Content-Type: multipart/mixed; boundary="------------Nw4hol3wvH7pPsxfkkRKlHfw"
Message-ID: <0f3ddeb5-0dbd-479c-9d0e-ae254758e624@gmail.com>
Date: Sun, 2 Aug 2026 23:00:01 +0300
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
From: Alexander Lakhin <exclusion@gmail.com>
Subject: Re: BUG #19595: Three memory-safety defects in
 src/backend/tsearch/spell.c (dictionary loader), PG 18.3
To: Tom Lane <tgl@sss.pgh.pa.us>, Andrey Rachitskiy <pl0h0yp1@gmail.com>
Cc: michaelmalis2@gmail.com, pgsql-bugs@lists.postgresql.org
References: <19595-7dc18b4e212c4757@postgresql.org>
 <CAB8bMiun+cTqTnv-cTfxvTbnOLxWunRgyZeUZ88YMSLLXub4mg@mail.gmail.com>
 <325748.1785691547@sss.pgh.pa.us>
Content-Language: en-US
In-Reply-To: <325748.1785691547@sss.pgh.pa.us>
Archived-At: 
 <https://www.postgresql.org/message-id/0f3ddeb5-0dbd-479c-9d0e-ae254758e624%40gmail.com>
Precedence: bulk

This is a multi-part message in MIME format.
--------------Nw4hol3wvH7pPsxfkkRKlHfw
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit

Hello Tom,

02.08.2026 20:25, Tom Lane wrote:
> Andrey Rachitskiy<pl0h0yp1@gmail.com> writes:
>> Hi, Michael!
>> Patch attached.
> I pushed these code changes with one minor tweak: adjusting the
> new error message in NIImportOOAffixes to look more like the
> existing one about too many aliases.
>
> I left out the test cases.  I don't think we need them, and
> I certainly don't think we want to install intentionally-broken
> files as sample data, as this patch would have done.

I'm not sure it's directly related to this bug report, but maybe you'd
like to fix one more memory-safety defect in tsearch in passing...

With the oom-simulation patch applied, the following script:
for i in {1..10}; do
echo "
SELECT COUNT(*) FROM pg_ts_dict;

CREATE TEXT SEARCH DICTIONARY thesaurus (Template=thesaurus, DictFile=thesaurus_sample, Dictionary=english_stem);

CREATE TEXT SEARCH CONFIGURATION tst (COPY=english);
SELECT to_tsvector('tst', 'Test test');

DROP TEXT SEARCH CONFIGURATION tst;
DROP TEXT SEARCH DICTIONARY thesaurus;
" | psql

grep 'was terminated' server.log && break;
done

fails for me as below:
2026-08-02 19:48:45.625 UTC [560023] LOG:  client backend (PID 560036) was terminated by signal 11: Segmentation fault

Core was generated by `postgres: law regression [local] SELECT                        '.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x000055aecffd519e in MemoryContextSetIdentifier (context=0x7f7f7f7f7f7f7f7f, id=0x0) at mcxt.c:667
667             Assert(MemoryContextIsValid(context));
(gdb) bt
#0  0x000055aecffd519e in MemoryContextSetIdentifier (context=0x7f7f7f7f7f7f7f7f, id=0x0) at mcxt.c:667
#1  0x000055aecff863c1 in lookup_ts_dictionary_cache (dictId=13336) at ts_cache.c:307
#2  0x000055aecfd87f00 in LexizeExec (ld=0x7ffe75617c20, correspondLexem=0x0) at ts_parse.c:204
#3  0x000055aecfd88741 in parsetext (cfgId=16385, prs=0x7ffe75617cc0, buf=0x55aeee42bba4 "Test test~\177\1770", 
buflen=9) at ts_parse.c:402
#4  0x000055aecfd8667d in to_tsvector_byid (fcinfo=0x55aeee5188c0) at to_tsany.c:260
#5  0x000055aecfa2a399 in ExecInterpExpr (state=0x55aeee5187e0, econtext=0x55aeee518d20, isnull=0x7ffe75618064) at 
execExprInterp.c:1011
#6  0x000055aecfa2cf0b in ExecInterpExprStillValid (state=0x55aeee5187e0, econtext=0x55aeee518d20, 
isNull=0x7ffe75618064) at execExprInterp.c:2309
#7  0x000055aecfbfba26 in ExecEvalExprSwitchContext (state=0x55aeee5187e0, econtext=0x55aeee518d20, isNull=0x7ffe75618064)
     at ../../../../src/include/executor/executor.h:452

Plain `make check` triggers similar crashes as well...

