Re: BUG #19595: Three memory-safety defects in src/backend/tsearch/spell.c (dictionary loader), PG 18.3

From: Alexander Lakhin <exclusion(at)gmail(dot)com>
To: Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us>
Cc: Andrey Rachitskiy <pl0h0yp1(at)gmail(dot)com>, michaelmalis2(at)gmail(dot)com, pgsql-bugs(at)lists(dot)postgresql(dot)org
Subject: Re: BUG #19595: Three memory-safety defects in src/backend/tsearch/spell.c (dictionary loader), PG 18.3
Date: 2026-08-30 04:30:00
Message-ID: 6e7563f0-48df-4639-b263-f04bc23c876b@gmail.com
Views: Whole Thread | Raw Message | Download mbox | Resend email
Thread:
Lists: pgsql-bugs

30.08.2026 07:04, Tom Lane wrote:
> Hmph. SN_new_env itself is visibly okay with this, so the failure is
> in some caller. I'm too tired to dig into it myself, but can you
> identify the culprit more precisely?

I think it's:
static void
locate_stem_module(DictSnowball *d, const char *lang)
{
...
                        d->stem = m->stem;
                        d->z = m->create();
...
(in two places)

then d->z is dereferenced in dsnowball_lexize().

Thank you for your time!

Best regards,
Alexander

In response to

Responses

Browse pgsql-bugs by date

  From Date Subject
Next Message Andrey Rachitskiy 2026-08-30 04:37:50 Re: BUG #19595: Three memory-safety defects in src/backend/tsearch/spell.c (dictionary loader), PG 18.3
Previous Message Tom Lane 2026-08-30 04:04:07 Re: BUG #19595: Three memory-safety defects in src/backend/tsearch/spell.c (dictionary loader), PG 18.3