diff --git a/src/backend/utils/adt/tsquery_util.c b/src/backend/utils/adt/tsquery_util.c index 63760080b26..5c5e3444aab 100644 --- a/src/backend/utils/adt/tsquery_util.c +++ b/src/backend/utils/adt/tsquery_util.c @@ -289,7 +289,7 @@ QTNBinary(QTNode *in) * Caller must initialize *sumlen and *nnode to zeroes. */ static void -cntsize(QTNode *in, int *sumlen, int *nnode) +cntsize(QTNode *in, size_t *sumlen, size_t *nnode) { /* since this function recurses, it could be driven to stack overflow. */ check_stack_depth(); @@ -327,10 +327,17 @@ fillQT(QTN2QTState *state, QTNode *in) if (in->valnode->type == QI_VAL) { + size_t distance; + memcpy(state->curitem, in->valnode, sizeof(QueryOperand)); memcpy(state->curoperand, in->word, in->valnode->qoperand.length); - state->curitem->qoperand.distance = state->curoperand - state->operand; + distance = state->curoperand - state->operand; + if (distance > MAXSTRPOS) + ereport(ERROR, + (errcode(ERRCODE_PROGRAM_LIMIT_EXCEEDED), + errmsg("tsquery is too large"))); + state->curitem->qoperand.distance = distance; state->curoperand[in->valnode->qoperand.length] = '\0'; state->curoperand += in->valnode->qoperand.length + 1; state->curitem++; @@ -364,7 +371,7 @@ QTN2QT(QTNode *in) { TSQuery out; int len; - int sumlen = 0, + size_t sumlen = 0, nnode = 0; QTN2QTState state; diff --git a/src/include/tsearch/ts_type.h b/src/include/tsearch/ts_type.h index c102ff5ad4f..63029f06096 100644 --- a/src/include/tsearch/ts_type.h +++ b/src/include/tsearch/ts_type.h @@ -250,7 +250,8 @@ typedef TSQueryData *TSQuery; */ #define COMPUTESIZE(size, lenofoperand) ( HDRSIZETQ + (size) * sizeof(QueryItem) + (lenofoperand) ) #define TSQUERY_TOO_BIG(size, lenofoperand) \ - ((size) > (MaxAllocSize - HDRSIZETQ - (lenofoperand)) / sizeof(QueryItem)) + ((size_t) (lenofoperand) > MaxAllocSize - HDRSIZETQ || \ + (size) > (MaxAllocSize - HDRSIZETQ - (lenofoperand)) / sizeof(QueryItem)) /* Returns a pointer to the first QueryItem in a TSQuery */ #define GETQUERY(x) ((QueryItem*)( (char*)(x)+HDRSIZETQ ))