Best regards,
Alexander
--------------Nw4hol3wvH7pPsxfkkRKlHfw
Content-Type: text/x-patch; charset=UTF-8;
 name="lookup_ts_dictionary_cache-oom.patch"
Content-Disposition: attachment;
 filename="lookup_ts_dictionary_cache-oom.patch"
Content-Transfer-Encoding: base64

ZGlmZiAtLWdpdCBhL3NyYy9iYWNrZW5kL3V0aWxzL2NhY2hlL3RzX2NhY2hlLmMgYi9zcmMv
YmFja2VuZC91dGlscy9jYWNoZS90c19jYWNoZS5jCmluZGV4IDllMjlmMTM4NmIwLi5kYmJi
YTY4N2FhZiAxMDA2NDQKLS0tIGEvc3JjL2JhY2tlbmQvdXRpbHMvY2FjaGUvdHNfY2FjaGUu
YworKysgYi9zcmMvYmFja2VuZC91dGlscy9jYWNoZS90c19jYWNoZS5jCkBAIC0yOTEsMTAg
KzI5MSwxMiBAQCBsb29rdXBfdHNfZGljdGlvbmFyeV9jYWNoZShPaWQgZGljdElkKQogCQkJ
CQkJCUhBU0hfRU5URVIsICZmb3VuZCk7CiAJCQlBc3NlcnQoIWZvdW5kKTsJCS8qIGl0IHdh
c24ndCB0aGVyZSBhIG1vbWVudCBhZ28gKi8KIAorb29tX3Byb2IgPSAwLjU7CiAJCQkvKiBD
cmVhdGUgcHJpdmF0ZSBtZW1vcnkgY29udGV4dCB0aGUgZmlyc3QgdGltZSB0aHJvdWdoICov
CiAJCQlzYXZlQ3R4ID0gQWxsb2NTZXRDb250ZXh0Q3JlYXRlKENhY2hlTWVtb3J5Q29udGV4
dCwKIAkJCQkJCQkJCQkJIlRTIGRpY3Rpb25hcnkiLAogCQkJCQkJCQkJCQlBTExPQ1NFVF9T
TUFMTF9TSVpFUyk7Citvb21fcHJvYiA9IDA7CiAJCQlNZW1vcnlDb250ZXh0Q29weUFuZFNl
dElkZW50aWZpZXIoc2F2ZUN0eCwgTmFtZVN0cihkaWN0LT5kaWN0bmFtZSkpOwogCQl9CiAJ
CWVsc2UKZGlmZiAtLWdpdCBhL3NyYy9iYWNrZW5kL3V0aWxzL21tZ3IvYXNldC5jIGIvc3Jj
L2JhY2tlbmQvdXRpbHMvbW1nci9hc2V0LmMKaW5kZXggNmE5ZWEzNjcxMDcuLjU4ODNlYzdm
Yjk5IDEwMDY0NAotLS0gYS9zcmMvYmFja2VuZC91dGlscy9tbWdyL2FzZXQuYworKysgYi9z
cmMvYmFja2VuZC91dGlscy9tbWdyL2FzZXQuYwpAQCAtNTEsNiArNTEsNyBAQAogI2luY2x1
ZGUgInV0aWxzL21lbXV0aWxzLmgiCiAjaW5jbHVkZSAidXRpbHMvbWVtdXRpbHNfaW50ZXJu
YWwuaCIKICNpbmNsdWRlICJ1dGlscy9tZW11dGlsc19tZW1vcnljaHVuay5oIgorI2luY2x1
ZGUgImNvbW1vbi9wZ19wcm5nLmgiCiAKIC8qLS0tLS0tLS0tLS0tLS0tLS0tLS0KICAqIENo
dW5rIGZyZWVsaXN0IGsgaG9sZHMgY2h1bmtzIG9mIHNpemUgMSA8PCAoayArIEFMTE9DX01J
TkJJVFMpLApAQCAtNDQxLDcgKzQ0Miw3IEBAIEFsbG9jU2V0Q29udGV4dENyZWF0ZUludGVy
