agora inbox for pgsql-committers@postgresql.orghelp / color / mirror / Atom feed
pgsql: Fix MCV input array checks in statistics restore functions 2+ messages / 1 participants [nested] [flat]
* pgsql: Fix MCV input array checks in statistics restore functions @ 2026-05-11 12:19 Noah Misch <noah@leadboat.com> 0 siblings, 0 replies; 2+ messages in thread From: Noah Misch @ 2026-05-11 12:19 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Fix MCV input array checks in statistics restore functions The SQL functions for the restore of attribute and expression statistics accept "most_common_vals" and "most_common_freqs" as independent arrays. The planner assumes these have the same number of elements, but it was possible to insert in the catalogs data that would cause an over-read when the catalog data is loaded in the planner. There were two holes in the stats restore logic: - Both arrays should match in size. - The input array must be one-dimensional, and it should match with what is delivered by pg_dump when scanning the pg_stats catalogs. The multivariate extended statistics MCV path (import_mcv) already validated these inputs via check_mcvlist_array(), and is not affected. These problems exist in v18 and newer versions for the restore of attribute statistics. These problems affect only HEAD for the restore of the expression statistics. Reported-by: Jeroen Gui <jeroen.gui1@proton.me> Author: Michael Paquier <michael@paquier.xyz> Reviewed-by: Amit Langote <amitlangote09@gmail.com> Reviewed-by: John Naylor <johncnaylorls@gmail.com> Security: CVE-2026-6575 Backpatch-through: 18 Branch ------ master Details ------- https://git.postgresql.org/pg/commitdiff/6d6348f0329dd50ba9f954df28c2ffa88a15df07 Author: Michael Paquier <michael@paquier.xyz> Modified Files -------------- src/backend/statistics/attribute_stats.c | 25 +++++- src/backend/statistics/extended_stats_funcs.c | 26 ++++++ src/backend/statistics/stat_utils.c | 9 ++ src/test/regress/expected/stats_import.out | 117 +++++++++++++++++++++++++- src/test/regress/sql/stats_import.sql | 76 +++++++++++++++++ 5 files changed, 248 insertions(+), 5 deletions(-) ^ permalink raw reply [nested|flat] 2+ messages in thread
* pgsql: Fix MCV input array checks in statistics restore functions @ 2026-05-11 12:19 Noah Misch <noah@leadboat.com> 0 siblings, 0 replies; 2+ messages in thread From: Noah Misch @ 2026-05-11 12:19 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Fix MCV input array checks in statistics restore functions The SQL functions for the restore of attribute and expression statistics accept "most_common_vals" and "most_common_freqs" as independent arrays. The planner assumes these have the same number of elements, but it was possible to insert in the catalogs data that would cause an over-read when the catalog data is loaded in the planner. There were two holes in the stats restore logic: - Both arrays should match in size. - The input array must be one-dimensional, and it should match with what is delivered by pg_dump when scanning the pg_stats catalogs. The multivariate extended statistics MCV path (import_mcv) already validated these inputs via check_mcvlist_array(), and is not affected. These problems exist in v18 and newer versions for the restore of attribute statistics. These problems affect only HEAD for the restore of the expression statistics. Reported-by: Jeroen Gui <jeroen.gui1@proton.me> Author: Michael Paquier <michael@paquier.xyz> Reviewed-by: Amit Langote <amitlangote09@gmail.com> Reviewed-by: John Naylor <johncnaylorls@gmail.com> Security: CVE-2026-6575 Backpatch-through: 18 Branch ------ REL_18_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/661095c40c0bcbb9c49743f518417a2977b63aef Author: Michael Paquier <michael@paquier.xyz> Modified Files -------------- src/backend/statistics/attribute_stats.c | 34 ++++++++++-- src/test/regress/expected/stats_import.out | 83 +++++++++++++++++++++++++++++- src/test/regress/sql/stats_import.sql | 54 +++++++++++++++++++ 3 files changed, 166 insertions(+), 5 deletions(-) ^ permalink raw reply [nested|flat] 2+ messages in thread
end of thread, other threads:[~2026-05-11 12:19 UTC | newest] Thread overview: 2+ messages (download: mbox mbox.gz follow: Atom feed) -- links below jump to the message on this page -- 2026-05-11 12:19 pgsql: Fix MCV input array checks in statistics restore functions Noah Misch <noah@leadboat.com> 2026-05-11 12:19 pgsql: Fix MCV input array checks in statistics restore functions Noah Misch <noah@leadboat.com>
This inbox is served by agora; see mirroring instructions for how to clone and mirror all data and code used for this inbox