From 00830b2819d5e58174f8bda3e95bcf37590fef23 Mon Sep 17 00:00:00 2001 From: dan Date: Fri, 25 Sep 2026 14:55:16 +0000 Subject: [PATCH] Fix some cases where fts3 integrity-check was not detecting corrupt databases. Report [bugs:/info/2026-09-25T11:18:11Z | 2026-09-25T11:18:11Z]. FossilOrigin-Name: 9b23f99212f49587c5f0b025e90fdd2e844437fbb76fc11c26062df7bcff765c --- ext/fts3/fts3_write.c | 58 ++++++++++++++++++++------------------ manifest | 14 ++++----- manifest.uuid | 2 +- test/fts3corrupt7.test | 64 ++++++++++++++++++++++++++++++++++++++++++ 4 files changed, 103 insertions(+), 35 deletions(-) diff --git a/ext/fts3/fts3_write.c b/ext/fts3/fts3_write.c index 9688393c64..c37174397e 100644 --- a/ext/fts3/fts3_write.c +++ b/ext/fts3/fts3_write.c @@ -5267,38 +5267,42 @@ static u64 fts3ChecksumIndex( rc = sqlite3Fts3SegReaderStart(p, &csr, &filter); } - if( rc==SQLITE_OK ){ - while( SQLITE_ROW==(rc = sqlite3Fts3SegReaderStep(p, &csr)) ){ - char *pCsr = csr.aDoclist; - char *pEnd = &pCsr[csr.nDoclist]; + while( rc==SQLITE_OK && SQLITE_ROW==(rc = sqlite3Fts3SegReaderStep(p,&csr)) ){ + char *pCsr = csr.aDoclist; + char *pEnd = &pCsr[csr.nDoclist]; - i64 iDocid = 0; - i64 iCol = 0; - u64 iPos = 0; + i64 iDocid = 0; + int iCol = 0; + u64 iPos = 0; - pCsr += sqlite3Fts3GetVarint(pCsr, &iDocid); - while( pCsrbDescIdx ){ - iDocid = (i64)((u64)iDocid - iVal); - }else{ - iDocid = (i64)((u64)iDocid + iVal); - } - } + rc = SQLITE_OK; + pCsr += sqlite3Fts3GetVarint(pCsr, &iDocid); + while( pCsrbDescIdx ){ + iDocid = (i64)((u64)iDocid - iVal); + }else{ + iDocid = (i64)((u64)iDocid + iVal); + } + } + }else{ + iPos += (iVal - 2); + if( iPos<0 || iPos>0x7FFFFFFF ){ + rc = SQLITE_CORRUPT_VTAB; + break; }else{ - iPos += (iVal - 2); cksum = cksum ^ fts3ChecksumEntry( csr.zTerm, csr.nTerm, iLangid, iIndex, iDocid, - (int)iCol, (int)iPos + iCol, (int)iPos ); } } diff --git a/manifest b/manifest index b0ba1eb3db..928b4491e3 100644 --- a/manifest +++ b/manifest @@ -1,5 +1,5 @@ -C Avoid\sa\suse-after-free\sproblem\sin\srtree\striggered\sby\san\sattacker\smanipulating\sthe\sshadow\stable\sschema\sto\sensure\ssqlite3_last_insert_rowid()\sreturns\s0\safter\scertain\sINSERTs.\sProblem\sreported\sby\sClaude\sand\sAda\sLogics. -D 2026-09-24T20:14:31.100 +C Fix\ssome\scases\swhere\sfts3\sintegrity-check\swas\snot\sdetecting\scorrupt\sdatabases.\sReport\s[bugs:/info/2026-09-25T11:18:11Z\s|\s2026-09-25T11:18:11Z]. +D 2026-09-25T14:55:16.206 F .fossil-settings/binary-glob 61195414528fb3ea9693577e1980230d78a1f8b0a54c78cf1b9b24d0a409ed6a x F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea @@ -98,7 +98,7 @@ F ext/fts3/fts3_tokenizer.h 64c6ef6c5272c51ebe60fc607a896e84288fcbc3 F ext/fts3/fts3_tokenizer1.c c1de4ae28356ad98ccb8b2e3388a7fdcce7607b5523738c9afb6275dab765154 F ext/fts3/fts3_unicode.c de426ff05c1c2e7bce161cf6b706638419c3a1d9c2667de9cb9dc0458c18e226 F ext/fts3/fts3_unicode2.c 416eb7e1e81142703520d284b768ca2751d40e31fa912cae24ba74860532bf0f -F ext/fts3/fts3_write.c 3a78030f52747d53ef8c9bdff8ad137957834ce2ff7367db5de2b0fabdbefb5f +F ext/fts3/fts3_write.c b5d75abc73bbc56bd10df8e2fc6691fd83a0e30a301057fe49d056f4754f79aa F ext/fts3/fts3speed.tcl b54caf6a18d38174f1a6e84219950d85e98bb1e9 F ext/fts3/tool/fts3cov.sh c331d006359456cf6f8f953e37f2b9c7d568f3863f00bb5f7eb87fea4ac01b73 F ext/fts3/tool/fts3view.c 4fea96ea2c2d434acb50f30554c30de23eeed5847fe4656470e2ebe5113e4d58 @@ -1182,7 +1182,7 @@ F test/fts3corrupt3.test 0d5b69a0998b4adf868cc301fc78f3d0707745f1d984ce044c205cd F test/fts3corrupt4.test b0a69267a2a4aa76349364c9948ec5ad078562bce55675d6691563164e9ffbca F test/fts3corrupt5.test 0549f85ec4bd22e992f645f13c59b99d652f2f5e643dac75568bfd23a6db7ed5 F test/fts3corrupt6.test 9ea944e3cd17a36c64451059022fabff53bd338a43356d1f49264ce8aa9477ad -F test/fts3corrupt7.test 8564d278801a7947d1c74d8819adee7dfed18b81574d0c42f8a1acc6759fc65a +F test/fts3corrupt7.test 49a4ef171a00b7807396c7ee6e88eb11346351551ba986d8484853a80fe887b2 F test/fts3cov.test 1e5ecea0e4c1394cea97adcfb9fd3d2d5998fd563dacf465f413e6c7fa5cffb3 F test/fts3d.test 2bd8c97bcb9975f2334147173b4872505b6a41359a4f9068960a36afe07a679f F test/fts3defer.test c4526accce368e03ced78978f28607139e336aaad8d5303f307f423e994603a9 @@ -2221,8 +2221,8 @@ F tool/warnings-clang.sh bbf6a1e685e534c92ec2bfba5b1745f34fb6f0bc2a362850723a9ee F tool/warnings.sh a554d13f6e5cf3760f041b87939e3d616ec6961859c3245e8ef701d1eafc2ca2 F tool/win/sqlite.vsix deb315d026cc8400325c5863eef847784a219a2f F tool/winmain.c 00c8fb88e365c9017db14c73d3c78af62194d9644feaf60e220ab0f411f3604c -P 481a1df638aeef163022523f8de590c265f64d078eb070cf262995e8ecb0f690 -R 761b664800b760a92a7139761df5f5d2 +P 6a9e1415659f9e75940b3c3a6f6e123f61c5e9e2a7a612693ee395d7b7567bef +R 514c99232b47a7f971b312fbe04241ab U dan -Z cf822e0b49e3247c0fea18489e680ae5 +Z b4b62298ad7890c8cd5923020fd25c0e # Remove this line to create a well-formed Fossil manifest. diff --git a/manifest.uuid b/manifest.uuid index 99f8a34483..ae257cdfc5 100644 --- a/manifest.uuid +++ b/manifest.uuid @@ -1 +1 @@ -6a9e1415659f9e75940b3c3a6f6e123f61c5e9e2a7a612693ee395d7b7567bef +9b23f99212f49587c5f0b025e90fdd2e844437fbb76fc11c26062df7bcff765c diff --git a/test/fts3corrupt7.test b/test/fts3corrupt7.test index 9d350b110a..594e8adbb2 100644 --- a/test/fts3corrupt7.test +++ b/test/fts3corrupt7.test @@ -373,4 +373,68 @@ do_execsql_test 8.1 { SELECT count(*) FROM t WHERE t MATCH 'a NEAR/100 b'; } {1} +#------------------------------------------------------------------------- +reset_db +do_test 9.0 { + sqlite3 db {} + db deserialize [decode_hexdb { +| size 20480 pagesize 4096 filename poc.db +| page 1 offset 0 +| 0: 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00 SQLite format 3. +| 16: 10 00 01 01 00 40 20 20 00 00 00 03 00 00 00 05 .....@ ........ +| 32: 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 04 ................ +| 48: 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 ................ +| 80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 ................ +| 96: 00 2e 76 89 0d 0e f9 00 05 0e 15 00 0f c7 0f 66 ..v............f +| 112: 0f 01 0e 15 0e c8 00 00 00 00 00 00 00 00 00 00 ................ +| 3600: 00 00 00 00 00 81 30 04 07 17 1d 1d 01 82 33 74 ......0.......3t +| 3616: 61 62 6c 65 74 5f 73 65 67 64 69 72 74 5f 73 65 ablet_segdirt_se +| 3632: 67 64 69 72 04 43 52 45 41 54 45 20 54 41 42 4c gdir.CREATE TABL +| 3648: 45 20 27 74 5f 73 65 67 64 69 72 27 28 6c 65 76 E 't_segdir'(lev +| 3664: 65 6c 20 49 4e 54 45 47 45 52 2c 69 64 78 20 49 el INTEGER,idx I +| 3680: 4e 54 45 47 45 52 2c 73 74 61 72 74 5f 62 6c 6f NTEGER,start_blo +| 3696: 63 6b 20 49 4e 54 45 47 45 52 2c 6c 65 61 76 65 ck INTEGER,leave +| 3712: 73 5f 65 6e 64 5f 62 6c 6f 63 6b 20 49 4e 54 45 s_end_block INTE +| 3728: 47 45 52 2c 65 6e 64 5f 62 6c 6f 63 6b 20 49 4e GER,end_block IN +| 3744: 54 45 47 45 52 2c 72 6f 6f 74 20 42 4c 4f 42 2c TEGER,root BLOB, +| 3760: 50 52 49 4d 41 52 59 20 4b 45 59 28 6c 65 76 65 PRIMARY KEY(leve +| 3776: 6c 2c 20 69 64 78 29 29 2f 05 06 17 43 1d 01 00 l, idx))/...C... +| 3792: 69 6e 64 65 78 73 71 6c 69 74 65 5f 61 75 74 6f indexsqlite_auto +| 3808: 69 6e 64 65 78 5f 74 5f 73 65 67 64 69 72 5f 31 index_t_segdir_1 +| 3824: 74 5f 73 65 67 64 69 72 05 00 00 00 08 00 00 00 t_segdir........ +| 3840: 00 63 03 07 17 21 21 01 81 11 74 61 62 6c 65 74 .c...!!...tablet +| 3856: 5f 73 65 67 6d 65 6e 74 73 74 5f 73 65 67 6d 65 _segmentst_segme +| 3872: 6e 74 73 03 43 52 45 41 54 45 20 54 41 42 4c 45 nts.CREATE TABLE +| 3888: 20 27 74 5f 73 65 67 6d 65 6e 74 73 27 28 62 6c 't_segments'(bl +| 3904: 6f 63 6b 69 64 20 49 4e 54 45 47 45 52 20 50 52 ockid INTEGER PR +| 3920: 49 4d 41 52 59 20 4b 45 59 2c 20 62 6c 6f 63 6b IMARY KEY, block +| 3936: 20 42 4c 4f 42 29 5f 02 07 17 1f 1f 01 81 0d 74 BLOB)_........t +| 3952: 61 62 6c 65 74 5f 63 6f 6e 74 65 6e 74 74 5f 63 ablet_contentt_c +| 3968: 6f 6e 74 65 6e 74 02 43 52 45 41 54 45 20 54 41 ontent.CREATE TA +| 3984: 42 4c 45 20 27 74 5f 63 6f 6e 74 65 6e 74 27 28 BLE 't_content'( +| 4000: 64 6f 63 69 64 20 49 4e 54 45 47 45 52 20 50 52 docid INTEGER PR +| 4016: 49 4d 41 52 59 20 4b 45 59 2c 20 27 63 30 63 6f IMARY KEY, 'c0co +| 4032: 6e 74 65 6e 74 27 29 37 01 06 17 0f 0f 08 61 74 ntent')7......at +| 4048: 61 62 6c 65 74 74 43 52 45 41 54 45 20 56 49 52 ablettCREATE VIR +| 4064: 54 55 41 4c 20 54 41 42 4c 45 20 74 20 55 53 49 TUAL TABLE t USI +| 4080: 4e 47 20 66 74 73 33 28 63 6f 6e 74 65 6e 74 29 NG fts3(content) +| page 2 offset 4096 +| 0: 0d 00 00 00 01 0f f6 00 0f f6 00 00 00 00 00 00 ................ +| 4080: 00 00 00 00 00 00 08 01 03 00 17 68 65 6c 6c 6f ...........hello +| page 3 offset 8192 +| 0: 0d 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 ................ +| page 4 offset 12288 +| 0: 0d 00 00 00 01 0f e4 00 0f e4 00 00 00 00 00 00 ................ +| 4064: 00 00 00 00 1a 01 07 08 08 08 08 15 2a 30 20 31 ............*0 1 +| 4080: 31 00 05 68 65 6c 6c 6f 07 01 82 80 80 80 10 00 1..hello........ +| page 5 offset 16384 +| 0: 0a 00 00 00 01 0f fb 00 0f fb 00 00 00 00 00 00 ................ +| 4080: 00 00 00 00 00 00 00 00 00 00 00 04 04 08 08 09 ................ +| end poc.db +}]} {} + +do_execsql_test 9.1 { + PRAGMA integrity_check; +} {{malformed inverted index for FTS3 table main.t}} + finish_test