agora inbox for pgsql-bugs@postgresql.org
help / color / mirror / Atom feedFrom: Alexander Lakhin <exclusion@gmail.com>
To: Tom Lane <tgl@sss.pgh.pa.us>
Cc: Andrey Rachitskiy <pl0h0yp1@gmail.com>
Cc: michaelmalis2@gmail.com
Cc: pgsql-bugs@lists.postgresql.org
Subject: Re: BUG #19595: Three memory-safety defects in src/backend/tsearch/spell.c (dictionary loader), PG 18.3
Date: Sun, 30 Aug 2026 07:00:00 +0300
Message-ID: <2ab10d25-7dc6-4914-8aea-ca0adfbe57c3@gmail.com> (raw)
In-Reply-To: <336527.1785701494@sss.pgh.pa.us>
References: <19595-7dc18b4e212c4757@postgresql.org>
<CAB8bMiun+cTqTnv-cTfxvTbnOLxWunRgyZeUZ88YMSLLXub4mg@mail.gmail.com>
<325748.1785691547@sss.pgh.pa.us>
<0f3ddeb5-0dbd-479c-9d0e-ae254758e624@gmail.com>
<336527.1785701494@sss.pgh.pa.us>
Hello Tom,
02.08.2026 23:11, Tom Lane wrote:
> Hmph. Not sure I'd call that "memory safety", but yeah, this bit
> isn't being careful about having a valid intermediate state of the
> data structure. Thanks for the report!
I discovered one more issue in this area. This OOM condition emulation:
--- a/src/backend/snowball/libstemmer/api.c
+++ b/src/backend/snowball/libstemmer/api.c
@@ -6,3 +6,3 @@ extern struct SN_env * SN_new_env(int alloc_size)
{
- struct SN_env * z = (struct SN_env *) malloc(alloc_size);
+ struct SN_env * z = (rand() % 2 == 0) ? NULL : (struct SN_env *) malloc(alloc_size);
if (z == NULL) return NULL;
leads to `make check` crashes like:
2026-08-30 06:42:24.759 EEST postmaster[1423557] LOG: client backend (PID 1423766) was terminated by signal 11:
Segmentation fault
2026-08-30 06:42:24.759 EEST postmaster[1423557] DETAIL: Failed process was running: SELECT
ts_delete(to_tsvector('english', 'Rebel spaceships, striking from a hidden base'), 'spaceship')
or
2026-08-30 06:46:50.112 EEST postmaster[1426347] LOG: client backend (PID 1427391) was terminated by signal 11:
Segmentation fault
2026-08-30 06:46:50.112 EEST postmaster[1426347] DETAIL: Failed process was running: SELECT ts_lexize('thesaurus', 'one');
Could you please have a look if you're still around?
Best regards,
Alexander
view thread (15+ messages) latest in thread
Message-ID: <2ab10d25-7dc6-4914-8aea-ca0adfbe57c3@gmail.com>
Permalink: ../2ab10d25-7dc6-4914-8aea-ca0adfbe57c3@gmail.com/
Also on: postgresql.org/message-id/2ab10d25-7dc6-4914-8aea-ca0adfbe57c3@gmail.com
reply
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-bugs@postgresql.org
Cc: exclusion@gmail.com, tgl@sss.pgh.pa.us, pl0h0yp1@gmail.com, michaelmalis2@gmail.com, pgsql-bugs@lists.postgresql.org
Subject: Re: BUG #19595: Three memory-safety defects in src/backend/tsearch/spell.c (dictionary loader), PG 18.3
In-Reply-To: <2ab10d25-7dc6-4914-8aea-ca0adfbe57c3@gmail.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox