Avoid leaking page references when database corruption is encountered. (CVS 5080)

FossilOrigin-Name: 270d47e8d0a20868879a95b66cb547e1e5b642d9

manifest

@@ -1,5 +1,5 @@
-C Fix\sto\stest\scode\sto\sbuild\swhen\sENABLE_IOTRACE\sis\snot\sdefined.\s(CVS\s5079)
+C Avoid\sleaking\spage\sreferences\swhen\sdatabase\scorruption\sis\sencountered.\s(CVS\s5080)
-D 2008-05-05T11:33:48
+D 2008-05-05T12:09:33
 F Makefile.arm-wince-mingw32ce-gcc ac5f7b2cef0cd850d6f755ba6ee4ab961b1fadf7
 F Makefile.in 25b3282a4ac39388632c2fb0e044ff494d490952
 F Makefile.linux-gcc d53183f4aa6a9192d249731c90dbdffbd2c68654
@@ -86,7 +86,7 @@ F src/attach.c 496cc628b2e8c4d8db99d7c136761fcbebd8420b
 F src/auth.c c8b2ab5c8bad4bd90ed7c294694f48269162c627
 F src/bitvec.c 8ec2212cfb702bc4f402c0b7ae7623d85320c714
 F src/btmutex.c 483ced3c52205b04b97df69161fadbf87f4f1ea2
-F src/btree.c 05c6bcb6d840d00f231514b253a2ed2f3987f88e
+F src/btree.c 6b16a43adb8f8c62b6344f5f364ead46b77e4cc6
 F src/btree.h 8826591bf54dd35fcf2e67473d5f1bae253861c7
 F src/btreeInt.h dc04ee33d8eb84714b2acdf81336fbbf6e764530
 F src/build.c a52d9d51341444a2131e3431608f245db80d9591
@@ -230,7 +230,7 @@ F test/collate9.test 0867eabc1222ab0bc308fc09a7fb30770334c3cd
 F test/collateA.test b8218ab90d1fa5c59dcf156efabb1b2599c580d6
 F test/colmeta.test 087c42997754b8c648819832241daf724f813322
 F test/conflict.test bb29b052c60a1f7eb6382be77902061d1f305318
-F test/corrupt.test 18c7a995b1af76a8c8600b996257f2c7b7bff083
+F test/corrupt.test af069d971853dbe12af936910bfa49d92f7b16e9
 F test/corrupt2.test 8059c7354aaba91e7405b4503b79f456c816df8e
 F test/corrupt3.test 263e8bb04e2728df832fddf6973cf54c91db0c32
 F test/corrupt4.test acdb01afaedf529004b70e55de1a6f5a05ae7fff
@@ -634,7 +634,7 @@ F www/tclsqlite.tcl 8be95ee6dba05eabcd27a9d91331c803f2ce2130
 F www/vdbe.tcl 87a31ace769f20d3627a64fa1fade7fed47b90d0
 F www/version3.tcl 890248cf7b70e60c383b0e84d77d5132b3ead42b
 F www/whentouse.tcl fc46eae081251c3c181bd79c5faef8195d7991a5
-P 3dc334aa4a394e85858d2441225d64d73664b5b5
+P 8fa2bda4c594119cbbc489b9879c52b134a57711
-R 5785867203a16836410ee4201cdc9b1c
+R 151ba0b2bb32ec7f98eb22eec73c5c65
 U danielk1977
-Z 6cf48111a8e0476a2bdecfe315c04c8b
+Z 01f35ec83f56376c6cddd2c6beaaf252

manifest.uuid

@@ -1 +1 @@
-8fa2bda4c594119cbbc489b9879c52b134a57711
+270d47e8d0a20868879a95b66cb547e1e5b642d9

src/btree.c

@@ -9,7 +9,7 @@
 **    May you share freely, never taking more than you give.
 **
 *************************************************************************
-** $Id: btree.c,v 1.453 2008/05/02 14:23:55 drh Exp $
+** $Id: btree.c,v 1.454 2008/05/05 12:09:33 danielk1977 Exp $
 **
 ** This file implements a external (disk-based) database using BTrees.
 ** See the header comment on "btreeInt.h" for additional information.
@@ -1054,6 +1054,10 @@ static int getAndInitPage(
   rc = sqlite3BtreeGetPage(pBt, pgno, ppPage, 0);
   if( rc==SQLITE_OK && (*ppPage)->isInit==0 ){
     rc = sqlite3BtreeInitPage(*ppPage, pParent);
+    if( rc!=SQLITE_OK ){
+      releasePage(*ppPage);
+      *ppPage = 0;
+    }
   }
   return rc;
 }
@@ -4091,7 +4095,8 @@ static int allocateBtreePage(
           *pPgno = iPage;
           if( *pPgno>sqlite3PagerPagecount(pBt->pPager) ){
             /* Free page off the end of the file */
-            return SQLITE_CORRUPT_BKPT;
+            rc = SQLITE_CORRUPT_BKPT;
+            goto end_allocate_page;
           }
           TRACE(("ALLOCATE: %d was leaf %d of %d on trunk %d"
                  ": %d more free pages\n",

test/corrupt.test

@@ -13,7 +13,7 @@
 # This file implements tests to make sure SQLite does not crash or
 # segfault if it sees a corrupt database file.
 #
-# $Id: corrupt.test,v 1.8 2005/02/19 08:18:06 danielk1977 Exp $
+# $Id: corrupt.test,v 1.9 2008/05/05 12:09:33 danielk1977 Exp $
 
 catch {file delete -force test.db}
 catch {file delete -force test.db-journal}
@@ -110,6 +110,15 @@ for {set i [expr {1*256}]} {$i<$fsize-256} {incr i 256} {
     catchsql {PRAGMA integrity_check}
     set x {}
   } {}
+
+  # Check that no page references were leaked.
+  do_test corrupt-2.$tn.8 {
+    set bt [btree_from_db db]
+    db_enter db
+    array set stats [btree_pager_stats $bt]
+    db_leave db
+    set stats(ref)
+  } {0}
 }  
 
 #------------------------------------------------------------------------