Content-Type: multipart/mixed; boundary="------------XJRauab4n9iTHpBBcsjSdqGO"
Message-ID: <4b8d299d-2505-4c30-bf80-0f697410db35@tantorlabs.com>
Date: Tue, 19 May 2026 17:29:56 +0300
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Content-Language: en-US
To: PostgreSQL Hackers <pgsql-hackers@lists.postgresql.org>
From: Ilia Evdokimov <ilya.evdokimov@tantorlabs.com>
Subject: Fix incorrect size check in statext_dependencies_deserialize
Archived-At: 
 <https://www.postgresql.org/message-id/4b8d299d-2505-4c30-bf80-0f697410db35%40tantorlabs.com>
Precedence: bulk

This is a multi-part message in MIME format.
--------------XJRauab4n9iTHpBBcsjSdqGO
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit

Hi hackers,

I noticed an issue in `statext_dependencies_deserialize()`. The sanity 
check uses `SizeOfItem` to validate the bytea size, but `SizeOfItem()` 
expects the number of attributes in a single dependency, not the number 
of dependencies. This means the check is computing the size of one 
dependency with ndeps attributes, which is incorrect.

It should use `MinSizeOfItems` instead, which correctly computes the 
minimum expected size as the header plus `ndeps` minimally-sized 
dependency items.

Notably, the similar function for ndistinct extended statistics 
`statext_ndistinct_deserialize()` already uses `MinSizeOfItems` 
correctly, which suggests this is a typo rather than an intentional choice.

--
Best regards,
Ilia Evdokimov,
Tantor Labs LLC,
https://tantorlabs.com/

--------------XJRauab4n9iTHpBBcsjSdqGO
Content-Type: text/x-patch; charset=UTF-8;
 name="v1-0001-Fix-size-check-in-statext_dependencies_deserializ.patch"
Content-Disposition: attachment;
 filename*0="v1-0001-Fix-size-check-in-statext_dependencies_deserializ.pa";
 filename*1="tch"
Content-Transfer-Encoding: base64

RnJvbSA1ZTc2MGI5ZDYzYzEyZWY1MDRhM2ZkM2JlNzVkZDI1MTEyMTExNjViIE1vbiBTZXAg
MTcgMDA6MDA6MDAgMjAwMQpGcm9tOiBFdmRva2ltb3YgSWxpYSA8aWx5YS5ldmRva2ltb3ZA
dGFudG9ybGFicy5jb20+CkRhdGU6IFR1ZSwgMTkgTWF5IDIwMjYgMTc6MTc6MDEgKzAzMDAK
U3ViamVjdDogW1BBVENIIHYxXSBGaXggc2l6ZSBjaGVjayBpbiBzdGF0ZXh0X2RlcGVuZGVu
Y2llc19kZXNlcmlhbGl6ZSgpCgpUaGUgc2FuaXR5IGNoZWNrIHdhcyB1c2luZyBTaXplT2ZJ
dGVtKGRlcGVuZGVuY2llcy0+bmRlcHMpIHRvIHZhbGlkYXRlCnRoZSBieXRlYSBzaXplLCBi
dXQgU2l6ZU9mSXRlbSgpIGV4cGVjdHMgdGhlIG51bWJlciBvZiBhdHRyaWJ1dGVzIGluIGEK
c2luZ2xlIGRlcGVuZGVuY3ksIG5vdCB0aGUgbnVtYmVyIG9mIGRlcGVuZGVuY2llcy4gUmVw
bGFjZSBpdCB3aXRoCk1pblNpemVPZkl0ZW1zKG5kZXBzKSwgd2hpY2ggY29ycmVjdGx5IGNv
bXB1dGVzIHRoZSBtaW5pbXVtIGV4cGVjdGVkCnNpemUgYXMgdGhlIGhlYWRlciBwbHVzIG5k
ZXBzIG1pbmltYWxseS1zaXplZCBkZXBlbmRlbmN5IGl0ZW1zLgotLS0KIHNyYy9iYWNrZW5k
L3N0YXRpc3RpY3MvZGVwZW5kZW5jaWVzLmMgfCAyICstCiAxIGZpbGUgY2hhbmdlZCwgMSBp
bnNlcnRpb24oKyksIDEgZGVsZXRpb24oLSkKCmRpZmYgLS1naXQgYS9zcmMvYmFja2VuZC9z
dGF0aXN0aWNzL2RlcGVuZGVuY2llcy5jIGIvc3JjL2JhY2tlbmQvc3RhdGlzdGljcy9kZXBl
bmRlbmNpZXMuYwppbmRleCBlM2EyZjU4MTdlMC4uOTVkY2MyMTg5NzggMTAwNjQ0Ci0tLSBh
L3NyYy9iYWNrZW5kL3N0YXRpc3RpY3MvZGVwZW5kZW5jaWVzLmMKKysrIGIvc3JjL2JhY2tl
bmQvc3RhdGlzdGljcy9kZXBlbmRlbmNpZXMuYwpAQCAtNTI5LDcgKzUyOSw3IEBAIHN0YXRl
eHRfZGVwZW5kZW5jaWVzX2Rlc2VyaWFsaXplKGJ5dGVhICpkYXRhKQogCQllbG9nKEVSUk9S
LCAiaW52YWxpZCB6ZXJvLWxlbmd0aCBpdGVtIGFycmF5IGluIE1WRGVwZW5kZW5jaWVzIik7
CiAKIAkvKiB3aGF0IG1pbmltdW0gYnl0ZWEgc2l6ZSBkbyB3ZSBleHBlY3QgZm9yIHRob3Nl
IHBhcmFtZXRlcnMgKi8KLQltaW5fZXhwZWN0ZWRfc2l6ZSA9IFNpemVPZkl0ZW0oZGVwZW5k
ZW5jaWVzLT5uZGVwcyk7CisJbWluX2V4cGVjdGVkX3NpemUgPSBNaW5TaXplT2ZJdGVtcyhk
ZXBlbmRlbmNpZXMtPm5kZXBzKTsKIAogCWlmIChWQVJTSVpFX0FOWV9FWEhEUihkYXRhKSA8
IG1pbl9leHBlY3RlZF9zaXplKQogCQllbG9nKEVSUk9SLCAiaW52YWxpZCBkZXBlbmRlbmNp
ZXMgc2l6ZSAlenUgKGV4cGVjdGVkIGF0IGxlYXN0ICV6dSkiLAotLSAKMi4zNC4xCgo=

--------------XJRauab4n9iTHpBBcsjSdqGO--