pgsql: Defend against stack overrun in a few more places.

From: Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us>
To: pgsql-committers(at)lists(dot)postgresql(dot)org
Subject: pgsql: Defend against stack overrun in a few more places.
Date: 2022-08-24 17:02:43
Message-ID: E1oQtm6-0011Jm-3R@gemulon.postgresql.org
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-committers

Defend against stack overrun in a few more places.

SplitToVariants() in the ispell code, lseg_inside_poly() in geo_ops.c,
and regex_selectivity_sub() in selectivity estimation could recurse
until stack overflow; fix by adding check_stack_depth() calls.
So could next() in the regex compiler, but that case is better fixed by
converting its tail recursion to a loop. (We probably get better code
that way too, since next() can now be inlined into its sole caller.)

There remains a reachable stack overrun in the Turkish stemmer, but
we'll need some advice from the Snowball people about how to fix that.

Per report from Egor Chindyaskin and Alexander Lakhin. These mistakes
are old, so back-patch to all supported branches.

Richard Guo and Tom Lane

Discussion: https://postgr.es/m/1661334672.728714027@f473.i.mail.ru

Branch
------
REL_13_STABLE

Details
-------
https://git.postgresql.org/pg/commitdiff/2d1f1523ce830bd59c10cf144993fdd0bba50478

Modified Files
--------------
src/backend/regex/regc_lex.c | 5 +++--
src/backend/tsearch/spell.c | 4 ++++
src/backend/utils/adt/geo_ops.c | 3 +++
src/backend/utils/adt/like_support.c | 4 ++++
4 files changed, 14 insertions(+), 2 deletions(-)

Browse pgsql-committers by date

  From Date Subject
Next Message Peter Eisentraut 2022-08-24 18:27:00 pgsql: pg_dump: Dump colliculocale
Previous Message David Rowley 2022-08-24 11:47:04 pgsql: Doc: remove duplicate "a" from func.sgml