postgres.git / summary / log / commit / refs

commit    cf12c4fd2912c23083a990febe55f79d0253a554
Author:   Tom Lane <tgl@sss.pgh.pa.us>
Date:     Sun Oct 01 17:16:47 2023 +0000

    Fix datalen calculation in tsvectorrecv().
    
    After receiving position data for a lexeme, tsvectorrecv()
    advanced its "datalen" value by (npos+1)*sizeof(WordEntry)
    where the correct calculation is (npos+1)*sizeof(WordEntryPos).
    This accidentally failed to render the constructed tsvector
    invalid, but it did result in leaving some wasted space
    approximately equal to the space consumed by the position data.
    That could have several bad effects:
    
    * Disk space is wasted if the received tsvector is stored into a
      table as-is.
    
    * A legal tsvector could get rejected with "maximum total lexeme
      length exceeded" if the extra space pushes it over the MAXSTRPOS
      limit.
    
    * In edge cases, the finished tsvector could be assigned a length
      larger than the allocated size of its palloc chunk, conceivably
      leading to SIGSEGV when the tsvector gets copied somewhere else.
      The odds of a field failure of this sort seem low, though valgrind
      testing could probably have found this.
    
    While we're here, let's express the calculation as
    "sizeof(uint16) + npos * sizeof(WordEntryPos)" to avoid the type
    pun implicit in the "npos + 1" formulation.  It's not wrong
    given that WordEntryPos had better be 2 bytes to avoid padding
    problems, but it seems clearer this way.
    
    Report and patch by Denis Erokhin.  Back-patch to all supported
    versions.
    
    Discussion: https://postgr.es/m/009801d9f2d9$f29730c0$d7c59240$@datagile.ru


 src/backend/utils/adt/tsvector.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/backend/utils/adt/tsvector.c b/src/backend/utils/adt/tsvector.c
index b02fecc0811..62f0926d864 100644
--- a/src/backend/utils/adt/tsvector.c
+++ b/src/backend/utils/adt/tsvector.c
@@ -491,7 +491,7 @@ tsvectorrecv(PG_FUNCTION_ARGS)
 		 * But make sure the buffer is large enough first.
 		 */
 		while (hdrlen + SHORTALIGN(datalen + lex_len) +
-			   (npos + 1) * sizeof(WordEntryPos) >= len)
+			   sizeof(uint16) + npos * sizeof(WordEntryPos) >= len)
 		{
 			len *= 2;
 			vec = (TSVector) repalloc(vec, len);
@@ -537,7 +537,7 @@ tsvectorrecv(PG_FUNCTION_ARGS)
 					elog(ERROR, "position information is misordered");
 			}
 
-			datalen += (npos + 1) * sizeof(WordEntry);
+			datalen += sizeof(uint16) + npos * sizeof(WordEntryPos);
 		}
 	}
 


[parent: a715c02122e7]