Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1umZXW-000FQc-DA for pgsql-committers@arkaria.postgresql.org; Thu, 14 Aug 2025 15:06:50 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.94.2) (envelope-from ) id 1umZXU-007P5W-U4 for pgsql-committers@arkaria.postgresql.org; Thu, 14 Aug 2025 15:06:49 +0000 Received: from makus.postgresql.org ([2001:4800:3e1:1::229]) by malur.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1ulNiC-00Axcl-8c for pgsql-committers@lists.postgresql.org; Mon, 11 Aug 2025 08:16:56 +0000 Received: from mahout.postgresql.org ([2001:4800:3e1:1::227]) by makus.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1ulNi8-001qfB-2f for pgsql-committers@lists.postgresql.org; Mon, 11 Aug 2025 08:16:55 +0000 Received: from gemulon.postgresql.org ([2001:4800:3e1:1::198]) by mahout.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1ulNi7-0055MX-DD for pgsql-committers@lists.postgresql.org; Mon, 11 Aug 2025 08:16:51 +0000 Received: from localhost ([127.0.0.1] helo=gemulon.postgresql.org) by gemulon.postgresql.org with esmtp (Exim 4.96) (envelope-from ) id 1ulNi6-001ofJ-1s for pgsql-committers@lists.postgresql.org; Mon, 11 Aug 2025 08:16:51 +0000 Content-Type: multipart/mixed; boundary="===============3140207774463667317==" MIME-Version: 1.0 From: Dean Rasheed To: pgsql-committers@lists.postgresql.org Subject: pgsql: Fix security checks in selectivity estimation functions. X-Auto-Response-Suppress: All Auto-Submitted: auto-generated Message-Id: Date: Mon, 11 Aug 2025 08:16:51 +0000 List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Archived-At: Precedence: bulk --===============3140207774463667317== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 Rml4IHNlY3VyaXR5IGNoZWNrcyBpbiBzZWxlY3Rpdml0eSBlc3RpbWF0aW9uIGZ1bmN0aW9ucy4K CkNvbW1pdCBlMmQ0ZWY4ZGU4NiAodGhlIGZpeCBmb3IgQ1ZFLTIwMTctNzQ4NCkgYWRkZWQgc2Vj dXJpdHkgY2hlY2tzCnRvIHRoZSBzZWxlY3Rpdml0eSBlc3RpbWF0aW9uIGZ1bmN0aW9ucyB0byBw cmV2ZW50IHRoZW0gZnJvbSBydW5uaW5nCnVzZXItc3VwcGxpZWQgb3BlcmF0b3JzIG9uIGRhdGEg b2J0YWluZWQgZnJvbSBwZ19zdGF0aXN0aWMgaWYgdGhlIHVzZXIKbGFja3MgcHJpdmlsZWdlcyB0 byBzZWxlY3QgZnJvbSB0aGUgdW5kZXJseWluZyB0YWJsZS4gSW4gY2FzZXMKaW52b2x2aW5nIGlu aGVyaXRhbmNlL3BhcnRpdGlvbmluZywgdGhvc2UgY2hlY2tzIHdlcmUgb3JpZ2luYWxseQpwZXJm b3JtZWQgYWdhaW5zdCB0aGUgY2hpbGQgUlRFICh3aGljaCBmb3IgcGxhaW4gaW5oZXJpdGFuY2Ug bWlnaHQKYWN0dWFsbHkgcmVmZXIgdG8gdGhlIHBhcmVudCB0YWJsZSkuIENvbW1pdCA1NTNkMmVj