agora inbox for pgsql-committers@postgresql.org
help / color / mirror / Atom feedFrom: Noah Misch <noah@leadboat.com>
To: pgsql-committers@lists.postgresql.org
Subject: pgsql: Fix multirange type handling in pg_restore_attribute_stats()
Date: Mon, 10 Aug 2026 13:41:24 +0000
Message-ID: <E1wtQFo-00000000y9B-3P1S@gemulon.postgresql.org> (raw)
Fix multirange type handling in pg_restore_attribute_stats()
statatt_get_type() unconditionally converted multirange types to their
underlying range type. This choice affected all the type information,
like atttypid, atttyptype and operators.
This made the bounds histogram work correctly (range type is required),
but it was wrong for all the other stat kinds. MCV values for a
multirange column should be parsed as multirange arrays, not range
arrays. It also made the TYPTYPE_MULTIRANGE check for the range stats
validation as dead code, since atttyptype was always TYPTYPE_RANGE
after the conversion due to the centralized statatt_get_type().
pg_restore_extended_stats() handles the same case correctly: it keeps
the original type and explicitly converts to the range type only at the
point where range_histogram_bounds is built.
The fix of this issue is simple: the multirange-to-range conversion
needs to be moved from the centralized statatt_get_type() up to where
attribute stats build their range_histogram_bounds, matching what is
done for extended statistics restore.
The regression tests for multiranges with attribute stats are extended
to cover this case.
Author: OpenAI Security Research Team
Backpatch-through: 18
Security: CVE-2026-16238
Branch
------
REL_18_STABLE
Details
-------
https://git.postgresql.org/pg/commitdiff/08454e8b2defdf8a0b61e550606f78b8f184f2e6
Author: Michael Paquier <michael@paquier.xyz>
Modified Files
--------------
src/backend/statistics/attribute_stats.c | 17 +++++++++--------
src/test/regress/expected/stats_import.out | 20 ++++++++++++++++++++
src/test/regress/sql/stats_import.sql | 14 ++++++++++++++
3 files changed, 43 insertions(+), 8 deletions(-)
view thread (3+ messages)
Message-ID: <E1wtQFo-00000000y9B-3P1S@gemulon.postgresql.org>
Permalink: ../E1wtQFo-00000000y9B-3P1S@gemulon.postgresql.org/
Also on: postgresql.org/message-id/E1wtQFo-00000000y9B-3P1S@gemulon.postgresql.org
reply
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-committers@postgresql.org
Cc: noah@leadboat.com, pgsql-committers@lists.postgresql.org
Subject: Re: pgsql: Fix multirange type handling in pg_restore_attribute_stats()
In-Reply-To: <E1wtQFo-00000000y9B-3P1S@gemulon.postgresql.org>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox