Fix bug in to_tsquery().

hlinnaka · hlinnaka · commit d2495f272cd1 · 2012-05-15T19:27:34.000+03:00
We were using memcpy() to copy to a possibly overlapping memory region,
which is a no-no. Use memmove() instead.
diff --git a/src/backend/tsearch/to_tsany.c b/src/backend/tsearch/to_tsany.c
@@ -340,6 +340,7 @@ to_tsquery_byid(PG_FUNCTION_ARGS)
 	if (query->size == 0)
 		PG_RETURN_TSQUERY(query);
 
+	/* clean out any stopword placeholders from the tree */
 	res = clean_fakeval(GETQUERY(query), &len);
 	if (!res)
 	{
@@ -349,6 +350,10 @@ to_tsquery_byid(PG_FUNCTION_ARGS)
 	}
 	memcpy((void *) GETQUERY(query), (void *) res, len * sizeof(QueryItem));
 
+	/*
+	 * Removing the stopword placeholders might've resulted in fewer
+	 * QueryItems. If so, move the operands up accordingly.
+	 */
 	if (len != query->size)
 	{
 		char	   *oldoperand = GETOPERAND(query);
@@ -357,7 +362,7 @@ to_tsquery_byid(PG_FUNCTION_ARGS)
 		Assert(len < query->size);
 
 		query->size = len;
-		memcpy((void *) GETOPERAND(query), oldoperand, VARSIZE(query) - (oldoperand - (char *) query));
+		memmove((void *) GETOPERAND(query), oldoperand, VARSIZE(query) - (oldoperand - (char *) query));
 		SET_VARSIZE(query, COMPUTESIZE(len, lenoperand));
 	}
 

Original file line number	Diff line number	Diff line change
`@@ -340,6 +340,7 @@ to_tsquery_byid(PG_FUNCTION_ARGS)`
`340`	`340`	`if (query->size == 0)`
`341`	`341`	`PG_RETURN_TSQUERY(query);`
`342`	`342`
	`343`	`+ /* clean out any stopword placeholders from the tree */`
`343`	`344`	`res = clean_fakeval(GETQUERY(query), &len);`
`344`	`345`	`if (!res)`
`345`	`346`	`{`
`@@ -349,6 +350,10 @@ to_tsquery_byid(PG_FUNCTION_ARGS)`
`349`	`350`	`}`
`350`	`351`	`memcpy((void ) GETQUERY(query), (void ) res, len * sizeof(QueryItem));`
`351`	`352`
	`353`	`+ /*`
	`354`	`+ * Removing the stopword placeholders might've resulted in fewer`
	`355`	`+ * QueryItems. If so, move the operands up accordingly.`
	`356`	`+ */`
`352`	`357`	`if (len != query->size)`
`353`	`358`	`{`
`354`	`359`	`char *oldoperand = GETOPERAND(query);`
`@@ -357,7 +362,7 @@ to_tsquery_byid(PG_FUNCTION_ARGS)`
`357`	`362`	`Assert(len < query->size);`
`358`	`363`
`359`	`364`	`query->size = len;`
`360`		`- memcpy((void ) GETOPERAND(query), oldoperand, VARSIZE(query) - (oldoperand - (char ) query));`
	`365`	`+ memmove((void ) GETOPERAND(query), oldoperand, VARSIZE(query) - (oldoperand - (char ) query));`
`361`	`366`	`SET_VARSIZE(query, COMPUTESIZE(len, lenoperand));`
`362`	`367`	`}`
`363`	`368`