OSDN Git Service

Improved version of patch to protect pg_get_expr() against misuse:
[pg-rex/syncrep.git] / src / backend / parser / parse_func.c
1 /*-------------------------------------------------------------------------
2  *
3  * parse_func.c
4  *              handle function calls in parser
5  *
6  * Portions Copyright (c) 1996-2010, PostgreSQL Global Development Group
7  * Portions Copyright (c) 1994, Regents of the University of California
8  *
9  *
10  * IDENTIFICATION
11  *        $PostgreSQL: pgsql/src/backend/parser/parse_func.c,v 1.224.2.1 2010/07/29 23:16:41 tgl Exp $
12  *
13  *-------------------------------------------------------------------------
14  */
15 #include "postgres.h"
16
17 #include "catalog/pg_attrdef.h"
18 #include "catalog/pg_constraint.h"
19 #include "catalog/pg_proc.h"
20 #include "catalog/pg_type.h"
21 #include "funcapi.h"
22 #include "miscadmin.h"
23 #include "nodes/makefuncs.h"
24 #include "nodes/nodeFuncs.h"
25 #include "parser/parse_agg.h"
26 #include "parser/parse_coerce.h"
27 #include "parser/parse_func.h"
28 #include "parser/parse_relation.h"
29 #include "parser/parse_target.h"
30 #include "parser/parse_type.h"
31 #include "utils/builtins.h"
32 #include "utils/fmgroids.h"
33 #include "utils/lsyscache.h"
34 #include "utils/syscache.h"
35
36
37 static Oid      FuncNameAsType(List *funcname);
38 static Node *ParseComplexProjection(ParseState *pstate, char *funcname,
39                                            Node *first_arg, int location);
40
41
42 /*
43  *      Parse a function call
44  *
45  *      For historical reasons, Postgres tries to treat the notations tab.col
46  *      and col(tab) as equivalent: if a single-argument function call has an
47  *      argument of complex type and the (unqualified) function name matches
48  *      any attribute of the type, we take it as a column projection.  Conversely
49  *      a function of a single complex-type argument can be written like a
50  *      column reference, allowing functions to act like computed columns.
51  *
52  *      Hence, both cases come through here.  The is_column parameter tells us
53  *      which syntactic construct is actually being dealt with, but this is
54  *      intended to be used only to deliver an appropriate error message,
55  *      not to affect the semantics.  When is_column is true, we should have
56  *      a single argument (the putative table), unqualified function name
57  *      equal to the column name, and no aggregate or variadic decoration.
58  *      Also, when is_column is true, we return NULL on failure rather than
59  *      reporting a no-such-function error.
60  *
61  *      The argument expressions (in fargs) must have been transformed already.
62  *      But the agg_order expressions, if any, have not been.
63  */
64 Node *
65 ParseFuncOrColumn(ParseState *pstate, List *funcname, List *fargs,
66                                   List *agg_order, bool agg_star, bool agg_distinct,
67                                   bool func_variadic,
68                                   WindowDef *over, bool is_column, int location)
69 {
70         Oid                     rettype;
71         Oid                     funcid;
72         ListCell   *l;
73         ListCell   *nextl;
74         Node       *first_arg = NULL;
75         int                     nargs;
76         int                     nargsplusdefs;
77         Oid                     actual_arg_types[FUNC_MAX_ARGS];
78         Oid                *declared_arg_types;
79         List       *argnames;
80         List       *argdefaults;
81         Node       *retval;
82         bool            retset;
83         int                     nvargs;
84         FuncDetailCode fdresult;
85
86         /*
87          * Most of the rest of the parser just assumes that functions do not have
88          * more than FUNC_MAX_ARGS parameters.  We have to test here to protect
89          * against array overruns, etc.  Of course, this may not be a function,
90          * but the test doesn't hurt.
91          */
92         if (list_length(fargs) > FUNC_MAX_ARGS)
93                 ereport(ERROR,
94                                 (errcode(ERRCODE_TOO_MANY_ARGUMENTS),
95                          errmsg_plural("cannot pass more than %d argument to a function",
96                                                    "cannot pass more than %d arguments to a function",
97                                                    FUNC_MAX_ARGS,
98                                                    FUNC_MAX_ARGS),
99                                  parser_errposition(pstate, location)));
100
101         /*
102          * Extract arg type info in preparation for function lookup.
103          *
104          * If any arguments are Param markers of type VOID, we discard them from
105          * the parameter list.  This is a hack to allow the JDBC driver to not
106          * have to distinguish "input" and "output" parameter symbols while
107          * parsing function-call constructs.  We can't use foreach() because we
108          * may modify the list ...
109          */
110         nargs = 0;
111         for (l = list_head(fargs); l != NULL; l = nextl)
112         {
113                 Node       *arg = lfirst(l);
114                 Oid                     argtype = exprType(arg);
115
116                 nextl = lnext(l);
117
118                 if (argtype == VOIDOID && IsA(arg, Param) &&!is_column)
119                 {
120                         fargs = list_delete_ptr(fargs, arg);
121                         continue;
122                 }
123
124                 actual_arg_types[nargs++] = argtype;
125         }
126
127         /*
128          * Check for named arguments; if there are any, build a list of names.
129          *
130          * We allow mixed notation (some named and some not), but only with all
131          * the named parameters after all the unnamed ones.  So the name list
132          * corresponds to the last N actual parameters and we don't need any extra
133          * bookkeeping to match things up.
134          */
135         argnames = NIL;
136         foreach(l, fargs)
137         {
138                 Node       *arg = lfirst(l);
139
140                 if (IsA(arg, NamedArgExpr))
141                 {
142                         NamedArgExpr *na = (NamedArgExpr *) arg;
143                         ListCell   *lc;
144
145                         /* Reject duplicate arg names */
146                         foreach(lc, argnames)
147                         {
148                                 if (strcmp(na->name, (char *) lfirst(lc)) == 0)
149                                         ereport(ERROR,
150                                                         (errcode(ERRCODE_SYNTAX_ERROR),
151                                                    errmsg("argument name \"%s\" used more than once",
152                                                                   na->name),
153                                                          parser_errposition(pstate, na->location)));
154                         }
155                         argnames = lappend(argnames, na->name);
156                 }
157                 else
158                 {
159                         if (argnames != NIL)
160                                 ereport(ERROR,
161                                                 (errcode(ERRCODE_SYNTAX_ERROR),
162                                   errmsg("positional argument cannot follow named argument"),
163                                                  parser_errposition(pstate, exprLocation(arg))));
164                 }
165         }
166
167         if (fargs)
168         {
169                 first_arg = linitial(fargs);
170                 Assert(first_arg != NULL);
171         }
172
173         /*
174          * Check for column projection: if function has one argument, and that
175          * argument is of complex type, and function name is not qualified, then
176          * the "function call" could be a projection.  We also check that there
177          * wasn't any aggregate or variadic decoration, nor an argument name.
178          */
179         if (nargs == 1 && agg_order == NIL && !agg_star && !agg_distinct &&
180                 over == NULL && !func_variadic && argnames == NIL &&
181                 list_length(funcname) == 1)
182         {
183                 Oid                     argtype = actual_arg_types[0];
184
185                 if (argtype == RECORDOID || ISCOMPLEX(argtype))
186                 {
187                         retval = ParseComplexProjection(pstate,
188                                                                                         strVal(linitial(funcname)),
189                                                                                         first_arg,
190                                                                                         location);
191                         if (retval)
192                                 return retval;
193
194                         /*
195                          * If ParseComplexProjection doesn't recognize it as a projection,
196                          * just press on.
197                          */
198                 }
199         }
200
201         /*
202          * Okay, it's not a column projection, so it must really be a function.
203          * func_get_detail looks up the function in the catalogs, does
204          * disambiguation for polymorphic functions, handles inheritance, and
205          * returns the funcid and type and set or singleton status of the
206          * function's return value.  It also returns the true argument types to
207          * the function.
208          *
209          * Note: for a named-notation or variadic function call, the reported
210          * "true" types aren't really what is in pg_proc: the types are reordered
211          * to match the given argument order of named arguments, and a variadic
212          * argument is replaced by a suitable number of copies of its element
213          * type.  We'll fix up the variadic case below.  We may also have to deal
214          * with default arguments.
