database/sqlite
1
0
Fork 0
mirror of https://github.com/sqlite/sqlite.git synced 2025-08-01 06:27:03 +03:00
Code Activity

Fix a buffer overread in the sessions extension that could occur when processing a corrupt changeset.

Browse Source 
FossilOrigin-Name: 0e4e7a05c4204b47a324d67e18e76d2a98e26b2723d19d5c655ec9fd2e41f4b7
This commit is contained in:
dan
2023-09-07 13:53:09 +00:00
parent 0a4c31d87b
commit 09f1652f36
4 changed files with 24 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
ext/session/sqlite3session.c
View File

@ -3236,15 +3236,19 @@ static int sessionReadRecord(
}
}
if( eType==SQLITE_INTEGER || eType==SQLITE_FLOAT ){
sqlite3_int64 v = sessionGetI64(aVal);
if( eType==SQLITE_INTEGER ){
sqlite3VdbeMemSetInt64(apOut[i], v);
if( (pIn->nData-pIn->iNext)<8 ){
rc = SQLITE_CORRUPT_BKPT;
}else{
double d;
memcpy(&d, &v, 8);
sqlite3VdbeMemSetDouble(apOut[i], d);
sqlite3_int64 v = sessionGetI64(aVal);
if( eType==SQLITE_INTEGER ){
sqlite3VdbeMemSetInt64(apOut[i], v);
}else{
double d;
memcpy(&d, &v, 8);
sqlite3VdbeMemSetDouble(apOut[i], d);
}
pIn->iNext += 8;
}
pIn->iNext += 8;
}
}
}