1
0
mirror of https://github.com/sqlite/sqlite.git synced 2025-08-08 14:02:16 +03:00

Ensure that the cell overwrite optimization does not overwrite the header

of the b-tree page.

FossilOrigin-Name: 4cc5694cbd69749c146679c367860952fdf3f5356426ddfd1dce470569702bc1
This commit is contained in:
drh
2019-08-15 13:17:49 +00:00
parent b9fc45534d
commit 27e80a3b68
4 changed files with 12 additions and 10 deletions

View File

@@ -7675,7 +7675,7 @@ static int balance_nonroot(
*/
memset(&b.szCell[b.nCell], 0, sizeof(b.szCell[0])*(limit+pOld->nOverflow));
if( pOld->nOverflow>0 ){
if( limit<pOld->aiOvfl[0] ){
if( NEVER(limit<pOld->aiOvfl[0]) ){
rc = SQLITE_CORRUPT_BKPT;
goto balance_cleanup;
}
@@ -8476,7 +8476,9 @@ static int btreeOverwriteCell(BtCursor *pCur, const BtreePayload *pX){
Pgno ovflPgno; /* Next overflow page to write */
u32 ovflPageSize; /* Size to write on overflow page */
if( pCur->info.pPayload + pCur->info.nLocal > pPage->aDataEnd ){
if( pCur->info.pPayload + pCur->info.nLocal > pPage->aDataEnd
|| pCur->info.pPayload < pPage->aData + pPage->cellOffset
){
return SQLITE_CORRUPT_BKPT;
}
/* Overwrite the local portion first */