Re: BUG #19595: Three memory-safety defects in src/backend/tsearch/spell.c (dictionary loader), PG 18.3

вс, 30 авг. 2026 г. в 09:30, Alexander Lakhin <exclusion(at)gmail(dot)com>:

> 30.08.2026 07:04, Tom Lane wrote:
>
> Hmph. SN_new_env itself is visibly okay with this, so the failure is
> in some caller. I'm too tired to dig into it myself, but can you
> identify the culprit more precisely?
>
>
> I think it's:
> static void
> locate_stem_module(DictSnowball *d, const char *lang)
> {
> ...
> d->stem = m->stem;
> d->z = m->create();
> ...
> (in two places)
>
> then d->z is dereferenced in dsnowball_lexize().
>
> Confirm.
locate_stem_module() in dict_snowball.c stores m->create() into d->z
without checking. *_create_env wrappers correctly return NULL when
SN_new_env fails. dsnowball_init then succeeds with d->z == NULL, and
dsnowball_lexize crashes in SN_set_current / replace_s.

--
Regards,
Rachitskiy Andrey