Re: PQescapestringConn not found in libpq.dll - Mailing list pgsql-general

Glyn Astill <glynastill@yahoo.co.uk> writes:
> Sorry to steer this off the topic a bit, but we have a 3rd party app that insists on using libpq.dll version
8.0.1.5031and we're on pgsql v 8.3.4.  
> Apart from lacking functionality, is there anything else I should be aware of i.e. could this cause us any serious
problems?

You really need to have a word with that application vendor.

I count the following noncosmetic patches applied to libpq in the 8.0
branch since 8.0.1.  Note that this only covers bugs considered serious
enough to back-patch, not feature improvements that are in more recent
branches.

2008-01-14 13:46  tgl

    * doc/src/sgml/protocol.sgml, src/interfaces/libpq/fe-protocol3.c
    (REL8_0_STABLE): Fix an ancient oversight in libpq's handling of
    V3-protocol COPY OUT mode: we need to be able to swallow NOTICE
    messages, and potentially also ParameterStatus messages (although
    the latter would be a bit weird), without exiting COPY OUT state.
    Fix it, and adjust the protocol documentation to emphasize the need
    for this.  Per off-list report from Alexander Galler.

2007-07-23 14:12  mha

    * src/interfaces/libpq/: fe-auth.c, fe-connect.c, libpq-int.h
    (REL8_0_STABLE): The correct min buffer size is
    INITIAL_EXPBUFFER_SIZE, not PQERRORMSG_LENGTH.

2006-05-21 16:20  tgl

    * doc/src/sgml/libpq.sgml, src/interfaces/libpq/exports.txt,
    src/interfaces/libpq/fe-connect.c, src/interfaces/libpq/fe-exec.c,
    src/interfaces/libpq/libpq-fe.h, src/interfaces/libpq/libpq-int.h
    (REL8_0_STABLE): Modify libpq's string-escaping routines to be
    aware of encoding considerations and standard_conforming_strings.
    The encoding changes are needed for proper escaping in multibyte
    encodings, as per the SQL-injection vulnerabilities noted in
    CVE-2006-2313 and CVE-2006-2314.  Concurrent fixes are being
    applied to the server to ensure that it rejects queries that may
    have been corrupted by attempted SQL injection, but this merely
    guarantees that unpatched clients will fail rather than allow
    injection.  An actual fix requires changing the client-side code.
    While at it we have also fixed these routines to understand about
    standard_conforming_strings, so that the upcoming changeover to
    SQL-spec string syntax can be somewhat transparent to client code.

    Since the existing API of PQescapeString and PQescapeBytea provides
    no way to inform them which settings are in use, these functions
    are now deprecated in favor of new functions PQescapeStringConn and
    PQescapeByteaConn.  The new functions take the PGconn to which the
    string will be sent as an additional parameter, and look inside the
    connection structure to determine what to do.  So as to provide
    some functionality for clients using the old functions, libpq
    stores the latest encoding and standard_conforming_strings values
    received from the backend in static variables, and the old
    functions consult these variables.  This will work reliably in
    clients using only one Postgres connection at a time, or even
    multiple connections if they all use the same encoding and string
    syntax settings; which should cover many practical scenarios.

    Clients that use homebrew escaping methods, such as PHP's
    addslashes() function or even hardwired regexp substitution, will
    require extra effort to fix :-(.  It is strongly recommended that
    such code be replaced by use of
    PQescapeStringConn/PQescapeByteaConn if at all feasible.

2006-05-21 15:57  momjian

    * contrib/dbmirror/DBMirror.pl, contrib/dbmirror/pending.c,
    contrib/tsearch/expected/tsearch.out,
    contrib/tsearch/sql/tsearch.sql,
    contrib/tsearch2/expected/tsearch2.out,
    contrib/tsearch2/sql/tsearch2.sql,
    src/backend/utils/adt/ruleutils.c, src/bin/initdb/initdb.c,
    src/bin/pg_dump/pg_dump.c, src/bin/psql/large_obj.c,
    src/interfaces/ecpg/test/test1.pgc, src/interfaces/libpq/fe-exec.c,
    src/pl/plpgsql/src/gram.y, src/tutorial/funcs.source
    (REL8_0_STABLE): Change \' to '', for SQL standards compliance.
    Backpatch to 7.3, 7.4, and 8.0.  Later releases already patched.

2006-04-19 12:15  tgl

    * src/interfaces/libpq/fe-print.c (REL8_0_STABLE): Fix ancient
    memory leak in PQprintTuples(); our code no longer uses this
    routine, but perhaps some applications do.  Found by Martijn van
    Oosterhout using Coverity.

2005-07-13 11:26  tgl

    * src/interfaces/libpq/fe-connect.c (REL8_0_STABLE): Fix libpq
    memory leak during PQreset() --- closePGconn() was not freeing all
    transient state of the PGconn object.

2005-07-08 11:24  tgl

    * src/interfaces/libpq/fe-misc.c (REL8_0_STABLE): Make
    libpq_gettext save and restore errno in a Windows-compatible way.
    Also, back-patch fix into back branches.

2005-05-05 12:36  momjian

    * src/interfaces/libpq/fe-connect.c (REL8_0_STABLE): Add
    WSACleanup() for Win32 socket cleanup.

    Jason Erickson

2005-03-24 19:35  tgl

    * configure, configure.in, src/backend/postmaster/pgstat.c,
    src/backend/postmaster/postmaster.c, src/include/port.h,
    src/interfaces/libpq/Makefile, src/interfaces/libpq/fe-auth.c,
    src/interfaces/libpq/fe-connect.c, src/port/noblock.c
    (REL8_0_STABLE): Kerberos fixes from Magnus Hagander --- in theory
    Kerberos 5 auth should work on Windows now.  Also, rename
    set_noblock to pg_set_noblock; since it is included in libpq, the
    former name polluted application namespace.

2005-03-13 17:04  momjian

    * src/interfaces/: ecpg/compatlib/Makefile, ecpg/ecpglib/Makefile,
    ecpg/pgtypeslib/Makefile, ecpg/preproc/Makefile, libpq/Makefile
    (REL8_0_STABLE): Increment all major version numbers in 8.0.X to
    force recompile of client aplications so 7.4.X releases can be
    installed on the same machine as 8.0.X.

            regards, tom lane