Fix multirange type handling in pg_restore_attribute_stats() statatt_get_type() unconditionally converted multirange types to their underlying range type. This choice affected all the type information, like atttypid, atttyptype and operators.
This made the bounds histogram work correctly (range type is required), but it was wrong for all the other stat kinds. MCV values for a multirange column should be parsed as multirange arrays, not range arrays. It also made the TYPTYPE_MULTIRANGE check for the range stats validation as dead code, since atttyptype was always TYPTYPE_RANGE after the conversion due to the centralized statatt_get_type(). pg_restore_extended_stats() handles the same case correctly: it keeps the original type and explicitly converts to the range type only at the point where range_histogram_bounds is built. The fix of this issue is simple: the multirange-to-range conversion needs to be moved from the centralized statatt_get_type() up to where attribute stats build their range_histogram_bounds, matching what is done for extended statistics restore. The regression tests for multiranges with attribute stats are extended to cover this case. Author: OpenAI Security Research Team Backpatch-through: 18 Security: CVE-2026-16238 Branch ------ REL_18_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/08454e8b2defdf8a0b61e550606f78b8f184f2e6 Author: Michael Paquier <[email protected]> Modified Files -------------- src/backend/statistics/attribute_stats.c | 17 +++++++++-------- src/test/regress/expected/stats_import.out | 20 ++++++++++++++++++++ src/test/regress/sql/stats_import.sql | 14 ++++++++++++++ 3 files changed, 43 insertions(+), 8 deletions(-)
