From 05556bdf938db0f4b87f3852cd5802fb71a13263 Mon Sep 17 00:00:00 2001 From: Tom Lane Date: Mon, 17 Aug 2026 18:09:07 -0400 Subject: Tighten up tsqueryrecv(). tsqueryrecv() accepted zero-length lexemes, which tsqueryin() doesn't. It also accepted phrase distance values larger than MAXENTRYPOS, which tsqueryin() doesn't. While neither of these omissions are very harmful in themselves, they do allow accepting tsquery values that will fail in a subsequent textual dump/reload. Commit 23d9ad771 performed similar tightening of tsvectorrecv(), but I left off these changes at the time because they didn't seem to have security implications. Reported-by: Claude Code (via Noah Misch) Author: Tom Lane Reviewed-by: Chao Li Discussion: https://postgr.es/m/455079.1786897319@sss.pgh.pa.us Backpatch-through: 14 --- src/backend/utils/adt/tsquery.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/src/backend/utils/adt/tsquery.c b/src/backend/utils/adt/tsquery.c index 89d95086e82..fd7a35cf54a 100644 --- a/src/backend/utils/adt/tsquery.c +++ b/src/backend/utils/adt/tsquery.c @@ -1220,6 +1220,9 @@ tsqueryrecv(PG_FUNCTION_ARGS) if (weight > 0xF) elog(ERROR, "invalid tsquery: invalid weight bitmap"); + if (val_len == 0) + elog(ERROR, "invalid tsquery: empty operand"); + if (val_len > MAXSTRLEN) elog(ERROR, "invalid tsquery: operand too long"); @@ -1259,7 +1262,14 @@ tsqueryrecv(PG_FUNCTION_ARGS) item->qoperator.oper = oper; if (oper == OP_PHRASE) - item->qoperator.distance = (int16) pq_getmsgint(buf, sizeof(int16)); + { + unsigned int dist = pq_getmsgint(buf, sizeof(int16)); + + if (dist > MAXENTRYPOS) + elog(ERROR, "invalid tsquery: invalid phrase distance %u", + dist); + item->qoperator.distance = (int16) dist; + } } else elog(ERROR, "unrecognized tsquery node type: %d", item->type); -- cgit v1.2.3