pgsql: Harden tsvector code against overflows.

Harden tsvector code against overflows.

The core of this patch is to prevent array_to_tsvector() from
generating invalid tsvectors. It did not check for overly-long
lexemes (so that WordEntry.len fields could overflow), nor did it
check that the total "datalen" fits within MAXSTRPOS (so that
WordEntry.pos fields could overflow, and the number of entries
in the tsvector could be much more than the normal limit).
While the field overflows couldn't do anything much worse than
produce a corrupted tsvector value, a sufficiently large number
of tsvector entries could cause integer overflows in later
processing, such as tsvectorout.

Another important fix is to prevent tsvectorrecv() from accepting
invalid tsvectors. The main problem there is that it did not
reject empty-string lexemes. Hence, even though it did (mostly)
enforce the MAXSTRPOS limit, it could still produce a result
with an unreasonable number of tsvector entries, if they were
primarily empty strings.

Also, fix tsvectorout's calculation of its required output
buffer size: it was multiplying the string lengths by
pg_database_encoding_max_length() for no reason. That contributed
to the risk of integer overflow there. With valid tsvector input,
there's no risk, but there's still no reason to make the output
buffer several times bigger than needed.

I also tried to make a couple of related routines more robust,
and spent some effort on improving the comments in ts_type.h.
Also, standardize on a single spelling of the "string is too long
for tsvector" message, using %zu instead of an assortment of formats.
These changes aren't security per se but came out of inspecting the
code for problems.

Reported-by: Yuhang Wu <yuhang(at)depthfirst(dot)com> and Zhenpeng Lin
Reported-by: Zheng Yu <zheng(at)depthfirst(dot)com>
Reported-by: Hcamael <baiyjrh(at)gmail(dot)com>
Author: Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us>
Reviewed-by: Amit Langote <amitlangote09(at)gmail(dot)com>
Backpatch-through: 14
Security: CVE-2026-14662

Branch
------
REL_16_STABLE

Details
-------
https://git.postgresql.org/pg/commitdiff/7c1a8805a3ab9a8827621f833cbc4415adfcb9ee
Author: Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us>

Modified Files
--------------
src/backend/tsearch/to_tsany.c | 23 +++++++++++++++-----
src/backend/tsearch/ts_parse.c | 27 ++++++++++++++++++-----
src/backend/utils/adt/tsvector.c | 28 ++++++++++++++++++------
src/backend/utils/adt/tsvector_op.c | 40 +++++++++++++++++++++++++++++-----
src/include/tsearch/ts_type.h | 43 ++++++++++++++++++++++++++-----------
5 files changed, 126 insertions(+), 35 deletions(-)