On 4/24/2026 1:44 PM, Haibo Yan wrote: > On Thu, Apr 23, 2026 at 5:32 AM SCHOEMANS Maxime <[email protected]> > wrote: > >> Hi Haibo, >> >> Thanks for creating the CommitFest entry. Could you add Diogo Repas, >> Zhicheng Luo, and Mahmoud Sakr as authors as well? They wrote the >> original patch and the underlying algorithm. The earlier CF entry is >> at https://commitfest.postgresql.org/patch/3821/ for reference. >> >> Of course — I’ve added Diogo Repas, Zhicheng Luo, and Mahmoud Sakr as > authors as we > >> Regards, >> Maxime >> > Thanks for the reference. > > Best regards, > Haibo
One thing that might be a problem is that rangejoinsel and multirangejoinsel (0002) look like they use the bounds histogram without the statistic_proc_security_check() that calc_hist_selectivity does just above. If I follow it correctly, that runs the cmp/subdiff over another role's histogram at plan time, before the permission check, which I believe is what CVE-2017-7484 guarded against. -- Bryan Green EDB: https://www.enterprisedb.com