MjcxMCB0aGVuIGV4dGVuZGVkCnRoYXQgdG8gYWxzbyBjaGVjayB0aGUgcGFyZW50IFJURSwgYWxs b3dpbmcgYWNjZXNzIGlmIHRoZSB1c2VyIGhhZApwZXJtaXNzaW9ucyBvbiBlaXRoZXIgdGhlIHBh cmVudCBvciB0aGUgY2hpbGQuIEl0IHR1cm5zIG91dCwgaG93ZXZlciwKdGhhdCBkb2luZyBhbnkg Y2hlY2tzIHVzaW5nIHRoZSBjaGlsZCBSVEUgaXMgaW5jb3JyZWN0LCBzaW5jZQpzZWN1cml0eVF1 YWxzIGlzIHNldCB0byBOVUxMIHdoZW4gY3JlYXRpbmcgYW4gUlRFIGZvciBhbiBpbmhlcml0YW5j ZQpjaGlsZCAod2hldGhlciBpdCByZWZlcnMgdG8gdGhlIHBhcmVudCB0YWJsZSBvciB0aGUgY2hp bGQgdGFibGUpLCBhbmQKdGhlcmVmb3JlIHN1Y2ggY2hlY2tzIGRvIG5vdCBjb3JyZWN0bHkgYWNj b3VudCBmb3IgYW55IFJMUyBwb2xpY2llcyBvcgpzZWN1cml0eSBiYXJyaWVyIHZpZXdzLiBUaGVy ZWZvcmUsIGRvIHRoZSBzZWN1cml0eSBjaGVja3MgdXNpbmcgb25seQp0aGUgcGFyZW50IFJURS4g VGhpcyBpcyBjb25zaXN0ZW50IHdpdGggaG93IFJMUyBwb2xpY2llcyBhcmUgYXBwbGllZCwKYW5k IHRoZSBleGVjdXRvcidzIEFDTCBjaGVja3MsIGJvdGggb2Ygd2hpY2ggdXNlIG9ubHkgdGhlIHBh cmVudAp0YWJsZSdzIHBlcm1pc3Npb25zL3BvbGljaWVzLiBTaW1pbGFyIGNoZWNrcyBhcmUgcGVy Zm9ybWVkIGluIHRoZQpleHRlbmRlZCBzdGF0cyBjb2RlLCBzbyB1cGRhdGUgdGhhdCBpbiB0aGUg c2FtZSB3YXksIGNlbnRyYWxpemluZyBhbGwKdGhlIGNoZWNrcyBpbiBhIG5ldyBmdW5jdGlvbi4K CkluIGFkZGl0aW9uLCBub3RlIHRoYXQgdGhlc2UgY2hlY2tzIGJ5IHRoZW1zZWx2ZXMgYXJlIGlu c3VmZmljaWVudCB0bwplbnN1cmUgdGhhdCB0aGUgdXNlciBoYXMgYWNjZXNzIHRvIHRoZSB0YWJs ZSdzIGRhdGEgYmVjYXVzZSwgaW4gYQpxdWVyeSB0aGF0IGdvZXMgdmlhIGEgdmlldywgdGhleSBv bmx5IGNoZWNrIHRoYXQgdGhlIHZpZXcgb3duZXIgaGFzCnBlcm1pc3Npb25zIG9uIHRoZSB1bmRl cmx5aW5nIHRhYmxlLCBub3QgdGhhdCB0aGUgY3VycmVudCB1c2VyIGhhcwpwZXJtaXNzaW9ucyBv biB0aGUgdmlldyBpdHNlbGYuIEluIHRoZSBzZWxlY3Rpdml0eSBlc3RpbWF0aW9uCmZ1bmN0aW9u cywgdGhlcmUgaXMgbm8gZWFzeSB3YXkgdG8gbmF2aWdhdGUgZnJvbSB1bmRlcmx5aW5nIHRhYmxl cyB0bwp2aWV3cywgc28gYWRkIHBlcm1pc3Npb25zIGNoZWNrcyBmb3IgYWxsIHZpZXdzIG1lbnRp b25lZCBpbiB0aGUgcXVlcnkKdG8gdGhlIHBsYW5uZXIgc3RhcnR1cCBjb2RlLiBJZiB0aGUgdXNl ciBsYWNrcyBwZXJtaXNzaW9ucyBvbiBhIHZpZXcsCmEgcGVybWlzc2lvbnMgZXJyb3Igd2lsbCBu b3cgYmUgcmVwb3J0ZWQgYXQgcGxhbm5lci1zdGFydHVwLCBhbmQgdGhlCnNlbGVjdGl2aXR5IGVz dGltYXRpb24gZnVuY3Rpb25zIHdpbGwgbm90IGJlIHJ1bi4KCkNoZWNraW5nIHZpZXcgcGVybWlz c2lvbnMgYXQgcGxhbm5lci1zdGFydHVwIGluIHRoaXMgd2F5IGlzIGEgbGl0dGxlCnVnbHksIHNp bmNlIHRoZSBzYW1lIGNoZWNrcyB3aWxsIGJlIHJlcGVhdGVkIGF0IGV4ZWN1dG9yLXN0YXJ0dXAu Ckxvbmdlci10ZXJtLCBpdCBtaWdodCBiZSBiZXR0ZXIgdG8gbW92ZSBhbGwgdGhlIHBlcm1pc3Np b25zIGNoZWNrcwpmcm9tIHRoZSBleGVjdXRvciB0byB0aGUgcGxhbm5lciBzbyB0aGF0IHBlcm1p c3Npb25zIGVycm9ycyBjYW4gYmUKcmVwb3J0ZWQgc29vbmVyLCBpbnN0ZWFkIG9mIGNyZWF0aW5n