diff --git a/src/backend/utils/adt/tsquery.c b/src/backend/utils/adt/tsquery.c index fd3c7a3ba1e..1be99ec1b91 100644 --- a/src/backend/utils/adt/tsquery.c +++ b/src/backend/utils/adt/tsquery.c @@ -1273,6 +1273,9 @@ tsqueryrecv(PG_FUNCTION_ARGS) if (weight > 0xF) elog(ERROR, "invalid tsquery: invalid weight bitmap"); + if (val_len == 0) + elog(ERROR, "invalid tsquery: empty operand"); + if (val_len > MAXSTRLEN) elog(ERROR, "invalid tsquery: operand too long"); @@ -1312,7 +1315,14 @@ tsqueryrecv(PG_FUNCTION_ARGS) item->qoperator.oper = oper; if (oper == OP_PHRASE) - item->qoperator.distance = (int16) pq_getmsgint(buf, sizeof(int16)); + { + unsigned int dist = pq_getmsgint(buf, sizeof(int16)); + + if (dist > MAXENTRYPOS) + elog(ERROR, "invalid tsquery: invalid phrase distance %u", + dist); + item->qoperator.distance = (int16) dist; + } } else elog(ERROR, "unrecognized tsquery node type: %d", item->type);