backpatch 16.12 CVE fixes in main.#1793

Open

reshke wants to merge 11 commits into

apache:mainfrom

reshke:bp_16_12_cve

Commits on May 31, 2026

pgcrypto: Fix buffer overflow in pgp_pub_decrypt_bytea()

michaelpq
authored and
reshke
committed
Fix encoding length for EUC_CN.

macdice
authored and
reshke
committed
Fix mb2wchar functions on short input.

macdice
authored and
reshke
committed
Replace pg_mblen() with bounds-checked versions.

authored and
reshke
committed
Code coverage for most pg_mblen* calls.

authored and
reshke
committed
Require PGP-decrypted text to pass encoding validation.

nmisch
authored and
reshke
committed
Guard against unexpected dimensions of oidvector/int2vector.

tglsfdc
authored and
reshke
committed
Add a syscache on pg_extension.oid.

tglsfdc
authored and
reshke
committed
Require superuser to install a non-built-in selectivity estimator.

tglsfdc
authored and
reshke
committed
Harden _int_matchsel() against being attached to the wrong operator.

tglsfdc
authored and
reshke
committed
Rebase fixes & RAT check fix
reshke
committed