Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit00eb036

Browse files
committed
Fix potential memory clobber in tsvector_concat().
tsvector_concat() allocated its result workspace using the "conservative"estimate of the sum of the two input tsvectors' sizes. Unfortunately thatwasn't so conservative as all that, because it supposed that the number ofpad bytes required could not grow. Which it can, as per test case fromJesper Krogh, if there's a mix of lexemes with positions and lexemeswithout them in the input data. The fix is to assume that we might adda not-previously-present pad byte for each and every lexeme in the twoinputs; which really is conservative, but it doesn't seem worthwhile totry to be more precise.This is an aboriginal bug in tsvector_concat, so back-patch to allversions containing it.
1 parent4027181 commit00eb036

File tree

1 file changed

+30
-6
lines changed

1 file changed

+30
-6
lines changed

‎src/backend/utils/adt/tsvector_op.c

Lines changed: 30 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -341,11 +341,14 @@ tsvector_concat(PG_FUNCTION_ARGS)
341341
j,
342342
i1,
343343
i2,
344-
dataoff;
344+
dataoff,
345+
output_bytes,
346+
output_size;
345347
char*data,
346348
*data1,
347349
*data2;
348350

351+
/* Get max position in in1; we'll need this to offset in2's positions */
349352
ptr=ARRPTR(in1);
350353
i=in1->size;
351354
while (i--)
@@ -369,10 +372,23 @@ tsvector_concat(PG_FUNCTION_ARGS)
369372
data2=STRPTR(in2);
370373
i1=in1->size;
371374
i2=in2->size;
372-
/* conservative estimate of space needed */
373-
out= (TSVector)palloc0(VARSIZE(in1)+VARSIZE(in2));
374-
SET_VARSIZE(out,VARSIZE(in1)+VARSIZE(in2));
375+
376+
/*
377+
* Conservative estimate of space needed. We might need all the data
378+
* in both inputs, and conceivably add a pad byte before position data
379+
* for each item where there was none before.
380+
*/
381+
output_bytes=VARSIZE(in1)+VARSIZE(in2)+i1+i2;
382+
383+
out= (TSVector)palloc0(output_bytes);
384+
SET_VARSIZE(out,output_bytes);
385+
386+
/*
387+
* We must make out->size valid so that STRPTR(out) is sensible. We'll
388+
* collapse out any unused space at the end.
389+
*/
375390
out->size=in1->size+in2->size;
391+
376392
ptr=ARRPTR(out);
377393
data=STRPTR(out);
378394
dataoff=0;
@@ -514,10 +530,18 @@ tsvector_concat(PG_FUNCTION_ARGS)
514530
(errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED),
515531
errmsg("string is too long for tsvector (%d bytes, max %d bytes)",dataoff,MAXSTRPOS)));
516532

517-
out->size=ptr-ARRPTR(out);
518-
SET_VARSIZE(out,CALCDATASIZE(out->size,dataoff));
533+
/*
534+
* Adjust sizes (asserting that we didn't overrun the original estimates)
535+
* and collapse out any unused array entries.
536+
*/
537+
output_size=ptr-ARRPTR(out);
538+
Assert(output_size <=out->size);
539+
out->size=output_size;
519540
if (data!=STRPTR(out))
520541
memmove(STRPTR(out),data,dataoff);
542+
output_bytes=CALCDATASIZE(out->size,dataoff);
543+
Assert(output_bytes <=VARSIZE(out));
544+
SET_VARSIZE(out,output_bytes);
521545

522546
PG_FREE_IF_COPY(in1,0);
523547
PG_FREE_IF_COPY(in2,1);

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp