Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1wuXKt-000m6Y-2h for pgsql-committers@arkaria.postgresql.org; Thu, 13 Aug 2026 15:27:15 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.96) (envelope-from ) id 1wuXJs-00F4fG-2F for pgsql-committers@arkaria.postgresql.org; Thu, 13 Aug 2026 15:26:13 +0000 Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29]) by malur.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1wtQGf-00HRDN-1D for pgsql-committers@lists.postgresql.org; Mon, 10 Aug 2026 13:42:16 +0000 Received: from mahout.postgresql.org ([2001:4800:3e1:1::227]) by magus.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.98.2) (envelope-from ) id 1wtQGb-00000001M52-3WNN for pgsql-committers@lists.postgresql.org; Mon, 10 Aug 2026 13:42:16 +0000 Received: from gemulon.postgresql.org ([72.32.157.198]) by mahout.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1wtQFv-0021BG-1W for pgsql-committers@lists.postgresql.org; Mon, 10 Aug 2026 13:41:31 +0000 Received: from localhost ([127.0.0.1] helo=gemulon.postgresql.org) by gemulon.postgresql.org with esmtp (Exim 4.98.2) (envelope-from ) id 1wtQFu-00000000yIM-18YK for pgsql-committers@lists.postgresql.org; Mon, 10 Aug 2026 13:41:30 +0000 Content-Type: multipart/mixed; boundary="===============2541683987841500770==" MIME-Version: 1.0 From: Noah Misch To: pgsql-committers@lists.postgresql.org Subject: pgsql: Harden tsquery code against overflows. X-Auto-Response-Suppress: All Auto-Submitted: auto-generated Message-Id: Date: Mon, 10 Aug 2026 13:41:30 +0000 List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Archived-At: Precedence: bulk --===============2541683987841500770== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 SGFyZGVuIHRzcXVlcnkgY29kZSBhZ2FpbnN0IG92ZXJmbG93cy4KClRoZSBvbmx5IG92ZXJmbG93 IGhhemFyZHMgSSBjb3VsZCBmaW5kIGluIHRzcXVlcnkgY29uc3RydWN0aW9uCmFyZSBpbiBRVE4y UVQoKSwgd2hpY2ggYnVpbGRzIGEgZmxhdCB0c3F1ZXJ5IGRhdHVtIGZyb20gdGhlClFUTm9kZSB0 cmVlIHJlcHJlc2VudGF0aW9uIHVzZWQgYnkgdHNxdWVyeV9vciwgdHNxdWVyeV9yZXdyaXRlLAph bmQgYWxsaWVkIGZ1bmN0aW9ucy4gIFRoZXJlIGFyZSB0d286CgoxLiBJdCBzZWVtcyB0aGVvcmV0 aWNhbGx5IHBvc3NpYmxlIGZvciB0aGUgb3V0cHV0cyBvZiBjbnRzaXplKCkgdG8Kb3ZlcmZsb3cg YW4gaW50LCBzbyBJIHdpZGVuZWQgdGhlbSB0byBzaXplX3QuICBUaGVyZSdzIG5vIGhhemFyZApj ZXJ0YWlubHkgaW4gdHNxdWVyeV9vciBhbmQgZnJpZW5kcywgYnV0IHRzcXVlcnlfcmV3cml0ZSBj b3VsZCBleHBhbmQKdGhlIHF1ZXJ5IHRyZWUgYnkgbGFyZ2UgbXVsdGlwbGVzIChieSByZXBsYWNp bmcgbWFueSBpZGVudGljYWwKc3VidHJlZXMgd2l0aCBhIGxhcmdlIHJlcGxhY2VtZW50IHRyZWUp