Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1umZXZ-000FQd-Gr for pgsql-committers@arkaria.postgresql.org; Thu, 14 Aug 2025 15:06:53 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.94.2) (envelope-from ) id 1umZXU-007P5V-UR for pgsql-committers@arkaria.postgresql.org; Thu, 14 Aug 2025 15:06:49 +0000 Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29]) by malur.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1ulNiE-00Axfj-9E for pgsql-committers@lists.postgresql.org; Mon, 11 Aug 2025 08:16:58 +0000 Received: from mahout.postgresql.org ([2001:4800:3e1:1::227]) by magus.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1ulNi8-0000Lc-2d for pgsql-committers@lists.postgresql.org; Mon, 11 Aug 2025 08:16:57 +0000 Received: from gemulon.postgresql.org ([72.32.157.198]) by mahout.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1ulNi7-0055Md-MZ for pgsql-committers@lists.postgresql.org; Mon, 11 Aug 2025 08:16:52 +0000 Received: from localhost ([127.0.0.1] helo=gemulon.postgresql.org) by gemulon.postgresql.org with esmtp (Exim 4.96) (envelope-from ) id 1ulNi6-001ofW-29 for pgsql-committers@lists.postgresql.org; Mon, 11 Aug 2025 08:16:51 +0000 Content-Type: multipart/mixed; boundary="===============2600405492391793619==" MIME-Version: 1.0 From: Dean Rasheed To: pgsql-committers@lists.postgresql.org Subject: pgsql: Fix security checks in selectivity estimation functions. X-Auto-Response-Suppress: All Auto-Submitted: auto-generated Message-Id: Date: Mon, 11 Aug 2025 08:16:51 +0000 List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Archived-At: Precedence: bulk --===============2600405492391793619== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 Rml4IHNlY3VyaXR5IGNoZWNrcyBpbiBzZWxlY3Rpdml0eSBlc3RpbWF0aW9uIGZ1bmN0aW9ucy4K CkNvbW1pdCBlMmQ0ZWY4ZGU4NiAodGhlIGZpeCBmb3IgQ1ZFLTIwMTctNzQ4NCkgYWRkZWQgc2Vj dXJpdHkgY2hlY2tzCnRvIHRoZSBzZWxlY3Rpdml0eSBlc3RpbWF0aW9uIGZ1bmN0aW9ucyB0byBw cmV2ZW50IHRoZW0gZnJvbSBydW5uaW5nCnVzZXItc3VwcGxpZWQgb3BlcmF0b3JzIG9uIGRhdGEg b2J0YWluZWQgZnJvbSBwZ19zdGF0aXN0aWMgaWYgdGhlIHVzZXIKbGFja3MgcHJpdmlsZWdlcyB0 byBzZWxlY3QgZnJvbSB0aGUgdW5kZXJseWluZyB0YWJsZS4gSW4gY2FzZXMKaW52b2x2aW5nIGlu aGVyaXRhbmNlL3BhcnRpdGlvbmluZywgdGhvc2UgY2hlY2tzIHdlcmUgb3JpZ2luYWxseQpwZXJm b3JtZWQgYWdhaW5zdCB0aGUgY2hpbGQgUlRFICh3aGljaCBmb3IgcGxhaW4gaW5oZXJpdGFuY2Ug bWlnaHQKYWN0dWFsbHkgcmVmZXIgdG8gdGhlIHBhcmVudCB0YWJsZSkuIENvbW1pdCA1NTNkMmVj