Content-Type: multipart/alternative;
 boundary="------------C3Kztbq5lGZoY6c8ENKCdkIb"
Message-ID: <6e7563f0-48df-4639-b263-f04bc23c876b@gmail.com>
Date: Sun, 30 Aug 2026 07:30:00 +0300
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Subject: Re: BUG #19595: Three memory-safety defects in
 src/backend/tsearch/spell.c (dictionary loader), PG 18.3
To: Tom Lane <tgl@sss.pgh.pa.us>
Cc: Andrey Rachitskiy <pl0h0yp1@gmail.com>, michaelmalis2@gmail.com,
 pgsql-bugs@lists.postgresql.org
References: <19595-7dc18b4e212c4757@postgresql.org>
 <CAB8bMiun+cTqTnv-cTfxvTbnOLxWunRgyZeUZ88YMSLLXub4mg@mail.gmail.com>
 <325748.1785691547@sss.pgh.pa.us>
 <0f3ddeb5-0dbd-479c-9d0e-ae254758e624@gmail.com>
 <336527.1785701494@sss.pgh.pa.us>
 <2ab10d25-7dc6-4914-8aea-ca0adfbe57c3@gmail.com>
 <445119.1788062647@sss.pgh.pa.us>
Content-Language: en-US
From: Alexander Lakhin <exclusion@gmail.com>
In-Reply-To: <445119.1788062647@sss.pgh.pa.us>
Archived-At: 
 <https://www.postgresql.org/message-id/6e7563f0-48df-4639-b263-f04bc23c876b%40gmail.com>
Precedence: bulk

This is a multi-part message in MIME format.
--------------C3Kztbq5lGZoY6c8ENKCdkIb
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit

30.08.2026 07:04, Tom Lane wrote:
> Hmph.  SN_new_env itself is visibly okay with this, so the failure is
> in some caller.  I'm too tired to dig into it myself, but can you
> identify the culprit more precisely?

I think it's:
static void
locate_stem_module(DictSnowball *d, const char *lang)
{
...
                         d->stem = m->stem;
                         d->z = m->create();
...
(in two places)

then d->z is dereferenced in dsnowball_lexize().

Thank you for your time!

Best regards,
Alexander
--------------C3Kztbq5lGZoY6c8ENKCdkIb
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 8bit

<!DOCTYPE html>
<html>
  <head>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
  </head>
  <body>
    <div class="moz-cite-prefix">30.08.2026 07:04, Tom Lane wrote:<br>
    </div>
    <blockquote type="cite" cite="mid:445119.1788062647@sss.pgh.pa.us">
      <pre wrap="" class="moz-quote-pre">Hmph.  SN_new_env itself is visibly okay with this, so the failure is
in some caller.  I'm too tired to dig into it myself, but can you
identify the culprit more precisely?
</pre>
    </blockquote>
    <br>
    I think it's:<br>
    static void<br>
    locate_stem_module(DictSnowball *d, const char *lang)<br>
    {<br>
    ...<br>
                            d-&gt;stem = m-&gt;stem;<br>
                            d-&gt;z = m-&gt;create();<br>
    ...<br>
    (in two places)<br>
    <br>
    then d-&gt;z is dereferenced in dsnowball_lexize().<br>
    <br>
    Thank you for your time!<br>
    <br>
    Best regards,<br>
    Alexander<br>
  </body>
</html>

--------------C3Kztbq5lGZoY6c8ENKCdkIb--