215          */
216         fdresult = func_get_detail(funcname, fargs, argnames, nargs,
217                                                            actual_arg_types,
218                                                            !func_variadic, true,
219                                                            &funcid, &rettype, &retset, &nvargs,
220                                                            &declared_arg_types, &argdefaults);
221         if (fdresult == FUNCDETAIL_COERCION)
222         {
223                 /*
224                  * We interpreted it as a type coercion. coerce_type can handle these
225                  * cases, so why duplicate code...
226                  */
227                 return coerce_type(pstate, linitial(fargs),
228                                                    actual_arg_types[0], rettype, -1,
229                                                    COERCION_EXPLICIT, COERCE_EXPLICIT_CALL, location);
230         }
231         else if (fdresult == FUNCDETAIL_NORMAL)
232         {
233                 /*
234                  * Normal function found; was there anything indicating it must be an
235                  * aggregate?
236                  */
237                 if (agg_star)
238                         ereport(ERROR,
239                                         (errcode(ERRCODE_WRONG_OBJECT_TYPE),
240                            errmsg("%s(*) specified, but %s is not an aggregate function",
241                                           NameListToString(funcname),
242                                           NameListToString(funcname)),
243                                          parser_errposition(pstate, location)));
244                 if (agg_distinct)
245                         ereport(ERROR,
246                                         (errcode(ERRCODE_WRONG_OBJECT_TYPE),
247                         errmsg("DISTINCT specified, but %s is not an aggregate function",
248                                    NameListToString(funcname)),
249                                          parser_errposition(pstate, location)));
250                 if (agg_order != NIL)
251                         ereport(ERROR,
252                                         (errcode(ERRCODE_WRONG_OBJECT_TYPE),
253                         errmsg("ORDER BY specified, but %s is not an aggregate function",
254                                    NameListToString(funcname)),
255                                          parser_errposition(pstate, location)));
256                 if (over)
257                         ereport(ERROR,
258                                         (errcode(ERRCODE_WRONG_OBJECT_TYPE),
259                                          errmsg("OVER specified, but %s is not a window function nor an aggregate function",
260                                                         NameListToString(funcname)),
261                                          parser_errposition(pstate, location)));
262         }
263         else if (!(fdresult == FUNCDETAIL_AGGREGATE ||
264                            fdresult == FUNCDETAIL_WINDOWFUNC))
265         {
266                 /*
267                  * Oops.  Time to die.
268                  *
269                  * If we are dealing with the attribute notation rel.function, let the
270                  * caller handle failure.
271                  */
272                 if (is_column)
273                         return NULL;
274
275                 /*
276                  * Else generate a detailed complaint for a function
277                  */
278                 if (fdresult == FUNCDETAIL_MULTIPLE)
279                         ereport(ERROR,
280                                         (errcode(ERRCODE_AMBIGUOUS_FUNCTION),
281                                          errmsg("function %s is not unique",
282                                                         func_signature_string(funcname, nargs, argnames,
283                                                                                                   actual_arg_types)),
284                                          errhint("Could not choose a best candidate function. "
285                                                          "You might need to add explicit type casts."),
286                                          parser_errposition(pstate, location)));
287                 else
288                         ereport(ERROR,
289                                         (errcode(ERRCODE_UNDEFINED_FUNCTION),
290                                          errmsg("function %s does not exist",
291                                                         func_signature_string(funcname, nargs, argnames,
292                                                                                                   actual_arg_types)),
293                         errhint("No function matches the given name and argument types. "
294                                         "You might need to add explicit type casts."),
295                                          parser_errposition(pstate, location)));
296         }
297
298         /*
299          * If there are default arguments, we have to include their types in
300          * actual_arg_types for the purpose of checking generic type consistency.
301          * However, we do NOT put them into the generated parse node, because
302          * their actual values might change before the query gets run.  The
303          * planner has to insert the up-to-date values at plan time.
304          */
305         nargsplusdefs = nargs;
306         foreach(l, argdefaults)
307         {
308                 Node       *expr = (Node *) lfirst(l);
309
310                 /* probably shouldn't happen ... */
311                 if (nargsplusdefs >= FUNC_MAX_ARGS)
312                         ereport(ERROR,
313                                         (errcode(ERRCODE_TOO_MANY_ARGUMENTS),
314                          errmsg_plural("cannot pass more than %d argument to a function",
315                                                    "cannot pass more than %d arguments to a function",
316                                                    FUNC_MAX_ARGS,
317                                                    FUNC_MAX_ARGS),
318                                          parser_errposition(pstate, location)));
319
320                 actual_arg_types[nargsplusdefs++] = exprType(expr);
321         }
322
323         /*
324          * enforce consistency with polymorphic argument and return types,
325          * possibly adjusting return type or declared_arg_types (which will be
326          * used as the cast destination by make_fn_arguments)
327          */
328         rettype = enforce_generic_type_consistency(actual_arg_types,
329                                                                                            declared_arg_types,
330                                                                                            nargsplusdefs,
331                                                                                            rettype,
332                                                                                            false);
333
334         /* perform the necessary typecasting of arguments */
335         make_fn_arguments(pstate, fargs, actual_arg_types, declared_arg_types);
336
337         /*
338          * If it's a variadic function call, transform the last nvargs arguments
339          * into an array --- unless it's an "any" variadic.
340          */
341         if (nvargs > 0 && declared_arg_types[nargs - 1] != ANYOID)
342         {
343                 ArrayExpr  *newa = makeNode(ArrayExpr);
344                 int                     non_var_args = nargs - nvargs;
345                 List       *vargs;
346
347                 Assert(non_var_args >= 0);
348                 vargs = list_copy_tail(fargs, non_var_args);
349                 fargs = list_truncate(fargs, non_var_args);
350
351                 newa->elements = vargs;
352                 /* assume all the variadic arguments were coerced to the same type */
353                 newa->element_typeid = exprType((Node *) linitial(vargs));
354                 newa->array_typeid = get_array_type(newa->element_typeid);
355                 if (!OidIsValid(newa->array_typeid))
356                         ereport(ERROR,
357                                         (errcode(ERRCODE_UNDEFINED_OBJECT),
358                                          errmsg("could not find array type for data type %s",
359                                                         format_type_be(newa->element_typeid)),
360                                   parser_errposition(pstate, exprLocation((Node *) vargs))));
361                 newa->multidims = false;
362                 newa->location = exprLocation((Node *) vargs);
363
364                 fargs = lappend(fargs, newa);
365         }
366
367         /* build the appropriate output structure */
368         if (fdresult == FUNCDETAIL_NORMAL)
369         {
370                 FuncExpr   *funcexpr = makeNode(FuncExpr);
371
372                 funcexpr->funcid = funcid;
373                 funcexpr->funcresulttype = rettype;
374                 funcexpr->funcretset = retset;
375                 funcexpr->funcformat = COERCE_EXPLICIT_CALL;
376                 funcexpr->args = fargs;
377                 funcexpr->location = location;
378
379                 retval = (Node *) funcexpr;
380         }
381         else if (fdresult == FUNCDETAIL_AGGREGATE && !over)
382         {
383                 /* aggregate function */
384                 Aggref     *aggref = makeNode(Aggref);
385
386                 aggref->aggfnoid = funcid;
387                 aggref->aggtype = rettype;
388                 /* args, aggorder, aggdistinct will be set by transformAggregateCall */
389                 aggref->aggstar = agg_star;
390                 /* agglevelsup will be set by transformAggregateCall */
391                 aggref->location = location;
392
393                 /*
394                  * Reject attempt to call a parameterless aggregate without (*)
395                  * syntax.      This is mere pedantry but some folks insisted ...
