Last-minute updates for release notes.

Security: CVE-2021-32027, CVE-2021-32028, CVE-2021-32029

diff --git a/doc/src/sgml/release-13.sgml b/doc/src/sgml/release-13.sgml
index 47420d6c897f9e407d0296add684729b6b875c2f..8c9aae803330f089023f7de6a5d449da36b503f2 100644 (file)
--- a/doc/src/sgml/release-13.sgml
+++ b/doc/src/sgml/release-13.sgml
@@ -36,6 +36,69 @@
     
 
+     
+      Prevent integer overflows in array subscripting calculations
+      (Tom Lane)
+     
+
+     
+      The array code previously did not complain about cases where an
+      array's lower bound plus length overflows an integer.  This resulted
+      in later entries in the array becoming inaccessible (since their
+      subscripts could not be written as integers), but more importantly
+      it confused subsequent assignment operations.  This could lead to
+      memory overwrites, with ensuing crashes or unwanted data
+      modifications.
+      (CVE-2021-32027)
+     
+    
+
+    
+
+     
+      Fix mishandling of junk columns in INSERT
+      ... ON CONFLICT ... UPDATE target lists (Tom Lane)
+     
+
+     
+      If the UPDATE list contains any multi-column
+      sub-selects (which give rise to junk columns in addition to the
+      results proper), the UPDATE path would end up
+      storing tuples that include the values of the extra junk columns.
+      That's fairly harmless in the short run, but if new columns are
+      added to the table then the values would become accessible, possibly
+      leading to malfunctions if they don't match the datatypes of the
+      added columns.
+     
+
+     
+      In addition, in versions supporting cross-partition updates,
+      a cross-partition update triggered by such a case had the reverse
+      problem: the junk columns were removed from the target list,
+      typically causing an immediate crash due to malfunction of the
+      multi-column sub-select mechanism.
+      (CVE-2021-32028)
+     
+    
+
+    
+
      
       Reduce the overhead of dtrace probes for LWLock operations, when