MjcxMCB0aGVuIGV4dGVuZGVkCnRoYXQgdG8gYWxzbyBjaGVjayB0aGUgcGFyZW50IFJURSwgYWxs b3dpbmcgYWNjZXNzIGlmIHRoZSB1c2VyIGhhZApwZXJtaXNzaW9ucyBvbiBlaXRoZXIgdGhlIHBh cmVudCBvciB0aGUgY2hpbGQuIEl0IHR1cm5zIG91dCwgaG93ZXZlciwKdGhhdCBkb2luZyBhbnkg Y2hlY2tzIHVzaW5nIHRoZSBjaGlsZCBSVEUgaXMgaW5jb3JyZWN0LCBzaW5jZQpzZWN1cml0eVF1 YWxzIGlzIHNldCB0byBOVUxMIHdoZW4gY3JlYXRpbmcgYW4gUlRFIGZvciBhbiBpbmhlcml0YW5j ZQpjaGlsZCAod2hldGhlciBpdCByZWZlcnMgdG8gdGhlIHBhcmVudCB0YWJsZSBvciB0aGUgY2hp bGQgdGFibGUpLCBhbmQKdGhlcmVmb3JlIHN1Y2ggY2hlY2tzIGRvIG5vdCBjb3JyZWN0bHkgYWNj b3VudCBmb3IgYW55IFJMUyBwb2xpY2llcyBvcgpzZWN1cml0eSBiYXJyaWVyIHZpZXdzLiBUaGVy ZWZvcmUsIGRvIHRoZSBzZWN1cml0eSBjaGVja3MgdXNpbmcgb25seQp0aGUgcGFyZW50IFJURS4g VGhpcyBpcyBjb25zaXN0ZW50IHdpdGggaG93IFJMUyBwb2xpY2llcyBhcmUgYXBwbGllZCwKYW5k IHRoZSBleGVjdXRvcidzIEFDTCBjaGVja3MsIGJvdGggb2Ygd2hpY2ggdXNlIG9ubHkgdGhlIHBh cmVudAp0YWJsZSdzIHBlcm1pc3Npb25zL3BvbGljaWVzLiBTaW1pbGFyIGNoZWNrcyBhcmUgcGVy Zm9ybWVkIGluIHRoZQpleHRlbmRlZCBzdGF0cyBjb2RlLCBzbyB1cGRhdGUgdGhhdCBpbiB0aGUg c2FtZSB3YXksIGNlbnRyYWxpemluZyBhbGwKdGhlIGNoZWNrcyBpbiBhIG5ldyBmdW5jdGlvbi4K CkluIGFkZGl0aW9uLCBub3RlIHRoYXQgdGhlc2UgY2hlY2tzIGJ5IHRoZW1zZWx2ZXMgYXJlIGlu c3VmZmljaWVudCB0bwplbnN1cmUgdGhhdCB0aGUgdXNlciBoYXMgYWNjZXNzIHRvIHRoZSB0YWJs ZSdzIGRhdGEgYmVjYXVzZSwgaW4gYQpxdWVyeSB0aGF0IGdvZXMgdmlhIGEgdmlldywgdGhleSBv bmx5IGNoZWNrIHRoYXQgdGhlIHZpZXcgb3duZXIgaGFzCnBlcm1pc3Npb25zIG9uIHRoZSB1bmRl cmx5aW5nIHRhYmxlLCBub3QgdGhhdCB0aGUgY3VycmVudCB1c2VyIGhhcwpwZXJtaXNzaW9ucyBv biB0aGUgdmlldyBpdHNlbGYuIEluIHRoZSBzZWxlY3Rpdml0eSBlc3RpbWF0aW9uCmZ1bmN0aW9u cywgdGhlcmUgaXMgbm8gZWFzeSB3YXkgdG8gbmF2aWdhdGUgZnJvbSB1bmRlcmx5aW5nIHRhYmxl cyB0bwp2aWV3cywgc28gYWRkIHBlcm1pc3Npb25zIGNoZWNrcyBmb3IgYWxsIHZpZXdzIG1lbnRp b25lZCBpbiB0aGUgcXVlcnkKdG8gdGhlIHBsYW5uZXIgc3RhcnR1cCBjb2RlLiBJZiB0aGUgdXNl ciBsYWNrcyBwZXJtaXNzaW9ucyBvbiBhIHZpZXcsCmEgcGVybWlzc2lvbnMgZXJyb3Igd2lsbCBu b3cgYmUgcmVwb3J0ZWQgYXQgcGxhbm5lci1zdGFydHVwLCBhbmQgdGhlCnNlbGVjdGl2aXR5IGVz dGltYXRpb24gZnVuY3Rpb25zIHdpbGwgbm90IGJlIHJ1bi4KCkNoZWNraW5nIHZpZXcgcGVybWlz c2lvbnMgYXQgcGxhbm5lci1zdGFydHVwIGluIHRoaXMgd2F5IGlzIGEgbGl0dGxlCnVnbHksIHNp bmNlIHRoZSBzYW1lIGNoZWNrcyB3aWxsIGJlIHJlcGVhdGVkIGF0IGV4ZWN1dG9yLXN0YXJ0dXAu Ckxvbmdlci10ZXJtLCBpdCBtaWdodCBiZSBiZXR0ZXIgdG8gbW92ZSBhbGwgdGhlIHBlcm1pc3Np b25zIGNoZWNrcwpmcm9tIHRoZSBleGVjdXRvciB0byB0aGUgcGxhbm5lciBzbyB0aGF0IHBlcm1p c3Npb25zIGVycm9ycyBjYW4gYmUKcmVwb3J0ZWQgc29vbmVyLCBpbnN0ZWFkIG9mIGNyZWF0aW5n IGEgcGxhbiB0aGF0IHdvbid0IGV2ZXIgYmUgcnVuLgpIb3dldmVyLCBzdWNoIGEgY2hhbmdlIHNl ZW1zIHRvbyBmYXItcmVhY2hpbmcgdG8gYmUgYmFjay1wYXRjaGVkLgoKQmFjay1wYXRjaCB0byBh bGwgc3VwcG9ydGVkIHZlcnNpb25zLiBJbiB2MTMsIHRoZXJlIGlzIHRoZSBhZGRlZApjb21wbGlj YXRpb24gdGhhdCBVUERBVEVzIGFuZCBERUxFVEVzIG9uIGluaGVyaXRlZCB0YXJnZXQgdGFibGVz IGFyZQpwbGFubmVkIHVzaW5nIGluaGVyaXRhbmNlX3BsYW5uZXIoKSwgd2hpY2ggcGxhbnMgZWFj aCBpbmhlcml0YW5jZQpjaGlsZCB0YWJsZSBzZXBhcmF0ZWx5LCBzbyB0aGF0IHRoZSBzZWxlY3Rp dml0eSBlc3RpbWF0aW9uIGZ1bmN0aW9ucwpkbyBub3Qga25vdyB0aGF0IHRoZXkgYXJlIGRlYWxp bmcgd2l0aCBhIGNoaWxkIHRhYmxlIGFjY2Vzc2VkIHZpYSBpdHMKcGFyZW50LiBIYW5kbGUgdGhh dCBieSBjaGVja2luZyBhY2Nlc3MgcGVybWlzc2lvbnMgb24gdGhlIHRvcCBwYXJlbnQKdGFibGUg YXQgcGxhbm5lci1zdGFydHVwLCBpbiB0aGUgc2FtZSB3YXkgYXMgd2UgZG8gZm9yIHZpZXdzLiBB bnkKc2VjdXJpdHlRdWFscyBvbiB0aGUgdG9wIHBhcmVudCB0YWJsZSBhcmUgbW92ZWQgZG93biB0 byB0aGUgY2hpbGQKdGFibGVzIGJ5IGluaGVyaXRhbmNlX3BsYW5uZXIoKSwgc28gdGhleSBjb250 aW51ZSB0byBiZSBjaGVja2VkIGJ5IHRoZQpzZWxlY3Rpdml0eSBlc3RpbWF0aW9uIGZ1bmN0aW9u cy4KCkF1dGhvcjogRGVhbiBSYXNoZWVkIDxkZWFuLmEucmFzaGVlZEBnbWFpbC5jb20+ClJldmll d2VkLWJ5OiBUb20gTGFuZSA8dGdsQHNzcy5wZ2gucGEudXM+ClJldmlld2VkLWJ5OiBOb2FoIE1p c2NoIDxub2FoQGxlYWRib2F0LmNvbT4KQmFja3BhdGNoLXRocm91Z2g6IDEzClNlY3VyaXR5OiBD VkUtMjAyNS04NzEzCgpCcmFuY2gKLS0tLS0tClJFTF8xNF9TVEFCTEUKCkRldGFpbHMKLS0tLS0t LQpodHRwczovL2dpdC5wb3N0Z3Jlc3FsLm9yZy9wZy9jb21taXRkaWZmL2FmZTM4ZmI2YWJiOGVm MzY0MTkxMjAxZjU3N2E1YTYzOGJhNTU1MDkKCk1vZGlmaWVkIEZpbGVzCi0tLS0tLS0tLS0tLS0t CnNyYy9iYWNrZW5kL2V4ZWN1dG9yL2V4ZWNNYWluLmMgICAgICAgICAgIHwgICAzICstCnNyYy9i YWNrZW5kL29wdGltaXplci9wbGFuL3BsYW5uZXIuYyAgICAgIHwgIDMwICsrCnNyYy9iYWNrZW5k L3N0YXRpc3RpY3MvZXh0ZW5kZWRfc3RhdHMuYyAgIHwgMTA4ICsrKy0tLS0Kc3JjL2JhY2tlbmQv dXRpbHMvYWR0L3NlbGZ1bmNzLmMgICAgICAgICAgfCA0NjQgKysrKysrKysrKysrKysrKy0tLS0t LS0tLS0tLS0tCnNyYy9pbmNsdWRlL2V4ZWN1dG9yL2V4ZWN1dG9yLmggICAgICAgICAgIHwgICAx ICsKc3JjL2luY2x1ZGUvdXRpbHMvc2VsZnVuY3MuaCAgICAgICAgICAgICAgfCAgIDQgKy0Kc3Jj L3Rlc3QvcmVncmVzcy9leHBlY3RlZC9wcml2aWxlZ2VzLm91dCAgfCAgMTMgKy0Kc3JjL3Rlc3Qv cmVncmVzcy9leHBlY3RlZC9yb3dzZWN1cml0eS5vdXQgfCAgNzMgKysrKy0Kc3JjL3Rlc3QvcmVn cmVzcy9leHBlY3RlZC9zdGF0c19leHQub3V0ICAgfCAgNjAgKysrLQpzcmMvdGVzdC9yZWdyZXNz L3NxbC9wcml2aWxlZ2VzLnNxbCAgICAgICB8ICAxMiArLQpzcmMvdGVzdC9yZWdyZXNzL3NxbC9y b3dzZWN1cml0eS5zcWwgICAgICB8ICA1MSArKystCnNyYy90ZXN0L3JlZ3Jlc3Mvc3FsL3N0YXRz X2V4dC5zcWwgICAgICAgIHwgIDM5ICsrKwoxMiBmaWxlcyBjaGFuZ2VkLCA1NjIgaW5zZXJ0aW9u cygrKSwgMjk2IGRlbGV0aW9ucygtKQoK --===============2600405492391793619==--