Fix crash of to_tsvector() function on huge input: compareWORD()

function didn't return correct result for word position greate than
limit.

Per report from Stuart Bishop <stuart@stuartbishop.net>

diff --git a/contrib/tsearch2/tsvector.c b/contrib/tsearch2/tsvector.c
index f3afc9f2cd1b9d074f27fc63d4682c2cdc7bd569..d823231067ae9d69b1dbc615f4d5089b7f257e32 100644 (file)
--- a/contrib/tsearch2/tsvector.c
+++ b/contrib/tsearch2/tsvector.c
@@ -580,7 +580,12 @@ compareWORD(const void *a, const void *b)
                                                                  ((WORD *) b)->len);
 
                if (res == 0)
+               {
+                       if ( ((WORD *) a)->pos.pos == ((WORD *) b)->pos.pos )
+                               return 0;
+
                        return (((WORD *) a)->pos.pos > ((WORD *) b)->pos.pos) ? 1 : -1;
+               }
                return res;
        }
        return (((WORD *) a)->len > ((WORD *) b)->len) ? 1 : -1;
@@ -630,7 +635,8 @@ uniqueWORD(WORD * a, int4 l)
                else
                {
                        pfree(ptr->word);
-                       if (res->pos.apos[0] < MAXNUMPOS - 1 && res->pos.apos[res->pos.apos[0]] != MAXENTRYPOS - 1)
+                       if (res->pos.apos[0] < MAXNUMPOS - 1 && res->pos.apos[res->pos.apos[0]] != MAXENTRYPOS - 1 &&
+                               res->pos.apos[res->pos.apos[0]] != LIMITPOS(ptr->pos.pos) )
                        {
                                if (res->pos.apos[0] + 1 >= res->alen)
                                {