Fix crash of to_tsvector() function on huge input: compareWORD()

function didn't return correct result for word position greate than
limit.

Per report from Stuart Bishop <stuart@stuartbishop.net>

diff --git a/contrib/tsearch2/tsvector.c b/contrib/tsearch2/tsvector.c
index 1abf1914e3392fb056b94ed544b76b6cc2121e65..059a247f18625db2579af436a7f948fda719ea04 100644 (file)
--- a/contrib/tsearch2/tsvector.c
+++ b/contrib/tsearch2/tsvector.c
@@ -604,7 +604,12 @@ compareWORD(const void *a, const void *b)
                                                                  ((TSWORD *) b)->len);
 
                if (res == 0)
+               {
+                       if ( ((TSWORD *) a)->pos.pos == ((TSWORD *) b)->pos.pos )
+                               return 0;
+
                        return (((TSWORD *) a)->pos.pos > ((TSWORD *) b)->pos.pos) ? 1 : -1;
+               }
                return res;
        }
        return (((TSWORD *) a)->len > ((TSWORD *) b)->len) ? 1 : -1;
@@ -654,7 +659,8 @@ uniqueWORD(TSWORD * a, int4 l)
                else
                {
                        pfree(ptr->word);
-                       if (res->pos.apos[0] < MAXNUMPOS - 1 && res->pos.apos[res->pos.apos[0]] != MAXENTRYPOS - 1)
+                       if (res->pos.apos[0] < MAXNUMPOS - 1 && res->pos.apos[res->pos.apos[0]] != MAXENTRYPOS - 1 &&
+                               res->pos.apos[res->pos.apos[0]] != LIMITPOS(ptr->pos.pos) )
                        {
                                if (res->pos.apos[0] + 1 >= res->alen)
                                {