pg_query 6.2.3 → 6.2.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c200160a0eb146a7f9fa38a6d9dd904e3ba617b82bb249af4677e8ea37279a91
-  data.tar.gz: 023c133937589b4edd3f3e156b11df6ad4d2940a661a21c3a1ab82574a853c80
+  metadata.gz: 562e4dee230d79e497d81f4b15b37574e084e183fc4ce722d62f3d30e4610315
+  data.tar.gz: bb92ff67386d19430475cf0e36fbb4ab1dbe971e77c3b0da2258b12d85cf3201
 SHA512:
-  metadata.gz: e4ccb4134993fabd3883cac1753e7da88fdab116e6e9915f58fc9d3ee659550f65d570e161d3c2033a4635c5898b5e89ee0c7039e92783bc423b7c7fc9e9523b
-  data.tar.gz: 2d143a73b0b1edf30f839e0804a2d010716a795312e26389aa17eee15cea94ed2c70c1b40210c3b092a014f68cbe633594db616c35db699b3a3119d17cea7303
+  metadata.gz: ca16555eccbf189e0248a9c6d8046d222232bb3fa030f4bb2c6693a5c9325fb361b8f649c33aeebf0837098c757e07c2117ee09847fe83980099c2a4c09a738a
+  data.tar.gz: 0ec4d547d4c33b645be78ab02ddaa7dc60c3c47a7c88ed58b4e586edd7cd0c2371e68858230b962586701511e1969aceab4448db9862b696f8266ee07b39abe9

data/CHANGELOG.md

@@ -2,7 +2,43 @@
 
 ## Unreleased
 
-* ...
+* Fix `#tables` dropping a relation when a CTE shares its name
+  - A non-recursive CTE is not visible inside its own definition, so
+    `WITH users AS (SELECT * FROM users) SELECT * FROM users` reads the `users`
+    table in the CTE body and the CTE in the outer query. Previously any
+    unqualified reference matching a CTE name was treated as the CTE, so this
+    returned `tables == []` and the relation was lost entirely.
+  - `WITH RECURSIVE` self-references are still correctly excluded, as are
+    references to a CTE that is already visible from an enclosing scope.
+  - DML/DDL targets are no longer treated as CTE references, since a CTE cannot
+    be the target of `INSERT`/`UPDATE`/`DELETE`/`COPY` or DDL. This fixes
+    `#dml_tables` being empty for e.g.
+    `WITH users AS (...) UPDATE users SET ...`.
+
+## 6.2.5     2026-09-30
+
+* Upgrade to libpg_query 17-6.2.5
+  - Security fix: Heap out-of-bounds write and read in `PgQuery.normalize` ([GHSA-6ggm-xmc9-8ffg](https://github.com/pganalyze/libpg_query/security/advisories/GHSA-6ggm-xmc9-8ffg))
+    - When normalizing certain utility statements (e.g. `DO ... LANGUAGE`, statements with
+      string options, or `CREATE/ALTER SUBSCRIPTION ... CONNECTION`), the normalizer
+      searched the query text for the location of string constants, which could yield
+      wrong locations for crafted input. This could cause out-of-bounds writes and reads
+      on the heap, leaking process memory in the normalized output or crashing the process.
+    - Constant locations are now recorded by the parser instead, and the normalizer checks
+      at runtime that constant locations never overlap
+    - This adds new location fields to the parse tree output (`DefElem.arg_location`,
+      `NotifyStmt.payload_location`, `CreateSubscriptionStmt.conninfo_location` and
+      `AlterSubscriptionStmt.conninfo_location`). Like other location fields, these are
+      ignored for fingerprinting.
+    - Applications that normalize untrusted query text should upgrade
+    - Reported by Paul Gerste (Cure53)
+  - Deparser: Add strict checking for unexpected pointer values
+    - This ensures that a bad input parse tree doesn't cause the deparser to crash, and
+      instead raises an error
+    - Reported by Paul Gerste (Cure53)
+  - Normalize:
+    - Add support for `NOTIFY` statements [#340](https://github.com/pganalyze/libpg_query/pull/340)
+    - Avoid undefined behaviour for overly large parameter references [#346](https://github.com/pganalyze/libpg_query/pull/346)
 
 ## 6.2.3     2026-08-26
 

data/Rakefile

@@ -5,8 +5,8 @@ require 'rspec/core/rake_task'
 require 'rubocop/rake_task'
 require 'open-uri'
 
-LIB_PG_QUERY_TAG = '17-6.2.3'.freeze
-LIB_PG_QUERY_SHA256SUM = '1049617789dd0bea1f6e59e15a6c4906e59045f2f5271836fdce68466efe8d87'.freeze
+LIB_PG_QUERY_TAG = '17-6.2.5'.freeze
+LIB_PG_QUERY_SHA256SUM = '344ee7a39d3fa4eb5e8cdff8aa7db514a30883423c65731c9ce04b2b7089abb6'.freeze
 
 Rake::ExtensionTask.new 'pg_query' do |ext|
   ext.lib_dir = 'lib/pg_query'

data/ext/pg_query/include/pg_query_fingerprint_defs.c

@@ -5754,6 +5754,8 @@ _fingerprintDefElem(FingerprintContext *ctx, const DefElem *node, const void *pa
     XXH3_freeState(prev);
   }
 
