Content-Type: multipart/alternative;
 boundary="------------jO7ieUOL8cMFyAdtfcfvwgbt"
Message-ID: <2ab10d25-7dc6-4914-8aea-ca0adfbe57c3@gmail.com>
Date: Sun, 30 Aug 2026 07:00:00 +0300
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Subject: Re: BUG #19595: Three memory-safety defects in
 src/backend/tsearch/spell.c (dictionary loader), PG 18.3
To: Tom Lane <tgl@sss.pgh.pa.us>
Cc: Andrey Rachitskiy <pl0h0yp1@gmail.com>, michaelmalis2@gmail.com,
 pgsql-bugs@lists.postgresql.org
References: <19595-7dc18b4e212c4757@postgresql.org>
 <CAB8bMiun+cTqTnv-cTfxvTbnOLxWunRgyZeUZ88YMSLLXub4mg@mail.gmail.com>
 <325748.1785691547@sss.pgh.pa.us>
 <0f3ddeb5-0dbd-479c-9d0e-ae254758e624@gmail.com>
 <336527.1785701494@sss.pgh.pa.us>
Content-Language: en-US
From: Alexander Lakhin <exclusion@gmail.com>
In-Reply-To: <336527.1785701494@sss.pgh.pa.us>
Archived-At: 
 <https://www.postgresql.org/message-id/2ab10d25-7dc6-4914-8aea-ca0adfbe57c3%40gmail.com>
Precedence: bulk

This is a multi-part message in MIME format.
--------------jO7ieUOL8cMFyAdtfcfvwgbt
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit

Hello Tom,

02.08.2026 23:11, Tom Lane wrote:
> Hmph.  Not sure I'd call that "memory safety", but yeah, this bit
> isn't being careful about having a valid intermediate state of the
> data structure.  Thanks for the report!

I discovered one more issue in this area. This OOM condition emulation:
--- a/src/backend/snowball/libstemmer/api.c
+++ b/src/backend/snowball/libstemmer/api.c
@@ -6,3 +6,3 @@ extern struct SN_env * SN_new_env(int alloc_size)
  {
-    struct SN_env * z = (struct SN_env *) malloc(alloc_size);
+    struct SN_env * z = (rand() % 2 == 0) ? NULL : (struct SN_env *) malloc(alloc_size);
      if (z == NULL) return NULL;

leads to `make check` crashes like:
2026-08-30 06:42:24.759 EEST postmaster[1423557] LOG:  client backend (PID 1423766) was terminated by signal 11: 
Segmentation fault
2026-08-30 06:42:24.759 EEST postmaster[1423557] DETAIL:  Failed process was running: SELECT 
ts_delete(to_tsvector('english', 'Rebel spaceships, striking from a hidden base'), 'spaceship')
or
2026-08-30 06:46:50.112 EEST postmaster[1426347] LOG:  client backend (PID 1427391) was terminated by signal 11: 
Segmentation fault
2026-08-30 06:46:50.112 EEST postmaster[1426347] DETAIL:  Failed process was running: SELECT ts_lexize('thesaurus', 'one');

Could you please have a look if you're still around?

Best regards,
Alexander
--------------jO7ieUOL8cMFyAdtfcfvwgbt
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 8bit

<!DOCTYPE html>
<html>
  <head>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
  </head>
  <body>
    <div class="moz-cite-prefix">Hello Tom,<br>
      <br>
      02.08.2026 23:11, Tom Lane wrote:<br>
    </div>
    <blockquote type="cite" cite="mid:336527.1785701494@sss.pgh.pa.us">
      <pre wrap="" class="moz-quote-pre">Hmph.  Not sure I'd call that "memory safety", but yeah, this bit
isn't being careful about having a valid intermediate state of the
data structure.  Thanks for the report!
</pre>
    </blockquote>
    <br>
    I discovered one more issue in this area. This OOM condition
    emulation:<br>
    --- a/src/backend/snowball/libstemmer/api.c<br>
    +++ b/src/backend/snowball/libstemmer/api.c<br>
    @@ -6,3 +6,3 @@ extern struct SN_env * SN_new_env(int alloc_size)<br>
     {<br>
    -    struct SN_env * z = (struct SN_env *) malloc(alloc_size);<br>
    +    struct SN_env * z = (rand() % 2 == 0) ? NULL : (struct SN_env
    *) malloc(alloc_size);<br>
         if (z == NULL) return NULL;<br>
    <br>
    leads to `make check` crashes like:<br>
    2026-08-30 06:42:24.759 EEST postmaster[1423557] LOG:  client
    backend (PID 1423766) was terminated by signal 11: Segmentation
    fault<br>
    2026-08-30 06:42:24.759 EEST postmaster[1423557] DETAIL:  Failed
    process was running: SELECT ts_delete(to_tsvector('english', 'Rebel
    spaceships, striking from a hidden base'), 'spaceship')<br>
    or<br>
    2026-08-30 06:46:50.112 EEST postmaster[1426347] LOG:  client
    backend (PID 1427391) was terminated by signal 11: Segmentation
    fault<br>
    2026-08-30 06:46:50.112 EEST postmaster[1426347] DETAIL:  Failed
    process was running: SELECT ts_lexize('thesaurus', 'one');<br>
    <br>
    Could you please have a look if you're still around?<br>
    <br>
    Best regards,<br>
    Alexander<br>
  </body>
</html>

--------------jO7ieUOL8cMFyAdtfcfvwgbt--