bmFsKE1lbW9yeUNvbnRleHQgcGFyZW50LAogCSAqIEFsbG9jYXRlIHRoZSBpbml0aWFsIGJs
b2NrLiAgVW5saWtlIG90aGVyIGFzZXQuYyBibG9ja3MsIGl0IHN0YXJ0cyB3aXRoCiAJICog
dGhlIGNvbnRleHQgaGVhZGVyIGFuZCBpdHMgYmxvY2sgaGVhZGVyIGZvbGxvd3MgdGhhdC4K
IAkgKi8KLQlzZXQgPSAoQWxsb2NTZXQpIG1hbGxvYyhmaXJzdEJsb2NrU2l6ZSk7CisJc2V0
ID0gKHBnX3BybmdfZG91YmxlKCZwZ19nbG9iYWxfcHJuZ19zdGF0ZSkgPCBvb21fcHJvYikg
PyBOVUxMIDogKEFsbG9jU2V0KSBtYWxsb2MoZmlyc3RCbG9ja1NpemUpOwogCWlmIChzZXQg
PT0gTlVMTCkKIAl7CiAJCWlmIChUb3BNZW1vcnlDb250ZXh0KQpkaWZmIC0tZ2l0IGEvc3Jj
L2JhY2tlbmQvdXRpbHMvbW1nci9tY3h0LmMgYi9zcmMvYmFja2VuZC91dGlscy9tbWdyL21j
eHQuYwppbmRleCA5MzBmYzQ1NzMyOC4uYWYwNTBlZDg3MGQgMTAwNjQ0Ci0tLSBhL3NyYy9i
YWNrZW5kL3V0aWxzL21tZ3IvbWN4dC5jCisrKyBiL3NyYy9iYWNrZW5kL3V0aWxzL21tZ3Iv
bWN4dC5jCkBAIC00Niw2ICs0Niw3IEBACiAjaW5jbHVkZSAidXRpbHMvbWVtdXRpbHNfaW50
ZXJuYWwuaCIKICNpbmNsdWRlICJ1dGlscy9tZW11dGlsc19tZW1vcnljaHVuay5oIgogCitk
b3VibGUgb29tX3Byb2IgPSAwOwogCiBzdGF0aWMgdm9pZCBCb2d1c0ZyZWUodm9pZCAqcG9p
bnRlcik7CiBzdGF0aWMgdm9pZCAqQm9ndXNSZWFsbG9jKHZvaWQgKnBvaW50ZXIsIFNpemUg
c2l6ZSwgaW50IGZsYWdzKTsKZGlmZiAtLWdpdCBhL3NyYy9pbmNsdWRlL3V0aWxzL3BhbGxv
Yy5oIGIvc3JjL2luY2x1ZGUvdXRpbHMvcGFsbG9jLmgKaW5kZXggMGU5MzQxNThiNjAuLjkw
MDMzZGRjNWEzIDEwMDY0NAotLS0gYS9zcmMvaW5jbHVkZS91dGlscy9wYWxsb2MuaAorKysg
Yi9zcmMvaW5jbHVkZS91dGlscy9wYWxsb2MuaApAQCAtMTYzLDUgKzE2Myw2IEBAIGV4dGVy
biBjaGFyICpwY2hvbXAoY29uc3QgY2hhciAqaW4pOwogLyogc3ByaW50ZiBpbnRvIGEgcGFs
bG9jJ2QgYnVmZmVyIC0tLSB0aGVzZSBhcmUgaW4gcHNwcmludGYuYyAqLwogZXh0ZXJuIGNo
YXIgKnBzcHJpbnRmKGNvbnN0IGNoYXIgKmZtdCwgLi4uKSBwZ19hdHRyaWJ1dGVfcHJpbnRm
KDEsIDIpOwogZXh0ZXJuIHNpemVfdCBwdnNucHJpbnRmKGNoYXIgKmJ1Ziwgc2l6ZV90IGxl
biwgY29uc3QgY2hhciAqZm10LCB2YV9saXN0IGFyZ3MpIHBnX2F0dHJpYnV0ZV9wcmludGYo
MywgMCk7CitleHRlcm4gZG91YmxlIG9vbV9wcm9iOwogCiAjZW5kaWYJCQkJCQkJLyogUEFM
TE9DX0ggKi8K

--------------Nw4hol3wvH7pPsxfkkRKlHfw--