-05-09</p><p>
   This release contains a variety of fixes from 7.4.7, including several
   security-related issues.
   For information about new features in the 7.4 major release, see
   <a class="xref" href="release-7-4.html" title="E.311. Release 7.4">Section E.311</a>.
  </p><div class="sect2" id="id-1.11.6.307.4"><div class="titlepage"><div><div><h3 class="title">E.303.1. Migration to Version 7.4.8</h3></div></div></div><p>
    A dump/restore is not required for those running 7.4.X.  However,
    it is one possible way of handling two significant security problems
    that have been found in the initial contents of 7.4.X system
    catalogs.  A dump/initdb/reload sequence using 7.4.8's initdb will
    automatically correct these problems.
   </p><p>
    The larger security problem is that the built-in character set encoding
    conversion functions can be invoked from SQL commands by unprivileged
    users, but the functions were not designed for such use and are not
    secure against malicious choices of arguments.  The fix involves changing
    the declared parameter list of these functions so that they can no longer
    be invoked from SQL commands.  (This does not affect their normal use
    by the encoding conversion machinery.)
   </p><p>
    The lesser problem is that the <code class="filename">contrib/tsearch2</code> module
    creates several functions that are misdeclared to return
    <code class="type">internal</code> when they do not accept <code class="type">internal</code> arguments.
    This breaks type safety for all functions using <code class="type">internal</code>
    arguments.
   </p><p>
    It is strongly recommended that all installations repair these errors,
    either by initdb or by following the manual repair procedures given
    below.  The errors at least allow unprivileged database users to crash
    their server process, and might allow unprivileged users to gain the
    privileges of a database superuser.
   </p><p>
    If you wish not to do an initdb, perform the following procedures instead.
    As the database superuser, do:

</p><pre class="programlisting">
BEGIN;
UPDATE pg_proc SET proargtypes[3] = 'internal'::regtype
WHERE pronamespace = 11 AND pronargs = 5
     AND proargtypes[2] = 'cstring'::regtype;
-- The command should report having updated 90 rows;
-- if not, rollback and investigate instead of committing!
COMMIT;
</pre><p>

    Next, if you have installed <code class="filename">contrib/tsearch2</code>, do:

</p><pre class="programlisting">
BEGIN;
UPDATE pg_proc SET proargtypes[0] = 'internal'::regtype
WHERE oid IN (
   'dex_init(text)'::regprocedure,
   'snb_en_init(text)'::regprocedure,
   'snb_ru_init(text)'::regprocedure,
   'spell_init(text)'::regprocedure,
   'syn_init(text)'::regprocedure
);
-- The command should report having updated 5 rows;
-- if not, rollback and investigate instead of committing!
COMMIT;
</pre><p>

    If this command fails with a message like <span class="quote">“<span class="quote">function
    "dex_init(text)" does not exist</span>”</span>, then either <code class="filename">tsearch2</code>
    is not installed in this database, or you already did the update.
   </p><p>
    The above procedures must be carried out in <span class="emphasis"><em>each</em></span> database
    of an installation, including <code class="literal">template1</code>, and ideally
    including <code class="literal">template0</code> as well.  If you do not fix the
    template databases then any subsequently created databases will contain
    the same errors.  <code class="literal">template1</code> can be fixed in the same way
    as any other database, but fixing <code class="literal">template0</code> requires
    additional steps.  First, from any database issue:
</p><pre class="programlisting">
UPDATE pg_database SET datallowconn = true WHERE datname = 'template0';
</pre><p>
     Next connect to <code class="literal">template0</code> and perform the above repair
     procedures.  Finally, do:
</p><pre class="programlisting">
-- re-freeze template0:
VACUUM FREEZE;
-- and protect it against future alterations:
UPDATE pg_database SET datallowconn = false WHERE datname = 'template0';
</pre><p>
   </p></div><div class="sect2" id="id-1.11.6.307.5"><div class="titlepage"><div><div><h3 class="title">E.303.2. Changes</h3></div></div></div><div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem"><p>Change encoding function signature to prevent
misuse</p></li><li class="listitem"><p>Change <code class="filename">contrib/tsearch2</code> to avoid unsafe use of
<code class="type">INTERNAL</code> function results</p></li><li class="listitem"><p>Repair ancient race condition that allowed a transaction to be
seen as committed for some purposes (eg SELECT FOR UPDATE) slightly sooner
than for other purposes</p><p>This is an extremely serious bug since it could lead to apparent
data inconsistencies being briefly visible to applications.</p></li><li class="listitem"><p>Repair race condition between relation extension and
VACUUM</p><p>This could theoretically have caused loss of a page's worth of
freshly-inserted data, although the scenario seems of very low probability.
There are no known cases of it having caused more than an Assert failure.
</p></li><li class="listitem"><p>Fix comparisons of <code class="type">TIME WITH TIME ZONE</code> values</p><p>
The comparison code was wrong in the case where the
<code class="literal">--enable-integer-datetimes</code> configuration switch had been used.
NOTE: if you have an index on a <code class="type">TIME WITH TIME ZONE</code> column,
it will need to be <code class="command">REINDEX</code>ed after installing this update, because
the fix corrects the sort order of column values.
</p></li><li class="listitem"><p>Fix <code class="function">EXTRACT(EPOCH)</code> for
<code class="type">TIME WITH TIME ZONE</code> values</p></li><li class="listitem"><p>Fix mis-display of negative fractional seconds in
<code class="type">INTERVAL</code> values</p><p>
This error only occurred when the
<code class="literal">--enable-integer-datetimes</code> configuration switch had been used.
</p></li><li class="listitem"><p>Ensure operations done during backend shutdown are counted by
statistics collector</p><p>
This is expected to resolve reports of <span class="application">pg_autovacuum</span>
not vacuuming the system catalogs often enough — it was not being
told about catalog deletions caused by temporary table removal during
backend exit.
</p></li><li class="listitem"><p>Additional buffer overrun checks in plpgsql
(Neil)</p></li><li class="listitem"><p>Fix pg_dump to dump trigger names containing <code class="literal">%</code>
correctly (Neil)</p></li><li class="listitem"><p>Fix <code class="filename">contrib/pgcrypto</code> for newer OpenSSL builds
(Marko Kreen)</p></li><li class="listitem"><p>Still more 64-bit fixes for
<code class="filename">contrib/intagg</code></p></li><li class="listitem"><p>Prevent incorrect optimization of functions returning
<code class="type">RECORD</code></p></li><li class="listitem"><p>Prevent <code class="function">to_char(interval)</code> from dumping core for
month-related formats</p></li><li class="listitem"><p>Prevent crash on <code class="literal">COALESCE(NULL,NULL)</code></p></li><li class="listitem"><p>Fix <code class="function">array_map</code> to call PL functions correctly</p></li><li class="listitem"><p>Fix permission checking in <code class="command">ALTER DATABASE RENAME</code></p></li><li class="listitem"><p>Fix <code class="command">ALTER LANGUAGE RENAME</code></p></li><li class="listitem"><p>Make <code class="function">RemoveFromWaitQueue</code> clean up after itself</p><p>
This fixes a lock management error that would only be visible if a transaction
was kicked out of a wait for a lock (typically by query cancel) and then the
holder of the lock released it within a very narrow window.
</p></li><li class="listitem"><p>Fix problem with untyped parameter appearing in
<code class="command">INSERT ... SELECT</code></p></li><li class="listitem"><p>Fix <code class="command">CLUSTER</code> failure after
<code class="command">ALTER TABLE SET WITHOUT OIDS</code></p></li></ul></div></div></div><div class="navfooter"><hr /><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="release-7-4-9.html">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="release.html">Up</a></td><td width="40%" align="right"> <a accesskey="n" href="release-7-4-7.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">E.302. Release 7.4.9 </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> E.304. Release 7.4.7</td></tr></table></div></body></html>