Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1wuXKv-000m6Y-2o for pgsql-committers@arkaria.postgresql.org; Thu, 13 Aug 2026 15:27:17 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.96) (envelope-from ) id 1wuXJs-00F4fI-2L for pgsql-committers@arkaria.postgresql.org; Thu, 13 Aug 2026 15:26:13 +0000 Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29]) by malur.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1wtQGm-00HRGI-1w for pgsql-committers@lists.postgresql.org; Mon, 10 Aug 2026 13:42:24 +0000 Received: from mahout.postgresql.org ([2001:4800:3e1:1::227]) by magus.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.98.2) (envelope-from ) id 1wtQGj-00000001M53-33cl for pgsql-committers@lists.postgresql.org; Mon, 10 Aug 2026 13:42:23 +0000 Received: from gemulon.postgresql.org ([72.32.157.198]) by mahout.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1wtQFu-0021BC-0Z for pgsql-committers@lists.postgresql.org; Mon, 10 Aug 2026 13:41:30 +0000 Received: from localhost ([127.0.0.1] helo=gemulon.postgresql.org) by gemulon.postgresql.org with esmtp (Exim 4.98.2) (envelope-from ) id 1wtQFs-00000000yFq-3eL8 for pgsql-committers@lists.postgresql.org; Mon, 10 Aug 2026 13:41:28 +0000 Content-Type: multipart/mixed; boundary="===============7235691382167208761==" MIME-Version: 1.0 From: Noah Misch To: pgsql-committers@lists.postgresql.org Subject: pgsql: Harden tsvector code against overflows. X-Auto-Response-Suppress: All Auto-Submitted: auto-generated Message-Id: Date: Mon, 10 Aug 2026 13:41:28 +0000 List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Archived-At: Precedence: bulk --===============7235691382167208761== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 SGFyZGVuIHRzdmVjdG9yIGNvZGUgYWdhaW5zdCBvdmVyZmxvd3MuCgpUaGUgY29yZSBvZiB0aGlz IHBhdGNoIGlzIHRvIHByZXZlbnQgYXJyYXlfdG9fdHN2ZWN0b3IoKSBmcm9tCmdlbmVyYXRpbmcg aW52YWxpZCB0c3ZlY3RvcnMuICBJdCBkaWQgbm90IGNoZWNrIGZvciBvdmVybHktbG9uZwpsZXhl bWVzIChzbyB0aGF0IFdvcmRFbnRyeS5sZW4gZmllbGRzIGNvdWxkIG92ZXJmbG93KSwgbm9yIGRp ZCBpdApjaGVjayB0aGF0IHRoZSB0b3RhbCAiZGF0YWxlbiIgZml0cyB3aXRoaW4gTUFYU1RSUE9T IChzbyB0aGF0CldvcmRFbnRyeS5wb3MgZmllbGRzIGNvdWxkIG92ZXJmbG93LCBhbmQgdGhlIG51 bWJlciBvZiBlbnRyaWVzCmluIHRoZSB0c3ZlY3RvciBjb3VsZCBiZSBtdWNoIG1vcmUgdGhhbiB0 aGUgbm9ybWFsIGxpbWl0KS4KV2hpbGUgdGhlIGZpZWxkIG92ZXJmbG93cyBjb3VsZG4ndCBkbyBh bnl0aGluZyBtdWNoIHdvcnNlIHRoYW4KcHJvZHVjZSBhIGNvcnJ1cHRlZCB0c3ZlY3RvciB2YWx1 ZSwgYSBzdWZmaWNpZW50bHkgbGFyZ2UgbnVtYmVyCm9mIHRzdmVjdG9yIGVudHJpZXMgY291bGQg Y2F1c2UgaW50ZWdlciBvdmVyZmxvd3MgaW4gbGF0ZXIKcHJvY2Vzc2luZywgc3VjaCBhcyB0c3Zl Y3Rvcm91dC4KCkFub3RoZXIgaW1wb3J0YW50IGZpeCBpcyB0byBwcmV2ZW50IHRzdmVjdG9ycmVj digpIGZyb20gYWNjZXB0aW5nCmludmFsaWQgdHN2ZWN0b3JzLiAgVGhlIG1haW4gcHJvYmxlbSB0 aGVyZSBpcyB0aGF0IGl0IGRpZCBub3QKcmVqZWN0IGVtcHR5LXN0cmluZyBsZXhlbWVzLiAgSGVu Y2UsIGV2ZW4gdGhvdWdoIGl0IGRpZCAobW9zdGx5KQplbmZvcmNlIHRoZSBNQVhTVFJQT1MgbGlt aXQsIGl0IGNvdWxkIHN0aWxsIHByb2R1Y2UgYSByZXN1bHQKd2l0aCBhbiB1bnJlYXNvbmFibGUg bnVtYmVyIG9mIHRzdmVjdG9yIGVudHJpZXMsIGlmIHRoZXkgd2VyZQpwcmltYXJpbHkgZW1wdHkg c3RyaW5ncy4KCkFsc28sIGZpeCB0c3ZlY3Rvcm91dCdzIGNhbGN1bGF0aW9uIG9mIGl0cyByZXF1 aXJlZCBvdXRwdXQKYnVmZmVyIHNpemU6IGl0IHdhcyBtdWx0aXBseWluZyB0aGUgc3RyaW5nIGxl bmd0aHMgYnkKcGdfZGF0YWJhc2VfZW5jb2RpbmdfbWF4X2xlbmd0aCgpIGZvciBubyByZWFzb24u ICBUaGF0IGNvbnRyaWJ1dGVkCnRvIHRoZSByaXNrIG9mIGludGVnZXIgb3ZlcmZsb3cgdGhlcmUu ICBXaXRoIHZhbGlkIHRzdmVjdG9yIGlucHV0LAp0aGVyZSdzIG5vIHJpc2ssIGJ1dCB0aGVyZSdz IHN0aWxsIG5vIHJlYXNvbiB0byBtYWtlIHRoZSBvdXRwdXQKYnVmZmVyIHNldmVyYWwgdGltZXMg YmlnZ2VyIHRoYW4gbmVlZGVkLgoKSSBhbHNvIHRyaWVkIHRvIG1ha2UgYSBjb3VwbGUgb2YgcmVs YXRlZCByb3V0aW5lcyBtb3JlIHJvYnVzdCwKYW5kIHNwZW50IHNvbWUgZWZmb3J0IG9uIGltcHJv dmluZyB0aGUgY29tbWVudHMgaW4gdHNfdHlwZS5oLgpBbHNvLCBzdGFuZGFyZGl6ZSBvbiBhIHNp bmdsZSBzcGVsbGluZyBvZiB0aGUgInN0cmluZyBpcyB0b28gbG9uZwpmb3IgdHN2ZWN0b3IiIG1l c3NhZ2UsIHVzaW5nICV6dSBpbnN0ZWFkIG9mIGFuIGFzc29ydG1lbnQgb2YgZm9ybWF0cy4KVGhl c2UgY2hhbmdlcyBhcmVuJ3Qgc2VjdXJpdHkgcGVyIHNlIGJ1dCBjYW1lIG91dCBvZiBpbnNwZWN0 aW5nIHRoZQpjb2RlIGZvciBwcm9ibGVtcy4KClJlcG9ydGVkLWJ5OiBZdWhhbmcgV3UgPHl1aGFu Z0BkZXB0aGZpcnN0LmNvbT4gYW5kIFpoZW5wZW5nIExpbgpSZXBvcnRlZC1ieTogWmhlbmcgWXUg PHpoZW5nQGRlcHRoZmlyc3QuY29tPgpSZXBvcnRlZC1ieTogSGNhbWFlbCA8YmFpeWpyaEBnbWFp bC5jb20+CkF1dGhvcjogVG9tIExhbmUgPHRnbEBzc3MucGdoLnBhLnVzPgpSZXZpZXdlZC1ieTog QW1pdCBMYW5nb3RlIDxhbWl0bGFuZ290ZTA5QGdtYWlsLmNvbT4KQmFja3BhdGNoLXRocm91Z2g6 IDE0ClNlY3VyaXR5OiBDVkUtMjAyNi0xNDY2MgoKQnJhbmNoCi0tLS0tLQpSRUxfMTZfU1RBQkxF CgpEZXRhaWxzCi0tLS0tLS0KaHR0cHM6Ly9naXQucG9zdGdyZXNxbC5vcmcvcGcvY29tbWl0ZGlm Zi83YzFhODgwNWEzYWI5YTg4Mjc2MjFmODMzY2JjNDQxNWFkZmNiOWVlCkF1dGhvcjogVG9tIExh bmUgPHRnbEBzc3MucGdoLnBhLnVzPgoKTW9kaWZpZWQgRmlsZXMKLS0tLS0tLS0tLS0tLS0Kc3Jj L2JhY2tlbmQvdHNlYXJjaC90b190c2FueS5jICAgICAgfCAyMyArKysrKysrKysrKysrKystLS0t LQpzcmMvYmFja2VuZC90c2VhcmNoL3RzX3BhcnNlLmMgICAgICB8IDI3ICsrKysrKysrKysrKysr KysrKy0tLS0tCnNyYy9iYWNrZW5kL3V0aWxzL2FkdC90c3ZlY3Rvci5jICAgIHwgMjggKysrKysr KysrKysrKysrKysrLS0tLS0tCnNyYy9iYWNrZW5kL3V0aWxzL2FkdC90c3ZlY3Rvcl9vcC5jIHwg NDAgKysrKysrKysrKysrKysrKysrKysrKysrKysrKystLS0tLQpzcmMvaW5jbHVkZS90c2VhcmNo L3RzX3R5cGUuaCAgICAgICB8IDQzICsrKysrKysrKysrKysrKysrKysrKysrKysrLS0tLS0tLS0t LS0KNSBmaWxlcyBjaGFuZ2VkLCAxMjYgaW5zZXJ0aW9ucygrKSwgMzUgZGVsZXRpb25zKC0pCgo= --===============7235691382167208761==--