Fix RelationBuildPartitionKey's processing of partition key expressions.
authorTom Lane <tgl@sss.pgh.pa.us>
Mon, 5 Feb 2018 15:37:30 +0000 (10:37 -0500)
committerTom Lane <tgl@sss.pgh.pa.us>
Mon, 5 Feb 2018 15:37:30 +0000 (10:37 -0500)
commit3492a0af0bd37e7f23e27fd3f5537f414ee9ab9b
tree490de2a1f07c523b02d22e2c7d96c10082383925
parent05d0f13f0701d84e4e6784da336aabcc2dfc8ade
Fix RelationBuildPartitionKey's processing of partition key expressions.

Failure to advance the list pointer while reading partition expressions
from a list results in invoking an input function with inappropriate data,
possibly leading to crashes or, with carefully crafted input, disclosure
of arbitrary backend memory.

Bug discovered independently by Γlvaro Herrera and David Rowley.
This patch is by Γlvaro but owes something to David's proposed fix.
Back-patch to v10 where the issue was introduced.

Security: CVE-2018-1052
src/backend/utils/cache/relcache.c
src/test/regress/expected/create_table.out
src/test/regress/sql/create_table.sql