| From: | Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us> |
|---|---|
| To: | Ewan Young <kdbase(dot)hack(at)gmail(dot)com> |
| Cc: | Alexander Lakhin <exclusion(at)gmail(dot)com>, Andrey Rachitskiy <pl0h0yp1(at)gmail(dot)com>, michaelmalis2(at)gmail(dot)com, pgsql-bugs(at)lists(dot)postgresql(dot)org |
| Subject: | Re: BUG #19595: Three memory-safety defects in src/backend/tsearch/spell.c (dictionary loader), PG 18.3 |
| Date: | 2026-08-30 00:14:57 |
| Message-ID: | 431728.1788048897@sss.pgh.pa.us |
| Views: | Whole Thread | Raw Message | Download mbox | Resend email |
| Thread: | |
| Lists: | pgsql-bugs |
Ewan Young <kdbase(dot)hack(at)gmail(dot)com> writes:
> One more problem in the same file. It is not one of the three in the
> original report - those were all on the affix-rule side (CompoundAffix,
> the flag buffer, the AF alias table), while this one is in the compound
> flag table - and it is older than all of them, the code being from 9.6.
> So I'm posting here rather than opening a new report.
Pushed, thanks for the report!
I noticed while reading your patch that all of the strtol() calls in
this file store the result into an "int" not a "long", which opens
the door to an undetected integer overflow and truncation. Nothing
terribly harmful seems likely to ensue, but I thought I'd clean that
up too while we're here.
regards, tom lane
| From | Date | Subject | |
|---|---|---|---|
| Next Message | Andrey Rachitskiy | 2026-08-30 03:08:19 | Re: BUG #19487: Error while executing SQL query involving XML parsing |
| Previous Message | Tom Lane | 2026-08-29 21:44:31 | Re: BUG #19487: Error while executing SQL query involving XML parsing |