396                  */
397                 if (fargs == NIL && !agg_star)
398                         ereport(ERROR,
399                                         (errcode(ERRCODE_WRONG_OBJECT_TYPE),
400                                          errmsg("%s(*) must be used to call a parameterless aggregate function",
401                                                         NameListToString(funcname)),
402                                          parser_errposition(pstate, location)));
403
404                 if (retset)
405                         ereport(ERROR,
406                                         (errcode(ERRCODE_INVALID_FUNCTION_DEFINITION),
407                                          errmsg("aggregates cannot return sets"),
408                                          parser_errposition(pstate, location)));
409
410                 /*
411                  * Currently it's not possible to define an aggregate with named
412                  * arguments, so this case should be impossible.  Check anyway because
413                  * the planner and executor wouldn't cope with NamedArgExprs in an
414                  * Aggref node.
415                  */
416                 if (argnames != NIL)
417                         ereport(ERROR,
418                                         (errcode(ERRCODE_FEATURE_NOT_SUPPORTED),
419                                          errmsg("aggregates cannot use named arguments"),
420                                          parser_errposition(pstate, location)));
421
422                 /* parse_agg.c does additional aggregate-specific processing */
423                 transformAggregateCall(pstate, aggref, fargs, agg_order, agg_distinct);
424
425                 retval = (Node *) aggref;
426         }
427         else
428         {
429                 /* window function */
430                 WindowFunc *wfunc = makeNode(WindowFunc);
431
432                 /*
433                  * True window functions must be called with a window definition.
434                  */
435                 if (!over)
436                         ereport(ERROR,
437                                         (errcode(ERRCODE_WRONG_OBJECT_TYPE),
438                                          errmsg("window function call requires an OVER clause"),
439                                          parser_errposition(pstate, location)));
440
441                 wfunc->winfnoid = funcid;
442                 wfunc->wintype = rettype;
443                 wfunc->args = fargs;
444                 /* winref will be set by transformWindowFuncCall */
445                 wfunc->winstar = agg_star;
446                 wfunc->winagg = (fdresult == FUNCDETAIL_AGGREGATE);
447                 wfunc->location = location;
448
449                 /*
450                  * agg_star is allowed for aggregate functions but distinct isn't
451                  */
452                 if (agg_distinct)
453                         ereport(ERROR,
454                                         (errcode(ERRCODE_FEATURE_NOT_SUPPORTED),
455                                   errmsg("DISTINCT is not implemented for window functions"),
456                                          parser_errposition(pstate, location)));
457
458                 /*
459                  * Reject attempt to call a parameterless aggregate without (*)
460                  * syntax.      This is mere pedantry but some folks insisted ...
461                  */
462                 if (wfunc->winagg && fargs == NIL && !agg_star)
463                         ereport(ERROR,
464                                         (errcode(ERRCODE_WRONG_OBJECT_TYPE),
465                                          errmsg("%s(*) must be used to call a parameterless aggregate function",
466                                                         NameListToString(funcname)),
467                                          parser_errposition(pstate, location)));
468
469                 /*
470                  * ordered aggs not allowed in windows yet
471                  */
472                 if (agg_order != NIL)
473                         ereport(ERROR,
474                                         (errcode(ERRCODE_FEATURE_NOT_SUPPORTED),
475                                          errmsg("aggregate ORDER BY is not implemented for window functions"),
476                                          parser_errposition(pstate, location)));
477
478                 if (retset)
479                         ereport(ERROR,
480                                         (errcode(ERRCODE_INVALID_FUNCTION_DEFINITION),
481                                          errmsg("window functions cannot return sets"),
482                                          parser_errposition(pstate, location)));
483
484                 /*
485                  * We might want to support this later, but for now reject it because
486                  * the planner and executor wouldn't cope with NamedArgExprs in a
487                  * WindowFunc node.
488                  */
489                 if (argnames != NIL)
490                         ereport(ERROR,
491                                         (errcode(ERRCODE_FEATURE_NOT_SUPPORTED),
492                                          errmsg("window functions cannot use named arguments"),
493                                          parser_errposition(pstate, location)));
494
495                 /* parse_agg.c does additional window-func-specific processing */
496                 transformWindowFuncCall(pstate, wfunc, over);
497
498                 retval = (Node *) wfunc;
499         }
500
501         /* Hack to protect pg_get_expr() against misuse */
502         check_pg_get_expr_args(pstate, funcid, fargs);
503
504         return retval;
505 }
506
507
508 /* func_match_argtypes()
509  *
510  * Given a list of candidate functions (having the right name and number
511  * of arguments) and an array of input datatype OIDs, produce a shortlist of
512  * those candidates that actually accept the input datatypes (either exactly
513  * or by coercion), and return the number of such candidates.
514  *
515  * Note that can_coerce_type will assume that UNKNOWN inputs are coercible to
516  * anything, so candidates will not be eliminated on that basis.
517  *
518  * NB: okay to modify input list structure, as long as we find at least
519  * one match.  If no match at all, the list must remain unmodified.
520  */
521 int
522 func_match_argtypes(int nargs,
523                                         Oid *input_typeids,
524                                         FuncCandidateList raw_candidates,
525                                         FuncCandidateList *candidates)          /* return value */
526 {
527         FuncCandidateList current_candidate;
528         FuncCandidateList next_candidate;
529         int                     ncandidates = 0;
530
531         *candidates = NULL;
532
533         for (current_candidate = raw_candidates;
534                  current_candidate != NULL;
535                  current_candidate = next_candidate)
536         {
537                 next_candidate = current_candidate->next;
538                 if (can_coerce_type(nargs, input_typeids, current_candidate->args,
539                                                         COERCION_IMPLICIT))
540                 {
541                         current_candidate->next = *candidates;
542                         *candidates = current_candidate;
543                         ncandidates++;
544                 }
545         }
546
547         return ncandidates;
548 }       /* func_match_argtypes() */
549
550
551 /* func_select_candidate()
552  *              Given the input argtype array and more than one candidate
553  *              for the function, attempt to resolve the conflict.
554  *
555  * Returns the selected candidate if the conflict can be resolved,
556  * otherwise returns NULL.
557  *
558  * Note that the caller has already determined that there is no candidate
559  * exactly matching the input argtypes, and has pruned away any "candidates"
560  * that aren't actually coercion-compatible with the input types.
561  *
562  * This is also used for resolving ambiguous operator references.  Formerly
563  * parse_oper.c had its own, essentially duplicate code for the purpose.
564  * The following comments (formerly in parse_oper.c) are kept to record some
565  * of the history of these heuristics.
566  *
567  * OLD COMMENTS:
568  *
569  * This routine is new code, replacing binary_oper_select_candidate()
570  * which dates from v4.2/v1.0.x days. It tries very hard to match up
571  * operators with types, including allowing type coercions if necessary.
572  * The important thing is that the code do as much as possible,
573  * while _never_ doing the wrong thing, where "the wrong thing" would
574  * be returning an operator when other better choices are available,
575  * or returning an operator which is a non-intuitive possibility.
576  * - thomas 1998-05-21
577  *
578  * The comments below came from binary_oper_select_candidate(), and
579  * illustrate the issues and choices which are possible:
580  * - thomas 1998-05-20
581  *
582  * current wisdom holds that the default operator should be one in which
583  * both operands have the same type (there will only be one such
584  * operator)
585  *
586  * 7.27.93 - I have decided not to do this; it's too hard to justify, and
587  * it's easy enough to typecast explicitly - avi
588  * [the rest of this routine was commented out since then - ay]
589  *
590  * 6/23/95 - I don't complete agree with avi. In particular, casting
591  * floats is a pain for users. Whatever the rationale behind not doing
592  * this is, I need the following special case to work.
593  *
594  * In the WHERE clause of a query, if a float is specified without
595  * quotes, we treat it as float8. I added the float48* operators so
596  * that we can operate on float4 and float8. But now we have more than
597  * one matching operator if the right arg is unknown (eg. float
598  * specified with quotes). This break some stuff in the regression
599  * test where there are floats in quotes not properly casted. Below is
600  * the solution. In addition to requiring the operator operates on the
601  * same type for both operands [as in the code Avi originally
602  * commented out], we also require that the operators be equivalent in
603  * some sense. (see equivalentOpersAfterPromotion for details.)
604  * - ay 6/95
605  */
606 FuncCandidateList
607 func_select_candidate(int nargs,
608                                           Oid *input_typeids,
609                                           FuncCandidateList candidates)
610 {
611         FuncCandidateList current_candidate;
612         FuncCandidateList last_candidate;
613         Oid                *current_typeids;
614         Oid                     current_type;
615         int                     i;
616         int                     ncandidates;
617         int                     nbestMatch,
618                                 nmatch;
619         Oid                     input_base_typeids[FUNC_MAX_ARGS];
620         TYPCATEGORY slot_category[FUNC_MAX_ARGS],
621                                 current_category;
622         bool            current_is_preferred;
623         bool            slot_has_preferred_type[FUNC_MAX_ARGS];
624         bool            resolved_unknowns;
625
626         /* protect local fixed-size arrays */
627         if (nargs > FUNC_MAX_ARGS)
628                 ereport(ERROR,
629                                 (errcode(ERRCODE_TOO_MANY_ARGUMENTS),
630                          errmsg_plural("cannot pass more than %d argument to a function",
631                                                    "cannot pass more than %d arguments to a function",
632                                                    FUNC_MAX_ARGS,
633                                                    FUNC_MAX_ARGS)));
634
635         /*
636          * If any input types are domains, reduce them to their base types. This
637          * ensures that we will consider functions on the base type to be "exact
638          * matches" in the exact-match heuristic; it also makes it possible to do
639          * something useful with the type-category heuristics. Note that this
640          * makes it difficult, but not impossible, to use functions declared to
641          * take a domain as an input datatype.  Such a function will be selected
642          * over the base-type function only if it is an exact match at all
643          * argument positions, and so was already chosen by our caller.
644          */
645         for (i = 0; i < nargs; i++)
646                 input_base_typeids[i] = getBaseType(input_typeids[i]);
647
648         /*
649          * Run through all candidates and keep those with the most matches on
650          * exact types. Keep all candidates if none match.
651          */
652         ncandidates = 0;
653         nbestMatch = 0;
654         last_candidate = NULL;
655         for (current_candidate = candidates;
656                  current_candidate != NULL;
657                  current_candidate = current_candidate->next)
658         {
659                 current_typeids = current_candidate->args;
660                 nmatch = 0;
661                 for (i = 0; i < nargs; i++)
662                 {
663                         if (input_base_typeids[i] != UNKNOWNOID &&
664                                 current_typeids[i] == input_base_typeids[i])
665                                 nmatch++;
666                 }
667
668                 /* take this one as the best choice so far? */
669                 if ((nmatch > nbestMatch) || (last_candidate == NULL))
670                 {
671                         nbestMatch = nmatch;
672                         candidates = current_candidate;
673                         last_candidate = current_candidate;
674                         ncandidates = 1;
675                 }
676                 /* no worse than the last choice, so keep this one too? */
677                 else if (nmatch == nbestMatch)
678                 {
679                         last_candidate->next = current_candidate;
680                         last_candidate = current_candidate;
681                         ncandidates++;
682                 }
683                 /* otherwise, don't bother keeping this one... */
684         }
685
686         if (last_candidate)                     /* terminate rebuilt list */
687                 last_candidate->next = NULL;
688
689         if (ncandidates == 1)
690                 return candidates;
691
692         /*
693          * Still too many candidates? Now look for candidates which have either
694          * exact matches or preferred types at the args that will require
695          * coercion. (Restriction added in 7.4: preferred type must be of same
696          * category as input type; give no preference to cross-category
697          * conversions to preferred types.)  Keep all candidates if none match.
698          */
699         for (i = 0; i < nargs; i++) /* avoid multiple lookups */
700                 slot_category[i] = TypeCategory(input_base_typeids[i]);
701         ncandidates = 0;
702         nbestMatch = 0;
703         last_candidate = NULL;
704         for (current_candidate = candidates;
705                  current_candidate != NULL;
706                  current_candidate = current_candidate->next)
707         {
708                 current_typeids = current_candidate->args;
709                 nmatch = 0;
710                 for (i = 0; i < nargs; i++)
711                 {
712                         if (input_base_typeids[i] != UNKNOWNOID)
713                         {
714                                 if (current_typeids[i] == input_base_typeids[i] ||
715                                         IsPreferredType(slot_category[i], current_typeids[i]))
716                                         nmatch++;
717                         }
718                 }
719
720                 if ((nmatch > nbestMatch) || (last_candidate == NULL))
721                 {
722                         nbestMatch = nmatch;
723                         candidates = current_candidate;
724                         last_candidate = current_candidate;
725                         ncandidates = 1;
726                 }
727                 else if (nmatch == nbestMatch)
728                 {
729                         last_candidate->next = current_candidate;
730                         last_candidate = current_candidate;
731                         ncandidates++;
732                 }
733         }
734
735         if (last_candidate)                     /* terminate rebuilt list */
736                 last_candidate->next = NULL;
737
738         if (ncandidates == 1)
739                 return candidates;
740
741         /*
742          * Still too many candidates? Try assigning types for the unknown columns.
743          *
744          * NOTE: for a binary operator with one unknown and one non-unknown input,
745          * we already tried the heuristic of looking for a candidate with the
746          * known input type on both sides (see binary_oper_exact()). That's
747          * essentially a special case of the general algorithm we try next.
748          *
749          * We do this by examining each unknown argument position to see if we can
750          * determine a "type category" for it.  If any candidate has an input
751          * datatype of STRING category, use STRING category (this bias towards
752          * STRING is appropriate since unknown-type literals look like strings).
753          * Otherwise, if all the candidates agree on the type category of this
754          * argument position, use that category.  Otherwise, fail because we
755          * cannot determine a category.
756          *
757          * If we are able to determine a type category, also notice whether any of
758          * the candidates takes a preferred datatype within the category.
759          *
760          * Having completed this examination, remove candidates that accept the
761          * wrong category at any unknown position.      Also, if at least one
762          * candidate accepted a preferred type at a position, remove candidates
763          * that accept non-preferred types.
764          *
765          * If we are down to one candidate at the end, we win.
766          */
767         resolved_unknowns = false;
768         for (i = 0; i < nargs; i++)
769         {
770                 bool            have_conflict;
771
772                 if (input_base_typeids[i] != UNKNOWNOID)
773                         continue;
774                 resolved_unknowns = true;               /* assume we can do it */
775                 slot_category[i] = TYPCATEGORY_INVALID;
776                 slot_has_preferred_type[i] = false;
777                 have_conflict = false;
778                 for (current_candidate = candidates;
779                          current_candidate != NULL;
780                          current_candidate = current_candidate->next)
781                 {
782                         current_typeids = current_candidate->args;
783                         current_type = current_typeids[i];
784                         get_type_category_preferred(current_type,
785                                                                                 &current_category,
786                                                                                 &current_is_preferred);
787                         if (slot_category[i] == TYPCATEGORY_INVALID)
788                         {
789                                 /* first candidate */
790                                 slot_category[i] = current_category;
791                                 slot_has_preferred_type[i] = current_is_preferred;
792                         }
793                         else if (current_category == slot_category[i])
794                         {
795                                 /* more candidates in same category */
796                                 slot_has_preferred_type[i] |= current_is_preferred;
797                         }
798                         else
799                         {
800                                 /* category conflict! */
801                                 if (current_category == TYPCATEGORY_STRING)
802                                 {
803                                         /* STRING always wins if available */
804                                         slot_category[i] = current_category;
805                                         slot_has_preferred_type[i] = current_is_preferred;
806                                 }
807                                 else
808                                 {
809                                         /*
810                                          * Remember conflict, but keep going (might find STRING)
811                                          */
812                                         have_conflict = true;
813                                 }
814                         }
815                 }
816                 if (have_conflict && slot_category[i] != TYPCATEGORY_STRING)
817                 {
818                         /* Failed to resolve category conflict at this position */
819                         resolved_unknowns = false;
820                         break;
821                 }
822         }
823
824         if (resolved_unknowns)
825         {
826                 /* Strip non-matching candidates */
827                 ncandidates = 0;
828                 last_candidate = NULL;
829                 for (current_candidate = candidates;
830                          current_candidate != NULL;
831                          current_candidate = current_candidate->next)
832                 {
833                         bool            keepit = true;
834
835                         current_typeids = current_candidate->args;
836                         for (i = 0; i < nargs; i++)
837                         {
838                                 if (input_base_typeids[i] != UNKNOWNOID)
839                                         continue;
840                                 current_type = current_typeids[i];
841                                 get_type_category_preferred(current_type,
842                                                                                         &current_category,
843                                                                                         &current_is_preferred);
844                                 if (current_category != slot_category[i])
845                                 {
846                                         keepit = false;
847                                         break;
848                                 }
849                                 if (slot_has_preferred_type[i] && !current_is_preferred)
850                                 {
851                                         keepit = false;
852                                         break;
853                                 }
854                         }
855                         if (keepit)
856                         {
857                                 /* keep this candidate */
858                                 last_candidate = current_candidate;
859                                 ncandidates++;
860                         }
861                         else
862                         {
863                                 /* forget this candidate */
864                                 if (last_candidate)
865                                         last_candidate->next = current_candidate->next;
866                                 else
867                                         candidates = current_candidate->next;
868                         }
869                 }
870                 if (last_candidate)             /* terminate rebuilt list */
871                         last_candidate->next = NULL;
872         }
873
874         if (ncandidates == 1)
875                 return candidates;
876
877         return NULL;                            /* failed to select a best candidate */
878 }       /* func_select_candidate() */
879
880
881 /* func_get_detail()
882  *
883  * Find the named function in the system catalogs.
