public inbox for [email protected]  

help / color / mirror / Atom feed

From: Коротков Максим <[email protected]>
To: [email protected]
Subject: [PATCH] snowball: fix potential NULL dereference
Date: Tue, 11 Feb 2025 11:52:29 +0300
Message-ID: <1d1a46-67ab1000-21-80c451@83151435> (raw)

Hi all,
I found the case of potential NULL pointer dereference.
In snowball/libstemmer/api.c if we transfer control to the SN_create_env() function
by using the error label when there is a memory allocation error of z->p or z->S,
we can then dereference the NULL pointer z->S in the function SN_close_env().
Added the pointer check for avoiding a potential problem.
---
Best regards, Korotkov Maksim
PostgresPro
[email protected]


Attachments:

  [text/x-patch] 0001-snowball-fix-potential-NULL-dereference.patch (1.3K, ../1d1a46-67ab1000-21-80c451@83151435/2-0001-snowball-fix-potential-NULL-dereference.patch)
  download | inline diff:
From c4596f6e23c4f5e9ae8294d51783afb733eccc9d Mon Sep 17 00:00:00 2001
From: Maksim Korotkov <[email protected]>
Date: Tue, 24 Dec 2024 17:07:12 +0300
Subject: [PATCH] snowball: fix potential NULL dereference

If we transfer control to the SN_create_env() function by using the error
label when there is a memory allocation error of z->p or z->S,
we can then dereference the NULL pointer z->S in the function SN_close_env().
Added the pointer check for avoiding potential problem.

Fixes: 140d4ebcb4 ("Tsearch2 functionality migrates to core.  The bulk of this work is by Oleg Bartunov and Teodor Sigaev, but I did a lot of editorializing, so anything that's broken is probably my fault.")

Found by Postgres Pro with Svace static analyzer
Signed-off-by: Maksim Korotkov <[email protected]>
---
 src/backend/snowball/libstemmer/api.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/backend/snowball/libstemmer/api.c b/src/backend/snowball/libstemmer/api.c
index 375938e6d1..3a7169abd8 100644
--- a/src/backend/snowball/libstemmer/api.c
+++ b/src/backend/snowball/libstemmer/api.c
@@ -34,7 +34,7 @@ error:
 extern void SN_close_env(struct SN_env * z, int S_size)
 {
     if (z == NULL) return;
-    if (S_size)
+    if (S_size && z->S)
     {
         int i;
         for (i = 0; i < S_size; i++)
-- 
2.34.1

view thread (4+ messages)  latest in thread

reply

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: [email protected]
  Cc: [email protected]
  Subject: Re: [PATCH] snowball: fix potential NULL dereference
  In-Reply-To: <1d1a46-67ab1000-21-80c451@83151435>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox