Re: BUG #19595: Three memory-safety defects in src/backend/tsearch/spell.c (dictionary loader), PG 18.3

вс, 30 авг. 2026 г. в 09:43, Andrey Rachitskiy <pl0h0yp1(at)gmail(dot)com>:

>
> Fix in attach
>

Looking again at how Snowball is wired in the backend, I was too
quick with the d->z NULL check.

In the backend, snowball_runtime.h remaps malloc to palloc
(src/include/snowball/snowball_runtime.h). api.c includes that
header via the -I order in the snowball Makefile / meson.build, so
SN_new_env()'s malloc is palloc. On allocation failure palloc does
not return NULL. It goes through MemoryContextAllocationFailure().
So the live OOM path never reaches SN_new_env()'s
"if (z == NULL) return NULL" (Or what don't I know?) , never leaves d->z
NULL, and never reaches the SEGV in dsnowball_lexize.

Alexander's change is different. It forces a NULL before the
(remapped) malloc runs:

z = (rand() % 2 == 0) ? NULL : malloc(alloc_size);

That is the Snowball C API's "malloc failed".
The patch I sent only covers that emulated NULL-return case.
It does not change behaviour for a real out-of-memory under palloc.

Sorry for the noise :).

--
Regards,
Rachitskiy Andrey