Re: BUG #19595: Three memory-safety defects in src/backend/tsearch/spell.c (dictionary loader), PG 18.3

вс, 30 авг. 2026 г. в 09:37, Andrey Rachitskiy <pl0h0yp1(at)gmail(dot)com>:

>
>
> вс, 30 авг. 2026 г. в 09:30, Alexander Lakhin <exclusion(at)gmail(dot)com>:
>
>> 30.08.2026 07:04, Tom Lane wrote:
>>
>> Hmph. SN_new_env itself is visibly okay with this, so the failure is
>> in some caller. I'm too tired to dig into it myself, but can you
>> identify the culprit more precisely?
>>
>>
>> I think it's:
>> static void
>> locate_stem_module(DictSnowball *d, const char *lang)
>> {
>> ...
>> d->stem = m->stem;
>> d->z = m->create();
>> ...
>> (in two places)
>>
>> then d->z is dereferenced in dsnowball_lexize().
>>
>> Confirm.
> locate_stem_module() in dict_snowball.c stores m->create() into d->z
> without checking. *_create_env wrappers correctly return NULL when
> SN_new_env fails. dsnowball_init then succeeds with d->z == NULL, and
> dsnowball_lexize crashes in SN_set_current / replace_s.
>
> --
> Regards,
> Rachitskiy Andrey
>
Fix in attach