diff options
| author | Alvaro Herrera <alvherre@alvh.no-ip.org> | 2022-05-18 20:28:31 +0200 |
|---|---|---|
| committer | Alvaro Herrera <alvherre@alvh.no-ip.org> | 2022-05-18 20:28:31 +0200 |
| commit | 80656f00f85668bb828c1eb878876e5bedcbf4c4 (patch) | |
| tree | e36ea5ffaa517fd4f07649bca5383f101ea0c666 /src/backend/parser | |
| parent | 2e9559b30239ce3cf69383ced208a72a7eb99335 (diff) | |
Check column list length in XMLTABLE/JSON_TABLE alias
We weren't checking the length of the column list in the alias clause of
an XMLTABLE or JSON_TABLE function (a "tablefunc" RTE), and it was
possible to make the server crash by passing an overly long one. Fix it
by throwing an error in that case, like the other places that deal with
alias lists.
In passing, modify the equivalent test used for join RTEs to look like
the other ones, which was different for no apparent reason.
This bug came in when XMLTABLE was born in version 10; backpatch to all
stable versions.
Reported-by: Wang Ke <krking@zju.edu.cn>
Discussion: https://postgr.es/m/17480-1c9d73565bb28e90@postgresql.org
Diffstat (limited to 'src/backend/parser')
| -rw-r--r-- | src/backend/parser/parse_clause.c | 15 | ||||
| -rw-r--r-- | src/backend/parser/parse_relation.c | 12 |
2 files changed, 12 insertions, 15 deletions
diff --git a/src/backend/parser/parse_clause.c b/src/backend/parser/parse_clause.c index edcaf276c0a..855e3b50b11 100644 --- a/src/backend/parser/parse_clause.c +++ b/src/backend/parser/parse_clause.c @@ -1435,21 +1435,6 @@ transformFromClauseItem(ParseState *pstate, Node *n, res_nscolumns + res_colindex); /* - * Check alias (AS clause), if any. - */ - if (j->alias) - { - if (j->alias->colnames != NIL) - { - if (list_length(j->alias->colnames) > list_length(res_colnames)) - ereport(ERROR, - (errcode(ERRCODE_SYNTAX_ERROR), - errmsg("column alias list for \"%s\" has too many entries", - j->alias->aliasname))); - } - } - - /* * Now build an RTE and nsitem for the result of the join. * res_nscolumns isn't totally done yet, but that's OK because * addRangeTableEntryForJoin doesn't examine it, only store a pointer. diff --git a/src/backend/parser/parse_relation.c b/src/backend/parser/parse_relation.c index af43a62cb25..12d1108c9ab 100644 --- a/src/backend/parser/parse_relation.c +++ b/src/backend/parser/parse_relation.c @@ -1963,6 +1963,12 @@ addRangeTableEntryForTableFunc(ParseState *pstate, eref->colnames = list_concat(eref->colnames, list_copy_tail(tf->colnames, numaliases)); + if (numaliases > list_length(tf->colnames)) + ereport(ERROR, + (errcode(ERRCODE_INVALID_COLUMN_REFERENCE), + errmsg("%s function has %d columns available but %d columns specified", + "XMLTABLE", list_length(tf->colnames), numaliases))); + rte->eref = eref; /* @@ -2140,6 +2146,12 @@ addRangeTableEntryForJoin(ParseState *pstate, eref->colnames = list_concat(eref->colnames, list_copy_tail(colnames, numaliases)); + if (numaliases > list_length(colnames)) + ereport(ERROR, + (errcode(ERRCODE_INVALID_COLUMN_REFERENCE), + errmsg("join expression \"%s\" has %d columns available but %d columns specified", + eref->aliasname, list_length(colnames), numaliases))); + rte->eref = eref; /* |