From: Teodor Sigaev <teodor@sigaev.ru>
Date: Wed, 26 Sep 2007 10:17:34 +0000 (+0000)
Subject: Fix crash of to_tsvector() function on huge input: compareWORD()
X-Git-Tag: REL8_2_6~48
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=d77a9018faffc2eed3f163de0b55e96064eaa25f;p=postgresql

Fix crash of to_tsvector() function on huge input: compareWORD()
function didn't return correct result for word position greate than
limit.

Per report from Stuart Bishop <stuart@stuartbishop.net>
---

diff --git a/contrib/tsearch2/tsvector.c b/contrib/tsearch2/tsvector.c
index 1abf1914e3..059a247f18 100644
--- a/contrib/tsearch2/tsvector.c
+++ b/contrib/tsearch2/tsvector.c
@@ -604,7 +604,12 @@ compareWORD(const void *a, const void *b)
 								  ((TSWORD *) b)->len);
 
 		if (res == 0)
+		{
+			if ( ((TSWORD *) a)->pos.pos == ((TSWORD *) b)->pos.pos )
+				return 0;
+
 			return (((TSWORD *) a)->pos.pos > ((TSWORD *) b)->pos.pos) ? 1 : -1;
+		}
 		return res;
 	}
 	return (((TSWORD *) a)->len > ((TSWORD *) b)->len) ? 1 : -1;
@@ -654,7 +659,8 @@ uniqueWORD(TSWORD * a, int4 l)
 		else
 		{
 			pfree(ptr->word);
-			if (res->pos.apos[0] < MAXNUMPOS - 1 && res->pos.apos[res->pos.apos[0]] != MAXENTRYPOS - 1)
+			if (res->pos.apos[0] < MAXNUMPOS - 1 && res->pos.apos[res->pos.apos[0]] != MAXENTRYPOS - 1 &&
+				res->pos.apos[res->pos.apos[0]] != LIMITPOS(ptr->pos.pos) )
 			{
 				if (res->pos.apos[0] + 1 >= res->alen)
 				{