Re: BUG #19595: Three memory-safety defects in src/backend/tsearch/spell.c (dictionary loader), PG 18.3

Hello Tom,

02.08.2026 20:25, Tom Lane wrote:
> Andrey Rachitskiy<pl0h0yp1(at)gmail(dot)com> writes:
>> Hi, Michael!
>> Patch attached.
> I pushed these code changes with one minor tweak: adjusting the
> new error message in NIImportOOAffixes to look more like the
> existing one about too many aliases.
>
> I left out the test cases. I don't think we need them, and
> I certainly don't think we want to install intentionally-broken
> files as sample data, as this patch would have done.

I'm not sure it's directly related to this bug report, but maybe you'd
like to fix one more memory-safety defect in tsearch in passing...

With the oom-simulation patch applied, the following script:
for i in {1..10}; do
echo "
SELECT COUNT(*) FROM pg_ts_dict;

CREATE TEXT SEARCH DICTIONARY thesaurus (Template=thesaurus, DictFile=thesaurus_sample, Dictionary=english_stem);

CREATE TEXT SEARCH CONFIGURATION tst (COPY=english);
SELECT to_tsvector('tst', 'Test test');

DROP TEXT SEARCH CONFIGURATION tst;
DROP TEXT SEARCH DICTIONARY thesaurus;
" | psql

grep 'was terminated' server.log && break;
done

fails for me as below:
2026-08-02 19:48:45.625 UTC [560023] LOG:  client backend (PID 560036) was terminated by signal 11: Segmentation fault

Core was generated by `postgres: law regression [local] SELECT                        '.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x000055aecffd519e in MemoryContextSetIdentifier (context=0x7f7f7f7f7f7f7f7f, id=0x0) at mcxt.c:667
667             Assert(MemoryContextIsValid(context));
(gdb) bt
#0  0x000055aecffd519e in MemoryContextSetIdentifier (context=0x7f7f7f7f7f7f7f7f, id=0x0) at mcxt.c:667
#1  0x000055aecff863c1 in lookup_ts_dictionary_cache (dictId=13336) at ts_cache.c:307
#2  0x000055aecfd87f00 in LexizeExec (ld=0x7ffe75617c20, correspondLexem=0x0) at ts_parse.c:204
#3  0x000055aecfd88741 in parsetext (cfgId=16385, prs=0x7ffe75617cc0, buf=0x55aeee42bba4 "Test test~\177\1770",
buflen=9) at ts_parse.c:402
#4  0x000055aecfd8667d in to_tsvector_byid (fcinfo=0x55aeee5188c0) at to_tsany.c:260
#5  0x000055aecfa2a399 in ExecInterpExpr (state=0x55aeee5187e0, econtext=0x55aeee518d20, isnull=0x7ffe75618064) at
execExprInterp.c:1011
#6  0x000055aecfa2cf0b in ExecInterpExprStillValid (state=0x55aeee5187e0, econtext=0x55aeee518d20,
isNull=0x7ffe75618064) at execExprInterp.c:2309
#7  0x000055aecfbfba26 in ExecEvalExprSwitchContext (state=0x55aeee5187e0, econtext=0x55aeee518d20, isNull=0x7ffe75618064)
    at ../../../../src/include/executor/executor.h:452

Plain `make check` triggers similar crashes as well...

Best regards,
Alexander