postgres.git / summary / log / commit / refs

commit    444038bb78d5d5f950e9f9bd5166c4f79bc3d4c0
Author:   Tom Lane <tgl@sss.pgh.pa.us>
Date:     Sun Aug 02 17:22:39 2026 +0000
First released in: 14.24, 15.19, 16.15, 17.11, 18.6

    Fix memory-safety bugs in the ispell/hunspell dictionary loader.
    
    Allocate CompoundAffix with room for its terminator, initialize the
    old-format flag buffer before NIAddAffix(), and reject incomplete or
    missing Hunspell AF aliases.  None of these errors would be likely to
    trigger on real dictionary files, accounting for the lack of previous
    reports; but they're certainly bugs.
    
    Bug: #19595
    Reported-by: Michael Malis <michaelmalis2@gmail.com>
    Author: Andrey Rachitskiy <pl0h0yp1@gmail.com>
    Reviewed-by: Tom Lane <tgl@sss.pgh.pa.us>
    Discussion: https://postgr.es/m/19595-7dc18b4e212c4757@postgresql.org
    Backpatch-through: 14


 src/backend/tsearch/spell.c | 18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

diff --git a/src/backend/tsearch/spell.c b/src/backend/tsearch/spell.c
index c28da26e39b..cd2822e6b30 100644
--- a/src/backend/tsearch/spell.c
+++ b/src/backend/tsearch/spell.c
@@ -1181,12 +1181,18 @@ getAffixFlagSet(IspellDict *Conf, char *s)
 					 errmsg("invalid affix alias \"%s\"", s)));
 
 		if (curaffix > 0 && curaffix < Conf->nAffixData)
+		{
+			if (Conf->AffixData[curaffix] == NULL)
+				ereport(ERROR,
+						(errcode(ERRCODE_CONFIG_FILE_ERROR),
+						 errmsg("invalid affix alias \"%s\"", s)));
 
 			/*
 			 * Do not subtract 1 from curaffix because empty string was added
 			 * in NIImportOOAffixes
 			 */
 			return Conf->AffixData[curaffix];
+		}
 		else if (curaffix > Conf->nAffixData)
 			ereport(ERROR,
 					(errcode(ERRCODE_CONFIG_FILE_ERROR),
@@ -1421,6 +1427,13 @@ nextline:
 	tsearch_readline_end(&trst);
 	if (ptype)
 		pfree(ptype);
+
+	/* Reject incomplete AF alias table. */
+	if (Conf->useFlagAliases && curaffix != naffix)
+		ereport(ERROR,
+				(errcode(ERRCODE_CONFIG_FILE_ERROR),
+				 errmsg("number of aliases is less than specified number %d",
+						naffix - 1)));
 }
 
 /*
@@ -1448,6 +1461,8 @@ NIImportAffixes(IspellDict *Conf, const char *filename)
 	bool		oldformat = false;
 	char	   *recoded = NULL;
 
+	flag[0] = '\0';				/* no flag seen yet */
+
 	if (!tsearch_readline_begin(&trst, filename))
 		ereport(ERROR,
 				(errcode(ERRCODE_CONFIG_FILE_ERROR),
@@ -1993,7 +2008,8 @@ NISortAffixes(IspellDict *Conf)
 	/* Store compound affixes in the Conf->CompoundAffix array */
 	if (Conf->naffixes > 1)
 		qsort(Conf->Affix, Conf->naffixes, sizeof(AFFIX), cmpaffix);
-	Conf->CompoundAffix = ptr = (CMPDAffix *) palloc(sizeof(CMPDAffix) * Conf->naffixes);
+	/* +1 for terminator */
+	Conf->CompoundAffix = ptr = palloc_array(CMPDAffix, Conf->naffixes + 1);
 	ptr->affix = NULL;
 
 	for (i = 0; i < Conf->naffixes; i++)


[parent: 796c275a018b]