LCBzbyBpbiBhIDY0LWJpdCBtYWNoaW5lCndpdGggcGxlbnR5IG9mIGF2YWlsYWJsZSBtZW1vcnkg aXQgc2hvdWxkIGJlIHBvc3NpYmxlIHRvIGJ1aWxkIGEKUVROb2RlIHRyZWUgbGFyZ2UgZW5vdWdo IHRvIGNhdXNlIHRoYXQuICBJZiB0aGVzZSBjb3VudGVycyBkaWQKb3ZlcmZsb3cgdGhlbiB3ZSdk IHVuZGVyLWFsbG9jYXRlIHRoZSBvdXRwdXQgdHNxdWVyeSBhbmQgaGF2ZSBhIGhlYXAKb3Zlcndy aXRlIHByb2JsZW0uICBzaXplX3QgaXMgc3VmZmljaWVudCwgc2luY2UgaXQncyBjb3VudGluZyB0 aGUgc2l6ZQpvZiBhIHN1YnNldCBvZiBhbiBpbi1tZW1vcnkgZGF0YSBzdHJ1Y3R1cmUuICBXZSBh bHNvIGhhdmUgdG8gZml4IHRoZQpUU1FVRVJZX1RPT19CSUcoKSBtYWNybyB0byBub3QgZ2V0IGNv bmZ1c2VkIGlmIHN1bWxlbiBleGNlZWRzCk1heEFsbG9jU2l6ZS4KCjIuIGZpbGxRVCgpIG5lZ2xl Y3RzIHRvIGNoZWNrIHRoYXQgdGhlIG5ldyAiZGlzdGFuY2UiIHZhbHVlIGZvciBhClFJX1ZBTCBp dGVtIGZpdHMgaW50byB0aGUgYXZhaWxhYmxlIDIwLWJpdCBmaWVsZC4gIEl0J3MgcXVpdGUgZWFz eQp0byByZWFjaCB0aGlzLCBmb3IgZXhhbXBsZSBieSB0c3F1ZXJ5X29yJ2luZyB0d28gbmVhci1t ZWdhYnl0ZS1zaXplZAp0c3F1ZXJ5cy4gIEhvd2V2ZXIsIHRoZSByZXN1bHQgaXMgb25seSBhIGNv cnJ1cHQgdHNxdWVyeSB0aGF0IGRvZXMKbm90IHJlcHJlc2VudCB0aGUgZXhwZWN0ZWQgcXVlcnks IHNvIHBlcmhhcHMgdGhpcyBkb2Vzbid0IHJpc2UgdG8KdGhlIGxldmVsIG9mIGEgc2VjdXJpdHkg YnVnLiAgTm9uZXRoZWxlc3MgaXQgc2hvdWxkIGJlIGZpeGVkLgoKTm90ZTogSSBmb2xsb3dlZCB0 aGUgcHJhY3RpY2UgdXNlZCBpbiBvdGhlciB0c3F1ZXJ5IGNvZGUgb2YgY2hlY2tpbmcKZWFjaCBk aXN0YW5jZSB2YWx1ZSBhcyBpdCdzIGFzc2lnbmVkLCB3aGljaCBtZWFucyB0aGF0IHRoZSBsYXN0 Cm9wZXJhbmQgc3RyaW5nIGNvdWxkIGV4dGVuZCBwYXN0IHRoZSBNQVhTVFJQT1MgYm91bmRhcnku ICBUaGlzIGlzIGEKYml0IGRpZmZlcmVudCBmcm9tIHRoZSBwYXR0ZXJuIHVzZWQgZm9yIHRzdmVj dG9ycywgd2hpY2ggaW5zaXN0IHRoYXQKdGhlIHRvdGFsIGRhdGEgbGVuZ3RoIG5vdCBleGNlZWQg TUFYU1RSUE9TIGFuZCB0aGVyZWJ5IGF2b2lkIG1ha2luZwpwZXItaXRlbSBjaGVja3MuICBQZXJo YXBzIHRoYXQgc2hvdWxkIGJlIGhhcm1vbml6ZWQgc29tZXRpbWUsIGJ1dCBmb3IKbm93IGl0J3Mg b2theSBmb3IgdGhlIHR3byB0eXBlcyB0byBkbyB0aGlzIGRpZmZlcmVudGx5IGFzIGxvbmcgYXMK ZWFjaCBvbmUgaXMgc2VsZi1jb25zaXN0ZW50LgoKQXV0aG9yOiBUb20gTGFuZSA8dGdsQHNzcy5w Z2gucGEudXM+ClJldmlld2VkLWJ5OiBBbWl0IExhbmdvdGUgPGFtaXRsYW5nb3RlMDlAZ21haWwu Y29tPgpCYWNrcGF0Y2gtdGhyb3VnaDogMTQKU2VjdXJpdHk6IENWRS0yMDI2LTE0NjYyCgpCcmFu Y2gKLS0tLS0tClJFTF8xNV9TVEFCTEUKCkRldGFpbHMKLS0tLS0tLQpodHRwczovL2dpdC5wb3N0 Z3Jlc3FsLm9yZy9wZy9jb21taXRkaWZmLzRmOGIzN2I2YmYwZjZiMDM4ZTI2ZDFkNzVjZTY0MDdl MWE1NmFhOWIKQXV0aG9yOiBUb20gTGFuZSA8dGdsQHNzcy5wZ2gucGEudXM+CgpNb2RpZmllZCBG aWxlcwotLS0tLS0tLS0tLS0tLQpzcmMvYmFja2VuZC91dGlscy9hZHQvdHNxdWVyeV91dGlsLmMg fCAxMyArKysrKysrKysrLS0tCnNyYy9pbmNsdWRlL3RzZWFyY2gvdHNfdHlwZS5oICAgICAgICB8 ICAzICsrLQoyIGZpbGVzIGNoYW5nZWQsIDEyIGluc2VydGlvbnMoKyksIDQgZGVsZXRpb25zKC0p Cgo= --===============2541683987841500770==--