Message-ID: <1101e1a3afbbabb503317069c40374b82e6f4cac.camel@j-davis.com>
Subject: dict_synonym.c: fix truncation of multibyte sequence
From: Jeff Davis <pgsql@j-davis.com>
To: pgsql-hackers@postgresql.org
Date: Thu, 04 Jun 2026 15:07:25 -0700
Content-Type: multipart/mixed; boundary="=-1fwzXwdiT4l1FrpwRCpb"
User-Agent: Evolution 3.52.3-0ubuntu1.1 
MIME-Version: 1.0
Archived-At: 
 <https://www.postgresql.org/message-id/1101e1a3afbbabb503317069c40374b82e6f4cac.camel%40j-davis.com>
Precedence: bulk

--=-1fwzXwdiT4l1FrpwRCpb
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable


If case_sensitive is false and str_tolower() changes the byte length of
the string, then outlen will be incorrect.

Fortunately, pnstrdup() also stops at a NUL terminator, so it will
never overrun; but if outlen is calculated to be too small, then it
could cause truncation. In any case, the input comes from a trusted
source (dictionary configuration), so it's not very serious.

The correct value of outlen is strlen(d->syn[cur].out). But it's only
ever used in one place, which is a call to pnstrdup(). Given that the
string is NUL-terminated anyway, it's easier to fix it by just changing
that to a pstrdup(). Patch attached, backpatch all the way.

Regards,
	Jeff Davis


--=-1fwzXwdiT4l1FrpwRCpb
Content-Disposition: attachment;
	filename="v1-0001-dict_synonym.c-remove-incorrect-outlen.patch"
Content-Type: text/x-patch;
 name="v1-0001-dict_synonym.c-remove-incorrect-outlen.patch";
	charset="UTF-8"
Content-Transfer-Encoding: base64

RnJvbSBjYzM5NWZjYTY4MTAwZDhiZDM1NGVkYWIyZWU5MzI1MTI4NWM5NDNhIE1vbiBTZXAgMTcg
MDA6MDA6MDAgMjAwMQpGcm9tOiBKZWZmIERhdmlzIDxqZWZmQGotZGF2aXMuY29tPgpEYXRlOiBX
ZWQsIDE1IEFwciAyMDI2IDEyOjU2OjMxIC0wNzAwClN1YmplY3Q6IFtQQVRDSCB2MV0gZGljdF9z
eW5vbnltLmM6IHJlbW92ZSBpbmNvcnJlY3Qgb3V0bGVuLgoKUHJldmlvdXNseSwgb3V0bGVuIHdh
cyBtaXNjYWxjdWxhdGVkIGlmIGNhc2Vfc2Vuc2l0aXZlIHdhcyBmYWxzZSBhbmQKc3RyX3RvbG93
ZXIoKSBjaGFuZ2VkIHRoZSBieXRlIGxlbmd0aCBvZiB0aGUgc3RyaW5nLiBJZiBvdXRsZW4gd2Fz
IHRvbwpsYXJnZSwgcG5zdHJkdXAoKSB3b3VsZCBzdG9wIGF0IHRoZSBOVUwgdGVybWluYXRvciwg
cHJldmVudGluZwpvdmVycnVuLiBCdXQgaWYgb3V0bGVuIHdhcyB0b28gc21hbGwsIGl0IHdvdWxk
IGNhdXNlIHRydW5jYXRpb24sCnBvc3NpYmx5IGluIHRoZSBtaWRkbGUgb2YgYSBtdWx0aWJ5dGUg
c2VxdWVuY2UuCgpGaXggYnkganVzdCByZW1vdmluZyBvdXRsZW4uIEJvdGggc3RyaW5ncyBhcmUg
TlVMLXRlcm1pbmF0ZWQgYW55d2F5LgoKQmFja3BhdGNoLXRocm91Z2g6IDE0Ci0tLQogc3JjL2Jh
Y2tlbmQvdHNlYXJjaC9kaWN0X3N5bm9ueW0uYyB8IDQgKy0tLQogMSBmaWxlIGNoYW5nZWQsIDEg
aW5zZXJ0aW9uKCspLCAzIGRlbGV0aW9ucygtKQoKZGlmZiAtLWdpdCBhL3NyYy9iYWNrZW5kL3Rz
ZWFyY2gvZGljdF9zeW5vbnltLmMgYi9zcmMvYmFja2VuZC90c2VhcmNoL2RpY3Rfc3lub255bS5j
CmluZGV4IDM5MzdmMjViY2M2Li4yNDM0NTc2NzY1OCAxMDA2NDQKLS0tIGEvc3JjL2JhY2tlbmQv
dHNlYXJjaC9kaWN0X3N5bm9ueW0uYworKysgYi9zcmMvYmFja2VuZC90c2VhcmNoL2RpY3Rfc3lu
b255bS5jCkBAIC0yNCw3ICsyNCw2IEBAIHR5cGVkZWYgc3RydWN0CiB7CiAJY2hhcgkgICAqaW47
CiAJY2hhcgkgICAqb3V0OwotCWludAkJCW91dGxlbjsKIAl1aW50MTYJCWZsYWdzOwogfSBTeW47
CiAKQEAgLTE4OSw3ICsxODgsNiBAQCBkc3lub255bV9pbml0KFBHX0ZVTkNUSU9OX0FSR1MpCiAJ
CQlkLT5zeW5bY3VyXS5vdXQgPSBzdHJfdG9sb3dlcihzdGFydG8sIHN0cmxlbihzdGFydG8pLCBE
RUZBVUxUX0NPTExBVElPTl9PSUQpOwogCQl9CiAKLQkJZC0+c3luW2N1cl0ub3V0bGVuID0gc3Ry
bGVuKHN0YXJ0byk7CiAJCWQtPnN5bltjdXJdLmZsYWdzID0gZmxhZ3M7CiAKIAkJY3VyKys7CkBA
IC0yMzcsNyArMjM1LDcgQEAgZHN5bm9ueW1fbGV4aXplKFBHX0ZVTkNUSU9OX0FSR1MpCiAJCVBH
X1JFVFVSTl9QT0lOVEVSKE5VTEwpOwogCiAJcmVzID0gcGFsbG9jMF9hcnJheShUU0xleGVtZSwg
Mik7Ci0JcmVzWzBdLmxleGVtZSA9IHBuc3RyZHVwKGZvdW5kLT5vdXQsIGZvdW5kLT5vdXRsZW4p
OworCXJlc1swXS5sZXhlbWUgPSBwc3RyZHVwKGZvdW5kLT5vdXQpOwogCXJlc1swXS5mbGFncyA9
IGZvdW5kLT5mbGFnczsKIAogCVBHX1JFVFVSTl9QT0lOVEVSKHJlcyk7Ci0tIAoyLjQzLjAKCg==


--=-1fwzXwdiT4l1FrpwRCpb--