+  // Intentionally ignoring node->arg_location for fingerprinting
+
   if (true) {
     _fingerprintString(ctx, "defaction");
     _fingerprintString(ctx, _enumToStringDefElemAction(node->defaction));
@@ -13428,6 +13430,8 @@ _fingerprintNotifyStmt(FingerprintContext *ctx, const NotifyStmt *node, const vo
     _fingerprintString(ctx, node->payload);
   }
 
+  // Intentionally ignoring node->payload_location for fingerprinting
+
 }
 
 static void
@@ -14865,6 +14869,8 @@ _fingerprintCreateSubscriptionStmt(FingerprintContext *ctx, const CreateSubscrip
     _fingerprintString(ctx, node->conninfo);
   }
 
+  // Intentionally ignoring node->conninfo_location for fingerprinting
+
   if (node->options != NULL && node->options->length > 0) {
     XXH3_state_t* prev = XXH3_createState();
     XXH64_hash_t hash;
@@ -14912,6 +14918,8 @@ _fingerprintAlterSubscriptionStmt(FingerprintContext *ctx, const AlterSubscripti
     _fingerprintString(ctx, node->conninfo);
   }
 
+  // Intentionally ignoring node->conninfo_location for fingerprinting
+
   if (true) {
     _fingerprintString(ctx, "kind");
     _fingerprintString(ctx, _enumToStringAlterSubscriptionType(node->kind));

data/ext/pg_query/include/pg_query_outfuncs_defs.c

@@ -1234,6 +1234,7 @@ _outDefElem(OUT_TYPE(DefElem, DefElem) out, const DefElem *node)
   WRITE_NODE_PTR_FIELD(arg, arg, arg);
   WRITE_ENUM_FIELD(DefElemAction, defaction, defaction, defaction);
   WRITE_INT_FIELD(location, location, location);
+  WRITE_INT_FIELD(arg_location, arg_location, arg_location);
 }
 
 static void
@@ -2534,6 +2535,7 @@ _outNotifyStmt(OUT_TYPE(NotifyStmt, NotifyStmt) out, const NotifyStmt *node)
 {
   WRITE_STRING_FIELD(conditionname, conditionname, conditionname);
   WRITE_STRING_FIELD(payload, payload, payload);
+  WRITE_INT_FIELD(payload_location, payload_location, payload_location);
 }
 
 static void
@@ -2862,6 +2864,7 @@ _outCreateSubscriptionStmt(OUT_TYPE(CreateSubscriptionStmt, CreateSubscriptionSt
   WRITE_STRING_FIELD(conninfo, conninfo, conninfo);
   WRITE_LIST_FIELD(publication, publication, publication);
   WRITE_LIST_FIELD(options, options, options);
+  WRITE_INT_FIELD(conninfo_location, conninfo_location, conninfo_location);
 }
 
 static void
@@ -2872,6 +2875,7 @@ _outAlterSubscriptionStmt(OUT_TYPE(AlterSubscriptionStmt, AlterSubscriptionStmt)
   WRITE_STRING_FIELD(conninfo, conninfo, conninfo);
   WRITE_LIST_FIELD(publication, publication, publication);
   WRITE_LIST_FIELD(options, options, options);
+  WRITE_INT_FIELD(conninfo_location, conninfo_location, conninfo_location);
 }
 
 static void

data/ext/pg_query/include/pg_query_readfuncs_defs.c

@@ -1411,6 +1411,7 @@ _readDefElem(OUT_TYPE(DefElem, DefElem) msg)
   READ_NODE_PTR_FIELD(arg, arg, arg);
   READ_ENUM_FIELD(DefElemAction, defaction, defaction, defaction);
   READ_INT_FIELD(location, location, location);
+  READ_INT_FIELD(arg_location, arg_location, arg_location);
   return node;
 }
 
@@ -2966,6 +2967,7 @@ _readNotifyStmt(OUT_TYPE(NotifyStmt, NotifyStmt) msg)
   NotifyStmt *node = makeNode(NotifyStmt);
   READ_STRING_FIELD(conditionname, conditionname, conditionname);
   READ_STRING_FIELD(payload, payload, payload);
+  READ_INT_FIELD(payload_location, payload_location, payload_location);
   return node;
 }
 
@@ -3376,6 +3378,7 @@ _readCreateSubscriptionStmt(OUT_TYPE(CreateSubscriptionStmt, CreateSubscriptionS
   READ_STRING_FIELD(conninfo, conninfo, conninfo);
   READ_LIST_FIELD(publication, publication, publication);
   READ_LIST_FIELD(options, options, options);
+  READ_INT_FIELD(conninfo_location, conninfo_location, conninfo_location);
   return node;
 }
 
@@ -3388,6 +3391,7 @@ _readAlterSubscriptionStmt(OUT_TYPE(AlterSubscriptionStmt, AlterSubscriptionStmt
   READ_STRING_FIELD(conninfo, conninfo, conninfo);
   READ_LIST_FIELD(publication, publication, publication);
   READ_LIST_FIELD(options, options, options);
+  READ_INT_FIELD(conninfo_location, conninfo_location, conninfo_location);
   return node;
 }
 

data/ext/pg_query/include/postgres/copyfuncs.funcs.c

@@ -1378,6 +1378,7 @@ _copyDefElem(const DefElem *from)
 	COPY_NODE_FIELD(arg);
 	COPY_SCALAR_FIELD(defaction);
 	COPY_LOCATION_FIELD(location);
+	COPY_LOCATION_FIELD(arg_location);
 
 	return newnode;
 }
@@ -3174,6 +3175,7 @@ _copyNotifyStmt(const NotifyStmt *from)
 
 	COPY_STRING_FIELD(conditionname);
 	COPY_STRING_FIELD(payload);
+	COPY_LOCATION_FIELD(payload_location);
 
 	return newnode;
 }
@@ -3666,6 +3668,7 @@ _copyCreateSubscriptionStmt(const CreateSubscriptionStmt *from)
 	COPY_STRING_FIELD(conninfo);
 	COPY_NODE_FIELD(publication);
 	COPY_NODE_FIELD(options);
+	COPY_LOCATION_FIELD(conninfo_location);
 
 	return newnode;
 }
@@ -3680,6 +3683,7 @@ _copyAlterSubscriptionStmt(const AlterSubscriptionStmt *from)
 	COPY_STRING_FIELD(conninfo);
 	COPY_NODE_FIELD(publication);
 	COPY_NODE_FIELD(options);
+	COPY_LOCATION_FIELD(conninfo_location);
 
 	return newnode;
 }

data/ext/pg_query/include/postgres/equalfuncs.funcs.c

@@ -1191,6 +1191,7 @@ _equalDefElem(const DefElem *a, const DefElem *b)
 	COMPARE_NODE_FIELD(arg);
 	COMPARE_SCALAR_FIELD(defaction);
 	COMPARE_LOCATION_FIELD(location);
+	COMPARE_LOCATION_FIELD(arg_location);
 
 	return true;
 }
@@ -2737,6 +2738,7 @@ _equalNotifyStmt(const NotifyStmt *a, const NotifyStmt *b)
 {
 	COMPARE_STRING_FIELD(conditionname);
 	COMPARE_STRING_FIELD(payload);
+	COMPARE_LOCATION_FIELD(payload_location);
 
 	return true;
 }
@@ -3147,6 +3149,7 @@ _equalCreateSubscriptionStmt(const CreateSubscriptionStmt *a, const CreateSubscr
 	COMPARE_STRING_FIELD(conninfo);
 	COMPARE_NODE_FIELD(publication);
 	COMPARE_NODE_FIELD(options);
+	COMPARE_LOCATION_FIELD(conninfo_location);
 
 	return true;
 }
@@ -3159,6 +3162,7 @@ _equalAlterSubscriptionStmt(const AlterSubscriptionStmt *a, const AlterSubscript
 	COMPARE_STRING_FIELD(conninfo);
 	COMPARE_NODE_FIELD(publication);
 	COMPARE_NODE_FIELD(options);
+	COMPARE_LOCATION_FIELD(conninfo_location);
 
 	return true;
 }

data/ext/pg_query/include/postgres/nodes/parsenodes.h

@@ -817,6 +817,8 @@ typedef struct DefElem
 								 * TypeName */
 	DefElemAction defaction;	/* unspecified action, or SET/ADD/DROP */
 	ParseLoc	location;		/* token location, or -1 if unknown */
+	/* location of arg's string constant, or -1 if not a string constant */
+	ParseLoc	arg_location pg_node_attr(query_jumble_ignore);
 } DefElem;
 
 /*
@@ -3624,6 +3626,8 @@ typedef struct NotifyStmt
 	NodeTag		type;
 	char	   *conditionname;	/* condition name to notify */
 	char	   *payload;		/* the payload string, or NULL if none */
+	/* location of payload's string constant; only set when payload is */
+	ParseLoc	payload_location pg_node_attr(query_jumble_ignore);
 } NotifyStmt;
 
 /* ----------------------
@@ -4198,6 +4202,8 @@ typedef struct CreateSubscriptionStmt
 	char	   *conninfo;		/* Connection string to publisher */
 	List	   *publication;	/* One or more publication to subscribe to */
 	List	   *options;		/* List of DefElem nodes */
+	/* location of conninfo's string constant; only set when conninfo is */
+	ParseLoc	conninfo_location pg_node_attr(query_jumble_ignore);
 } CreateSubscriptionStmt;
 
 typedef enum AlterSubscriptionType
@@ -4220,6 +4226,8 @@ typedef struct AlterSubscriptionStmt
 	char	   *conninfo;		/* Connection string to publisher */
 	List	   *publication;	/* One or more publication to subscribe to */
 	List	   *options;		/* List of DefElem nodes */
+	/* location of conninfo's string constant; only set when conninfo is */
+	ParseLoc	conninfo_location pg_node_attr(query_jumble_ignore);
 } AlterSubscriptionStmt;
 
 typedef struct DropSubscriptionStmt