Prevent buffer overrun in spell.c's CheckAffix().

This function writes into a caller-supplied buffer of length
2 * MAXNORMLEN, which should be plenty in real-world cases.
However a malicious affix file could supply an affix long
enough to overrun that.  Defend by just rejecting the match
if it would overrun the buffer.  I also inserted a check of
the input word length against Affix->replen, just to be sure
we won't index off the buffer, though it would be caller error
for that not to be true.

Also make the actual copying steps a bit more readable, and remove
an unnecessary requirement for the whole input word to fit into the
output buffer (even though it always will with the current caller).

The lack of documentation in this code makes my head hurt, so
I also reverse-engineered a basic header comment for CheckAffix.

Reported-by: Xint Code
Author: Tom Lane <tgl@sss.pgh.pa.us>
Reviewed-by: Andrey Borodin <x4mmm@yandex-team.ru>
Discussion: https://postgr.es/m/641711.1776792744@sss.pgh.pa.us
Backpatch-through: 14

diff --git a/src/backend/tsearch/spell.c b/src/backend/tsearch/spell.c
index a1bfd2a9f9b1016da9abdbe5f6f9988ac4c49094..abaa18c21c4e609aacb45b80504c76a61cb9161f 100644 (file)
--- a/src/backend/tsearch/spell.c
+++ b/src/backend/tsearch/spell.c
@@ -2065,9 +2065,32 @@ FindAffixes(AffixNode *node, const char *word, int wrdlen, int *level, int type)
        return NULL;
 }
 
+/*
+ * Checks to see if affix applies to word, transforms word if so.
+ * The transformation consists of replacing Affix->replen leading or
+ * trailing bytes with the Affix->find string.
+ *
+ * word: input word
+ * len: length of input word
+ * Affix: affix to consider
+ * flagflags: context flags showing whether we are handling a compound word
+ * newword: output buffer (MUST be of length 2 * MAXNORMLEN)
+ * baselen: input/output argument
+ *
+ * If baselen isn't NULL, then *baselen is used to return the length of
+ * the non-changed part of the word when applying a suffix, and is used
+ * to detect whether the input contained only a prefix and suffix when
+ * later applying a prefix.
+ *
+ * Returns newword on success, or NULL if the affix can't be applied.
+ * On success, the modified word is stored into newword.
+ */
 static char *
 CheckAffix(const char *word, size_t len, AFFIX *Affix, int flagflags, char *newword, int *baselen)
 {
+       size_t          keeplen,
+                               findlen;
+
        /*
         * Check compound allow flags
         */
@@ -2100,15 +2123,27 @@ CheckAffix(const char *word, size_t len, AFFIX *Affix, int flagflags, char *neww
                                return NULL;
        }
 
+       /*
+        * Protect against output buffer overrun (len < Affix->replen would be
+        * caller error, but check anyway)
+        */
+       Assert(len == strlen(word));
+       if (len < Affix->replen)
+               return NULL;
+       keeplen = len - Affix->replen;  /* how much of word we will keep */
+       findlen = strlen(Affix->find);
+       if (keeplen + findlen >= 2 * MAXNORMLEN)
+               return NULL;
+
        /*
         * make replace pattern of affix
         */
        if (Affix->type == FF_SUFFIX)
        {
-               strcpy(newword, word);
-               strcpy(newword + len - Affix->replen, Affix->find);
+               memcpy(newword, word, keeplen);
+               strcpy(newword + keeplen, Affix->find);
                if (baselen)                    /* store length of non-changed part of word */
-                       *baselen = len - Affix->replen;
+                       *baselen = keeplen;
        }
        else
        {
@@ -2116,10 +2151,10 @@ CheckAffix(const char *word, size_t len, AFFIX *Affix, int flagflags, char *neww
                 * if prefix is an all non-changed part's length then all word
                 * contains only prefix and suffix, so out
                 */
-               if (baselen && *baselen + strlen(Affix->find) <= Affix->replen)
+               if (baselen && *baselen + findlen <= Affix->replen)
                        return NULL;
-               strcpy(newword, Affix->find);
-               strcat(newword, word + Affix->replen);
+               memcpy(newword, Affix->find, findlen);
+               strcpy(newword + findlen, word + Affix->replen);
        }
 
        /*