884  *
885  * Attempt to find the named function in the system catalogs with
886  * arguments exactly as specified, so that the normal case (exact match)
887  * is as quick as possible.
888  *
889  * If an exact match isn't found:
890  *      1) check for possible interpretation as a type coercion request
891  *      2) apply the ambiguous-function resolution rules
892  *
893  * Return values *funcid through *true_typeids receive info about the function.
894  * If argdefaults isn't NULL, *argdefaults receives a list of any default
895  * argument expressions that need to be added to the given arguments.
896  *
897  * When processing a named- or mixed-notation call (ie, fargnames isn't NIL),
898  * the returned true_typeids and argdefaults are ordered according to the
899  * call's argument ordering: first any positional arguments, then the named
900  * arguments, then defaulted arguments (if needed and allowed by
901  * expand_defaults).  Some care is needed if this information is to be compared
902  * to the function's pg_proc entry, but in practice the caller can usually
903  * just work with the call's argument ordering.
904  *
905  * We rely primarily on fargnames/nargs/argtypes as the argument description.
906  * The actual expression node list is passed in fargs so that we can check
907  * for type coercion of a constant.  Some callers pass fargs == NIL indicating
908  * they don't need that check made.  Note also that when fargnames isn't NIL,
909  * the fargs list must be passed if the caller wants actual argument position
910  * information to be returned into the NamedArgExpr nodes.
911  */
912 FuncDetailCode
913 func_get_detail(List *funcname,
914                                 List *fargs,
915                                 List *fargnames,
916                                 int nargs,
917                                 Oid *argtypes,
918                                 bool expand_variadic,
919                                 bool expand_defaults,
920                                 Oid *funcid,    /* return value */
921                                 Oid *rettype,   /* return value */
922                                 bool *retset,   /* return value */
923                                 int *nvargs,    /* return value */
924                                 Oid **true_typeids,             /* return value */
925                                 List **argdefaults)             /* optional return value */
926 {
927         FuncCandidateList raw_candidates;
928         FuncCandidateList best_candidate;
929
930         /* initialize output arguments to silence compiler warnings */
931         *funcid = InvalidOid;
932         *rettype = InvalidOid;
933         *retset = false;
934         *nvargs = 0;
935         *true_typeids = NULL;
936         if (argdefaults)
937                 *argdefaults = NIL;
938
939         /* Get list of possible candidates from namespace search */
940         raw_candidates = FuncnameGetCandidates(funcname, nargs, fargnames,
941                                                                                    expand_variadic, expand_defaults);
942
943         /*
944          * Quickly check if there is an exact match to the input datatypes (there
945          * can be only one)
946          */
947         for (best_candidate = raw_candidates;
948                  best_candidate != NULL;
949                  best_candidate = best_candidate->next)
950         {
951                 if (memcmp(argtypes, best_candidate->args, nargs * sizeof(Oid)) == 0)
952                         break;
953         }
954
955         if (best_candidate == NULL)
956         {
957                 /*
958                  * If we didn't find an exact match, next consider the possibility
959                  * that this is really a type-coercion request: a single-argument
960                  * function call where the function name is a type name.  If so, and
961                  * if the coercion path is RELABELTYPE or COERCEVIAIO, then go ahead
962                  * and treat the "function call" as a coercion.
963                  *
964                  * This interpretation needs to be given higher priority than
965                  * interpretations involving a type coercion followed by a function
966                  * call, otherwise we can produce surprising results. For example, we
967                  * want "text(varchar)" to be interpreted as a simple coercion, not as
968                  * "text(name(varchar))" which the code below this point is entirely
969                  * capable of selecting.
970                  *
971                  * We also treat a coercion of a previously-unknown-type literal
972                  * constant to a specific type this way.
973                  *
974                  * The reason we reject COERCION_PATH_FUNC here is that we expect the
975                  * cast implementation function to be named after the target type.
976                  * Thus the function will be found by normal lookup if appropriate.
977                  *
978                  * The reason we reject COERCION_PATH_ARRAYCOERCE is mainly that you
979                  * can't write "foo[] (something)" as a function call.  In theory
980                  * someone might want to invoke it as "_foo (something)" but we have
981                  * never supported that historically, so we can insist that people
982                  * write it as a normal cast instead.  Lack of historical support is
983                  * also the reason for not considering composite-type casts here.
984                  *
985                  * NB: it's important that this code does not exceed what coerce_type
986                  * can do, because the caller will try to apply coerce_type if we
987                  * return FUNCDETAIL_COERCION.  If we return that result for something
988                  * coerce_type can't handle, we'll cause infinite recursion between
989                  * this module and coerce_type!
990                  */
991                 if (nargs == 1 && fargs != NIL && fargnames == NIL)
992                 {
993                         Oid                     targetType = FuncNameAsType(funcname);
994
995                         if (OidIsValid(targetType))
996                         {
997                                 Oid                     sourceType = argtypes[0];
998                                 Node       *arg1 = linitial(fargs);
999                                 bool            iscoercion;
1000
1001                                 if (sourceType == UNKNOWNOID && IsA(arg1, Const))
1002                                 {
1003                                         /* always treat typename('literal') as coercion */
1004                                         iscoercion = true;
1005                                 }
1006                                 else
1007                                 {
1008                                         CoercionPathType cpathtype;
1009                                         Oid                     cfuncid;
1010
1011                                         cpathtype = find_coercion_pathway(targetType, sourceType,
1012                                                                                                           COERCION_EXPLICIT,
1013                                                                                                           &cfuncid);
1014                                         iscoercion = (cpathtype == COERCION_PATH_RELABELTYPE ||
1015                                                                   cpathtype == COERCION_PATH_COERCEVIAIO);
1016                                 }
1017
1018                                 if (iscoercion)
1019                                 {
1020                                         /* Treat it as a type coercion */
1021                                         *funcid = InvalidOid;
1022                                         *rettype = targetType;
1023                                         *retset = false;
1024                                         *nvargs = 0;
1025                                         *true_typeids = argtypes;
1026                                         return FUNCDETAIL_COERCION;
1027                                 }
1028                         }
1029                 }
1030
1031                 /*
1032                  * didn't find an exact match, so now try to match up candidates...
1033                  */
1034                 if (raw_candidates != NULL)
1035                 {
1036                         FuncCandidateList current_candidates;
1037                         int                     ncandidates;
1038
1039                         ncandidates = func_match_argtypes(nargs,
1040                                                                                           argtypes,
1041                                                                                           raw_candidates,
1042                                                                                           &current_candidates);
1043
1044                         /* one match only? then run with it... */
1045                         if (ncandidates == 1)
1046                                 best_candidate = current_candidates;
1047
1048                         /*
1049                          * multiple candidates? then better decide or throw an error...
