pg.ddx.io  pgsql-bugs@postgresql.org mailing list archive  

help / color / mirror / Atom feed
From: Alexander Lakhin <exclusion@gmail.com>
To: Tom Lane <tgl@sss.pgh.pa.us>
Cc: Andrey Rachitskiy <pl0h0yp1@gmail.com>
Cc: michaelmalis2@gmail.com
Cc: pgsql-bugs@lists.postgresql.org
Subject: Re: BUG #19595: Three memory-safety defects in src/backend/tsearch/spell.c (dictionary loader), PG 18.3
Date: Sun, 30 Aug 2026 07:30:00 +0300
Message-ID: <6e7563f0-48df-4639-b263-f04bc23c876b@gmail.com> (raw)
In-Reply-To: <445119.1788062647@sss.pgh.pa.us>
References: <19595-7dc18b4e212c4757@postgresql.org>
	<CAB8bMiun+cTqTnv-cTfxvTbnOLxWunRgyZeUZ88YMSLLXub4mg@mail.gmail.com>
	<325748.1785691547@sss.pgh.pa.us>
	<0f3ddeb5-0dbd-479c-9d0e-ae254758e624@gmail.com>
	<336527.1785701494@sss.pgh.pa.us>
	<2ab10d25-7dc6-4914-8aea-ca0adfbe57c3@gmail.com>
	<445119.1788062647@sss.pgh.pa.us>

30.08.2026 07:04, Tom Lane wrote:
> Hmph.  SN_new_env itself is visibly okay with this, so the failure is
> in some caller.  I'm too tired to dig into it myself, but can you
> identify the culprit more precisely?

I think it's:
static void
locate_stem_module(DictSnowball *d, const char *lang)
{
...
                         d->stem = m->stem;
                         d->z = m->create();
...
(in two places)

then d->z is dereferenced in dsnowball_lexize().

Thank you for your time!

Best regards,
Alexander

view thread (15+ messages)  latest in thread

Message-ID: <6e7563f0-48df-4639-b263-f04bc23c876b@gmail.com>
Permalink:  ../6e7563f0-48df-4639-b263-f04bc23c876b@gmail.com/
Also on:    postgresql.org/message-id/6e7563f0-48df-4639-b263-f04bc23c876b@gmail.com

 · 

reply
Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-bugs@postgresql.org
  Cc: exclusion@gmail.com, tgl@sss.pgh.pa.us, pl0h0yp1@gmail.com, michaelmalis2@gmail.com, pgsql-bugs@lists.postgresql.org
  Subject: Re: BUG #19595: Three memory-safety defects in src/backend/tsearch/spell.c (dictionary loader), PG 18.3
  In-Reply-To: <6e7563f0-48df-4639-b263-f04bc23c876b@gmail.com>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox