fix hlfinditem function. Thanks to "Stphane Bidoul" .

The 'word' variable there is initialised from
the prs->words array, but immediately after,
that array may be reallocated, thus leaving
word pointing to unallocated memory.

diff --git a/contrib/tsearch2/expected/tsearch2.out b/contrib/tsearch2/expected/tsearch2.out
index 8571e59bbb124afd0ebb4fbe34259dd853c7e00c..bdcdd952cf60695f0c0caf88f5765a571f66e1f6 100644 (file)
--- a/contrib/tsearch2/expected/tsearch2.out
+++ b/contrib/tsearch2/expected/tsearch2.out
@@ -2056,11 +2056,11 @@ An hour of storm to place
 The sculpture of these granite seams,
 Upon a woman s face. E.  J.  Pratt  (1882 1964)
 ', to_tsquery('granite&sea'));
-                                           headline                                           
-----------------------------------------------------------------------------------------------
- sea an hour one night
-An hour of storm to place
-The sculpture of these granite
+                                             headline                                             
+--------------------------------------------------------------------------------------------------
+ sea a thousand years,
+A thousand years to trace
+The granite features of this cliff
 (1 row)
 
  

diff --git a/contrib/tsearch2/ts_cfg.c b/contrib/tsearch2/ts_cfg.c
index ad06d90d9abca6ec9bc035d24a50203755eca88d..1d3ca86a095aecc3504eeb0f34068eac1e91884a 100644 (file)
--- a/contrib/tsearch2/ts_cfg.c
+++ b/contrib/tsearch2/ts_cfg.c
@@ -360,7 +360,7 @@ hlfinditem(HLPRSTEXT * prs, QUERYTYPE * query, char *buf, int buflen)
 {
    int         i;
    ITEM       *item = GETQUERY(query);
-   HLWORD     *word = &(prs->words[prs->curwords - 1]);
+   HLWORD     *word;
 
    while (prs->curwords + query->size >= prs->lenwords)
    {
@@ -368,6 +368,7 @@ hlfinditem(HLPRSTEXT * prs, QUERYTYPE * query, char *buf, int buflen)
        prs->words = (HLWORD *) repalloc((void *) prs->words, prs->lenwords * sizeof(HLWORD));
    }
 
+   word = &(prs->words[prs->curwords - 1]);
    for (i = 0; i < query->size; i++)
    {
        if (item->type == VAL && item->length == buflen && strncmp(GETOPERAND(query) + item->distance, buf, buflen) == 0)