1050                          */
1051                         else if (ncandidates > 1)
1052                         {
1053                                 best_candidate = func_select_candidate(nargs,
1054                                                                                                            argtypes,
1055                                                                                                            current_candidates);
1056
1057                                 /*
1058                                  * If we were able to choose a best candidate, we're done.
1059                                  * Otherwise, ambiguous function call.
1060                                  */
1061                                 if (!best_candidate)
1062                                         return FUNCDETAIL_MULTIPLE;
1063                         }
1064                 }
1065         }
1066
1067         if (best_candidate)
1068         {
1069                 HeapTuple       ftup;
1070                 Form_pg_proc pform;
1071                 FuncDetailCode result;
1072
1073                 /*
1074                  * If processing named args or expanding variadics or defaults, the
1075                  * "best candidate" might represent multiple equivalently good
1076                  * functions; treat this case as ambiguous.
1077                  */
1078                 if (!OidIsValid(best_candidate->oid))
1079                         return FUNCDETAIL_MULTIPLE;
1080
1081                 /*
1082                  * We disallow VARIADIC with named arguments unless the last argument
1083                  * (the one with VARIADIC attached) actually matched the variadic
1084                  * parameter.  This is mere pedantry, really, but some folks insisted.
1085                  */
1086                 if (fargnames != NIL && !expand_variadic && nargs > 0 &&
1087                         best_candidate->argnumbers[nargs - 1] != nargs - 1)
1088                         return FUNCDETAIL_NOTFOUND;
1089
1090                 *funcid = best_candidate->oid;
1091                 *nvargs = best_candidate->nvargs;
1092                 *true_typeids = best_candidate->args;
1093
1094                 /*
1095                  * If processing named args, return actual argument positions into
1096                  * NamedArgExpr nodes in the fargs list.  This is a bit ugly but not
1097                  * worth the extra notation needed to do it differently.
1098                  */
1099                 if (best_candidate->argnumbers != NULL)
1100                 {
1101                         int                     i = 0;
1102                         ListCell   *lc;
1103
1104                         foreach(lc, fargs)
1105                         {
1106                                 NamedArgExpr *na = (NamedArgExpr *) lfirst(lc);
1107
1108                                 if (IsA(na, NamedArgExpr))
1109                                         na->argnumber = best_candidate->argnumbers[i];
1110                                 i++;
1111                         }
1112                 }
1113
1114                 ftup = SearchSysCache1(PROCOID,
1115                                                            ObjectIdGetDatum(best_candidate->oid));
1116                 if (!HeapTupleIsValid(ftup))    /* should not happen */
1117                         elog(ERROR, "cache lookup failed for function %u",
1118                                  best_candidate->oid);
1119                 pform = (Form_pg_proc) GETSTRUCT(ftup);
1120                 *rettype = pform->prorettype;
1121                 *retset = pform->proretset;
1122                 /* fetch default args if caller wants 'em */
1123                 if (argdefaults && best_candidate->ndargs > 0)
1124                 {
1125                         Datum           proargdefaults;
1126                         bool            isnull;
1127                         char       *str;
1128                         List       *defaults;
1129
1130                         /* shouldn't happen, FuncnameGetCandidates messed up */
1131                         if (best_candidate->ndargs > pform->pronargdefaults)
1132                                 elog(ERROR, "not enough default arguments");
1133
1134                         proargdefaults = SysCacheGetAttr(PROCOID, ftup,
1135                                                                                          Anum_pg_proc_proargdefaults,
1136                                                                                          &isnull);
1137                         Assert(!isnull);
1138                         str = TextDatumGetCString(proargdefaults);
1139                         defaults = (List *) stringToNode(str);
1140                         Assert(IsA(defaults, List));
1141                         pfree(str);
1142
1143                         /* Delete any unused defaults from the returned list */
1144                         if (best_candidate->argnumbers != NULL)
1145                         {
1146                                 /*
1147                                  * This is a bit tricky in named notation, since the supplied
1148                                  * arguments could replace any subset of the defaults.  We
1149                                  * work by making a bitmapset of the argnumbers of defaulted
1150                                  * arguments, then scanning the defaults list and selecting
1151                                  * the needed items.  (This assumes that defaulted arguments
1152                                  * should be supplied in their positional order.)
1153                                  */
1154                                 Bitmapset  *defargnumbers;
1155                                 int                *firstdefarg;
1156                                 List       *newdefaults;
1157                                 ListCell   *lc;
1158                                 int                     i;
1159
1160                                 defargnumbers = NULL;
1161                                 firstdefarg = &best_candidate->argnumbers[best_candidate->nargs - best_candidate->ndargs];
1162                                 for (i = 0; i < best_candidate->ndargs; i++)
1163                                         defargnumbers = bms_add_member(defargnumbers,
1164                                                                                                    firstdefarg[i]);
1165                                 newdefaults = NIL;
1166                                 i = pform->pronargs - pform->pronargdefaults;
1167                                 foreach(lc, defaults)
1168                                 {
1169                                         if (bms_is_member(i, defargnumbers))
1170                                                 newdefaults = lappend(newdefaults, lfirst(lc));
1171                                         i++;
1172                                 }
1173                                 Assert(list_length(newdefaults) == best_candidate->ndargs);
1174                                 bms_free(defargnumbers);
1175                                 *argdefaults = newdefaults;
1176                         }
1177                         else
1178                         {
1179                                 /*
1180                                  * Defaults for positional notation are lots easier; just
1181                                  * remove any unwanted ones from the front.
1182                                  */
1183                                 int                     ndelete;
1184
1185                                 ndelete = list_length(defaults) - best_candidate->ndargs;
1186                                 while (ndelete-- > 0)
1187                                         defaults = list_delete_first(defaults);
1188                                 *argdefaults = defaults;
1189                         }
1190                 }
1191                 if (pform->proisagg)
1192                         result = FUNCDETAIL_AGGREGATE;
1193                 else if (pform->proiswindow)
1194                         result = FUNCDETAIL_WINDOWFUNC;
1195                 else
1196                         result = FUNCDETAIL_NORMAL;
1197                 ReleaseSysCache(ftup);
1198                 return result;
1199         }
1200
1201         return FUNCDETAIL_NOTFOUND;
1202 }
1203
1204
1205 /*
1206  * make_fn_arguments()
1207  *
1208  * Given the actual argument expressions for a function, and the desired
1209  * input types for the function, add any necessary typecasting to the
1210  * expression tree.  Caller should already have verified that casting is
1211  * allowed.
1212  *
1213  * Caution: given argument list is modified in-place.
1214  *
1215  * As with coerce_type, pstate may be NULL if no special unknown-Param
1216  * processing is wanted.
1217  */
1218 void
1219 make_fn_arguments(ParseState *pstate,
1220                                   List *fargs,
1221                                   Oid *actual_arg_types,
1222                                   Oid *declared_arg_types)
1223 {
1224         ListCell   *current_fargs;
1225         int                     i = 0;
1226
1227         foreach(current_fargs, fargs)
1228         {
1229                 /* types don't match? then force coercion using a function call... */
1230                 if (actual_arg_types[i] != declared_arg_types[i])
1231                 {
1232                         Node       *node = (Node *) lfirst(current_fargs);
1233
1234                         /*
1235                          * If arg is a NamedArgExpr, coerce its input expr instead --- we
1236                          * want the NamedArgExpr to stay at the top level of the list.
1237                          */
1238                         if (IsA(node, NamedArgExpr))
1239                         {
1240                                 NamedArgExpr *na = (NamedArgExpr *) node;
1241
1242                                 node = coerce_type(pstate,
1243                                                                    (Node *) na->arg,
1244                                                                    actual_arg_types[i],
1245                                                                    declared_arg_types[i], -1,
1246                                                                    COERCION_IMPLICIT,
1247                                                                    COERCE_IMPLICIT_CAST,
1248                                                                    -1);
1249                                 na->arg = (Expr *) node;
1250                         }
1251                         else
1252                         {
1253                                 node = coerce_type(pstate,
1254                                                                    node,
1255                                                                    actual_arg_types[i],
1256                                                                    declared_arg_types[i], -1,
1257                                                                    COERCION_IMPLICIT,
1258                                                                    COERCE_IMPLICIT_CAST,
1259                                                                    -1);
1260                                 lfirst(current_fargs) = node;
1261                         }
1262                 }
1263                 i++;
1264         }
1265 }
1266
1267 /*
1268  * FuncNameAsType -
1269  *        convenience routine to see if a function name matches a type name
1270  *
1271  * Returns the OID of the matching type, or InvalidOid if none.  We ignore
1272  * shell types and complex types.
1273  */
1274 static Oid
1275 FuncNameAsType(List *funcname)
1276 {
1277         Oid                     result;
1278         Type            typtup;
1279
1280         typtup = LookupTypeName(NULL, makeTypeNameFromNameList(funcname), NULL);
1281         if (typtup == NULL)
1282                 return InvalidOid;
1283
1284         if (((Form_pg_type) GETSTRUCT(typtup))->typisdefined &&
1285                 !OidIsValid(typeTypeRelid(typtup)))
1286                 result = typeTypeId(typtup);
1287         else
1288                 result = InvalidOid;
1289
1290         ReleaseSysCache(typtup);
1291         return result;
1292 }
1293
1294 /*
1295  * ParseComplexProjection -
1296  *        handles function calls with a single argument that is of complex type.
1297  *        If the function call is actually a column projection, return a suitably
1298  *        transformed expression tree.  If not, return NULL.
1299  */
1300 static Node *
1301 ParseComplexProjection(ParseState *pstate, char *funcname, Node *first_arg,
1302                                            int location)
1303 {
1304         TupleDesc       tupdesc;
1305         int                     i;
1306
1307         /*
1308          * Special case for whole-row Vars so that we can resolve (foo.*).bar even
1309          * when foo is a reference to a subselect, join, or RECORD function. A
1310          * bonus is that we avoid generating an unnecessary FieldSelect; our
1311          * result can omit the whole-row Var and just be a Var for the selected
1312          * field.
1313          *
1314          * This case could be handled by expandRecordVariable, but it's more
1315          * efficient to do it this way when possible.
1316          */
1317         if (IsA(first_arg, Var) &&
1318                 ((Var *) first_arg)->varattno == InvalidAttrNumber)
1319         {
1320                 RangeTblEntry *rte;
1321
1322                 rte = GetRTEByRangeTablePosn(pstate,
1323                                                                          ((Var *) first_arg)->varno,
1324                                                                          ((Var *) first_arg)->varlevelsup);
1325                 /* Return a Var if funcname matches a column, else NULL */
1326                 return scanRTEForColumn(pstate, rte, funcname, location);
1327         }
1328
1329         /*
1330          * Else do it the hard way with get_expr_result_type().
1331          *
1332          * If it's a Var of type RECORD, we have to work even harder: we have to
1333          * find what the Var refers to, and pass that to get_expr_result_type.
1334          * That task is handled by expandRecordVariable().
1335          */
1336         if (IsA(first_arg, Var) &&
1337                 ((Var *) first_arg)->vartype == RECORDOID)
1338                 tupdesc = expandRecordVariable(pstate, (Var *) first_arg, 0);
1339         else if (get_expr_result_type(first_arg, NULL, &tupdesc) != TYPEFUNC_COMPOSITE)
1340                 return NULL;                    /* unresolvable RECORD type */
1341         Assert(tupdesc);
1342
1343         for (i = 0; i < tupdesc->natts; i++)
1344         {
1345                 Form_pg_attribute att = tupdesc->attrs[i];
1346
1347                 if (strcmp(funcname, NameStr(att->attname)) == 0 &&
1348                         !att->attisdropped)
1349                 {
1350                         /* Success, so generate a FieldSelect expression */
1351                         FieldSelect *fselect = makeNode(FieldSelect);
1352
1353                         fselect->arg = (Expr *) first_arg;
1354                         fselect->fieldnum = i + 1;
1355                         fselect->resulttype = att->atttypid;
1356                         fselect->resulttypmod = att->atttypmod;
1357                         return (Node *) fselect;
1358                 }
1359         }
1360
1361         return NULL;                            /* funcname does not match any column */
1362 }
1363
1364 /*
1365  * funcname_signature_string
1366  *              Build a string representing a function name, including arg types.
1367  *              The result is something like "foo(integer)".
1368  *
1369  * If argnames isn't NIL, it is a list of C strings representing the actual
1370  * arg names for the last N arguments.  This must be considered part of the
1371  * function signature too, when dealing with named-notation function calls.
1372  *
1373  * This is typically used in the construction of function-not-found error
1374  * messages.
1375  */
1376 const char *
1377 funcname_signature_string(const char *funcname, int nargs,
1378                                                   List *argnames, const Oid *argtypes)
1379 {
1380         StringInfoData argbuf;
1381         int                     numposargs;
1382         ListCell   *lc;
1383         int                     i;
1384
1385         initStringInfo(&argbuf);
1386
1387         appendStringInfo(&argbuf, "%s(", funcname);
1388
1389         numposargs = nargs - list_length(argnames);
1390         lc = list_head(argnames);
1391
1392         for (i = 0; i < nargs; i++)
1393         {
1394                 if (i)
1395                         appendStringInfoString(&argbuf, ", ");
1396                 if (i >= numposargs)
1397                 {
1398                         appendStringInfo(&argbuf, "%s := ", (char *) lfirst(lc));
1399                         lc = lnext(lc);
1400                 }
1401                 appendStringInfoString(&argbuf, format_type_be(argtypes[i]));
1402         }
1403
1404         appendStringInfoChar(&argbuf, ')');
1405
1406         return argbuf.data;                     /* return palloc'd string buffer */
1407 }
1408
1409 /*
1410  * func_signature_string
1411  *              As above, but function name is passed as a qualified name list.
1412  */
1413 const char *
1414 func_signature_string(List *funcname, int nargs,
1415                                           List *argnames, const Oid *argtypes)
1416 {
1417         return funcname_signature_string(NameListToString(funcname),
1418                                                                          nargs, argnames, argtypes);
1419 }
1420
1421 /*
1422  * LookupFuncName
1423  *              Given a possibly-qualified function name and a set of argument types,
1424  *              look up the function.
1425  *
1426  * If the function name is not schema-qualified, it is sought in the current
1427  * namespace search path.
1428  *
1429  * If the function is not found, we return InvalidOid if noError is true,
1430  * else raise an error.
1431  */
1432 Oid
1433 LookupFuncName(List *funcname, int nargs, const Oid *argtypes, bool noError)
1434 {
1435         FuncCandidateList clist;
1436
1437         clist = FuncnameGetCandidates(funcname, nargs, NIL, false, false);
1438
1439         while (clist)
1440         {
1441                 if (memcmp(argtypes, clist->args, nargs * sizeof(Oid)) == 0)
1442                         return clist->oid;
1443                 clist = clist->next;
1444         }
1445
1446         if (!noError)
1447                 ereport(ERROR,
1448                                 (errcode(ERRCODE_UNDEFINED_FUNCTION),
1449                                  errmsg("function %s does not exist",
1450                                                 func_signature_string(funcname, nargs,
1451                                                                                           NIL, argtypes))));
1452
1453         return InvalidOid;
1454 }
1455
1456 /*
1457  * LookupTypeNameOid
1458  *              Convenience routine to look up a type, silently accepting shell types
1459  */
1460 static Oid
1461 LookupTypeNameOid(const TypeName *typename)
1462 {
1463         Oid                     result;
1464         Type            typtup;
1465
1466         typtup = LookupTypeName(NULL, typename, NULL);
1467         if (typtup == NULL)
1468                 ereport(ERROR,
1469                                 (errcode(ERRCODE_UNDEFINED_OBJECT),
1470                                  errmsg("type \"%s\" does not exist",
1471                                                 TypeNameToString(typename))));
1472         result = typeTypeId(typtup);
1473         ReleaseSysCache(typtup);
1474         return result;
1475 }
1476
1477 /*
1478  * LookupFuncNameTypeNames
1479  *              Like LookupFuncName, but the argument types are specified by a
1480  *              list of TypeName nodes.
1481  */
1482 Oid
1483 LookupFuncNameTypeNames(List *funcname, List *argtypes, bool noError)
1484 {
1485         Oid                     argoids[FUNC_MAX_ARGS];
1486         int                     argcount;
1487         int                     i;
1488         ListCell   *args_item;
1489
1490         argcount = list_length(argtypes);
1491         if (argcount > FUNC_MAX_ARGS)
1492                 ereport(ERROR,
1493                                 (errcode(ERRCODE_TOO_MANY_ARGUMENTS),
1494                                  errmsg_plural("functions cannot have more than %d argument",
1495                                                            "functions cannot have more than %d arguments",
1496                                                            FUNC_MAX_ARGS,
1497                                                            FUNC_MAX_ARGS)));
1498
1499         args_item = list_head(argtypes);
1500         for (i = 0; i < argcount; i++)
1501         {
1502                 TypeName   *t = (TypeName *) lfirst(args_item);
1503
1504                 argoids[i] = LookupTypeNameOid(t);
1505                 args_item = lnext(args_item);
1506         }
1507
1508         return LookupFuncName(funcname, argcount, argoids, noError);
1509 }
1510
1511 /*
1512  * LookupAggNameTypeNames
1513  *              Find an aggregate function given a name and list of TypeName nodes.
1514  *
1515  * This is almost like LookupFuncNameTypeNames, but the error messages refer
1516  * to aggregates rather than plain functions, and we verify that the found
1517  * function really is an aggregate.
1518  */
1519 Oid
1520 LookupAggNameTypeNames(List *aggname, List *argtypes, bool noError)
1521 {
1522         Oid                     argoids[FUNC_MAX_ARGS];
1523         int                     argcount;
1524         int                     i;
1525         ListCell   *lc;
1526         Oid                     oid;
1527         HeapTuple       ftup;
1528         Form_pg_proc pform;
1529
1530         argcount = list_length(argtypes);
1531         if (argcount > FUNC_MAX_ARGS)
1532                 ereport(ERROR,
1533                                 (errcode(ERRCODE_TOO_MANY_ARGUMENTS),
1534                                  errmsg_plural("functions cannot have more than %d argument",
1535                                                            "functions cannot have more than %d arguments",
1536                                                            FUNC_MAX_ARGS,
1537                                                            FUNC_MAX_ARGS)));
1538
1539         i = 0;
1540         foreach(lc, argtypes)
1541         {
1542                 TypeName   *t = (TypeName *) lfirst(lc);
1543
1544                 argoids[i] = LookupTypeNameOid(t);
1545                 i++;
1546         }
1547
1548         oid = LookupFuncName(aggname, argcount, argoids, true);
1549
1550         if (!OidIsValid(oid))
1551         {
1552                 if (noError)
1553                         return InvalidOid;
1554                 if (argcount == 0)
1555                         ereport(ERROR,
1556                                         (errcode(ERRCODE_UNDEFINED_FUNCTION),
1557                                          errmsg("aggregate %s(*) does not exist",
1558                                                         NameListToString(aggname))));
1559                 else
1560                         ereport(ERROR,
1561                                         (errcode(ERRCODE_UNDEFINED_FUNCTION),
1562                                          errmsg("aggregate %s does not exist",
1563                                                         func_signature_string(aggname, argcount,
1564                                                                                                   NIL, argoids))));
1565         }
1566
1567         /* Make sure it's an aggregate */
1568         ftup = SearchSysCache1(PROCOID, ObjectIdGetDatum(oid));
1569         if (!HeapTupleIsValid(ftup))    /* should not happen */
1570                 elog(ERROR, "cache lookup failed for function %u", oid);
1571         pform = (Form_pg_proc) GETSTRUCT(ftup);
1572
1573         if (!pform->proisagg)
1574         {
1575                 ReleaseSysCache(ftup);
1576                 if (noError)
1577                         return InvalidOid;
1578                 /* we do not use the (*) notation for functions... */
1579                 ereport(ERROR,
1580                                 (errcode(ERRCODE_WRONG_OBJECT_TYPE),
1581                                  errmsg("function %s is not an aggregate",
1582                                                 func_signature_string(aggname, argcount,
1583                                                                                           NIL, argoids))));
1584         }
1585
1586         ReleaseSysCache(ftup);
1587
1588         return oid;
1589 }
1590
1591
1592 /*
1593  * pg_get_expr() is a system function that exposes the expression
1594  * deparsing functionality in ruleutils.c to users. Very handy, but it was
1595  * later realized that the functions in ruleutils.c don't check the input
1596  * rigorously, assuming it to come from system catalogs and to therefore
1597  * be valid. That makes it easy for a user to crash the backend by passing
1598  * a maliciously crafted string representation of an expression to
1599  * pg_get_expr().
1600  *
1601  * There's a lot of code in ruleutils.c, so it's not feasible to add
1602  * water-proof input checking after the fact. Even if we did it once, it
1603  * would need to be taken into account in any future patches too.
1604  *
1605  * Instead, we restrict pg_rule_expr() to only allow input from system
1606  * catalogs. This is a hack, but it's the most robust and easiest
1607  * to backpatch way of plugging the vulnerability.
1608  *
1609  * This is transparent to the typical usage pattern of
1610  * "pg_get_expr(systemcolumn, ...)", but will break "pg_get_expr('foo',
1611  * ...)", even if 'foo' is a valid expression fetched earlier from a
1612  * system catalog. Hopefully there aren't many clients doing that out there.
1613  */
1614 void
1615 check_pg_get_expr_args(ParseState *pstate, Oid fnoid, List *args)
1616 {
1617         bool            allowed = false;
1618         Node       *arg;
1619         int                     netlevelsup;
1620
1621         /* if not being called for pg_get_expr, do nothing */
1622         if (fnoid != F_PG_GET_EXPR && fnoid != F_PG_GET_EXPR_EXT)
1623                 return;
1624
1625         /* superusers are allowed to call it anyway (dubious) */
1626         if (superuser())
1627                 return;
1628
1629         /*
1630          * The first argument must be a Var referencing one of the allowed
1631          * system-catalog columns.  It could be a join alias Var, though.
1632          */
1633         Assert(list_length(args) > 1);
1634         arg = (Node *) linitial(args);
1635         netlevelsup = 0;
1636
1637 restart:
1638         if (IsA(arg, Var))
1639         {
1640                 Var                *var = (Var *) arg;
1641                 RangeTblEntry *rte;
1642
1643                 netlevelsup += var->varlevelsup;
1644                 rte = GetRTEByRangeTablePosn(pstate, var->varno, netlevelsup);
1645
1646                 if (rte->rtekind == RTE_JOIN)
1647                 {
1648                         /* Expand join alias reference */
1649                         if (var->varattno > 0 &&
1650                                 var->varattno <= list_length(rte->joinaliasvars))
1651                         {
1652                                 arg = (Node *) list_nth(rte->joinaliasvars, var->varattno - 1);
1653                                 goto restart;
1654                         }
1655                 }
1656                 else if (rte->rtekind == RTE_RELATION)
1657                 {
1658                         switch (rte->relid)
1659                         {
1660                                 case IndexRelationId:
1661                                         if (var->varattno == Anum_pg_index_indexprs ||
1662                                                 var->varattno == Anum_pg_index_indpred)
1663                                                 allowed = true;
1664                                         break;
1665
1666                                 case AttrDefaultRelationId:
1667                                         if (var->varattno == Anum_pg_attrdef_adbin)
1668                                                 allowed = true;
1669                                         break;
1670
1671                                 case ProcedureRelationId:
1672                                         if (var->varattno == Anum_pg_proc_proargdefaults)
1673                                                 allowed = true;
1674                                         break;
1675
1676                                 case ConstraintRelationId:
1677                                         if (var->varattno == Anum_pg_constraint_conbin)
1678                                                 allowed = true;
1679                                         break;
1680
1681                                 case TypeRelationId:
1682                                         if (var->varattno == Anum_pg_type_typdefaultbin)
1683                                                 allowed = true;
1684                                         break;
1685                         }
1686                 }
1687         }
1688
1689         if (!allowed)
1690                 ereport(ERROR,
1691                                 (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
1692                                  errmsg("argument to pg_get_expr() must come from system catalogs")));
1693 }