IGEgcGxhbiB0aGF0IHdvbid0IGV2ZXIgYmUgcnVuLgpIb3dldmVyLCBzdWNoIGEgY2hhbmdlIHNl ZW1zIHRvbyBmYXItcmVhY2hpbmcgdG8gYmUgYmFjay1wYXRjaGVkLgoKQmFjay1wYXRjaCB0byBh bGwgc3VwcG9ydGVkIHZlcnNpb25zLiBJbiB2MTMsIHRoZXJlIGlzIHRoZSBhZGRlZApjb21wbGlj YXRpb24gdGhhdCBVUERBVEVzIGFuZCBERUxFVEVzIG9uIGluaGVyaXRlZCB0YXJnZXQgdGFibGVz IGFyZQpwbGFubmVkIHVzaW5nIGluaGVyaXRhbmNlX3BsYW5uZXIoKSwgd2hpY2ggcGxhbnMgZWFj aCBpbmhlcml0YW5jZQpjaGlsZCB0YWJsZSBzZXBhcmF0ZWx5LCBzbyB0aGF0IHRoZSBzZWxlY3Rp dml0eSBlc3RpbWF0aW9uIGZ1bmN0aW9ucwpkbyBub3Qga25vdyB0aGF0IHRoZXkgYXJlIGRlYWxp bmcgd2l0aCBhIGNoaWxkIHRhYmxlIGFjY2Vzc2VkIHZpYSBpdHMKcGFyZW50LiBIYW5kbGUgdGhh dCBieSBjaGVja2luZyBhY2Nlc3MgcGVybWlzc2lvbnMgb24gdGhlIHRvcCBwYXJlbnQKdGFibGUg YXQgcGxhbm5lci1zdGFydHVwLCBpbiB0aGUgc2FtZSB3YXkgYXMgd2UgZG8gZm9yIHZpZXdzLiBB bnkKc2VjdXJpdHlRdWFscyBvbiB0aGUgdG9wIHBhcmVudCB0YWJsZSBhcmUgbW92ZWQgZG93biB0 byB0aGUgY2hpbGQKdGFibGVzIGJ5IGluaGVyaXRhbmNlX3BsYW5uZXIoKSwgc28gdGhleSBjb250 aW51ZSB0byBiZSBjaGVja2VkIGJ5IHRoZQpzZWxlY3Rpdml0eSBlc3RpbWF0aW9uIGZ1bmN0aW9u cy4KCkF1dGhvcjogRGVhbiBSYXNoZWVkIDxkZWFuLmEucmFzaGVlZEBnbWFpbC5jb20+ClJldmll d2VkLWJ5OiBUb20gTGFuZSA8dGdsQHNzcy5wZ2gucGEudXM+ClJldmlld2VkLWJ5OiBOb2FoIE1p c2NoIDxub2FoQGxlYWRib2F0LmNvbT4KQmFja3BhdGNoLXRocm91Z2g6IDEzClNlY3VyaXR5OiBD VkUtMjAyNS04NzEzCgpCcmFuY2gKLS0tLS0tCm1hc3RlcgoKRGV0YWlscwotLS0tLS0tCmh0dHBz Oi8vZ2l0LnBvc3RncmVzcWwub3JnL3BnL2NvbW1pdGRpZmYvMjI0MjQ5NTNjZGVkM2Y4M2YwMzgy MzgzNzczZWFmMzZlYjFhYmRhOQoKTW9kaWZpZWQgRmlsZXMKLS0tLS0tLS0tLS0tLS0Kc3JjL2Jh Y2tlbmQvZXhlY3V0b3IvZXhlY01haW4uYyAgICAgICAgICAgfCAgIDMgKy0Kc3JjL2JhY2tlbmQv b3B0aW1pemVyL3BsYW4vcGxhbm5lci5jICAgICAgfCAgMzMgKysKc3JjL2JhY2tlbmQvc3RhdGlz dGljcy9leHRlbmRlZF9zdGF0cy5jICAgfCAxMDggKysrLS0tLQpzcmMvYmFja2VuZC91dGlscy9h ZHQvc2VsZnVuY3MuYyAgICAgICAgICB8IDQ4NiArKysrKysrKysrKysrKysrLS0tLS0tLS0tLS0t LS0Kc3JjL2luY2x1ZGUvZXhlY3V0b3IvZXhlY3V0b3IuaCAgICAgICAgICAgfCAgIDEgKwpzcmMv aW5jbHVkZS91dGlscy9zZWxmdW5jcy5oICAgICAgICAgICAgICB8ICAgNCArLQpzcmMvdGVzdC9y ZWdyZXNzL2V4cGVjdGVkL3ByaXZpbGVnZXMub3V0ICB8ICAxMyArLQpzcmMvdGVzdC9yZWdyZXNz L2V4cGVjdGVkL3Jvd3NlY3VyaXR5Lm91dCB8ICA3MyArKysrLQpzcmMvdGVzdC9yZWdyZXNzL2V4 cGVjdGVkL3N0YXRzX2V4dC5vdXQgICB8ICA3MSArKysrLQpzcmMvdGVzdC9yZWdyZXNzL3NxbC9w cml2aWxlZ2VzLnNxbCAgICAgICB8ICAxMiArLQpzcmMvdGVzdC9yZWdyZXNzL3NxbC9yb3dzZWN1 cml0eS5zcWwgICAgICB8ICA1MSArKystCnNyYy90ZXN0L3JlZ3Jlc3Mvc3FsL3N0YXRzX2V4dC5z cWwgICAgICAgIHwgIDQ1ICsrLQoxMiBmaWxlcyBjaGFuZ2VkLCA1OTYgaW5zZXJ0aW9ucygrKSwg MzA0IGRlbGV0aW9ucygtKQoK --===============3140207774463667317==--