mirror of
https://github.com/sqlite/sqlite.git
synced 2025-08-05 15:55:57 +03:00
Add more corruption checking to the cell overwrite logic.
FossilOrigin-Name: 58d14afe1e1288d114ea213458b3121e0a95670887861928858b7f143c76f789
This commit is contained in:
@@ -8201,6 +8201,9 @@ static int btreeOverwriteCell(BtCursor *pCur, const BtreePayload *pX){
|
||||
Pgno ovflPgno; /* Next overflow page to write */
|
||||
u32 ovflPageSize; /* Size to write on overflow page */
|
||||
|
||||
if( pCur->info.pPayload + pCur->info.nLocal > pPage->aDataEnd ){
|
||||
return SQLITE_CORRUPT_BKPT;
|
||||
}
|
||||
/* Overwrite the local portion first */
|
||||
rc = btreeOverwriteContent(pPage, pCur->info.pPayload, pX,
|
||||
0, pCur->info.nLocal);
|
||||
@@ -8215,6 +8218,9 @@ static int btreeOverwriteCell(BtCursor *pCur, const BtreePayload *pX){
|
||||
do{
|
||||
rc = btreeGetPage(pBt, ovflPgno, &pPage, 0);
|
||||
if( rc ) return rc;
|
||||
if( sqlite3PagerPageRefcount(pPage->pDbPage)!=1 ){
|
||||
return SQLITE_CORRUPT_BKPT;
|
||||
}
|
||||
if( iOffset+ovflPageSize<nTotal ){
|
||||
ovflPgno = get4byte(pPage->aData);
|
||||
}else{
|
||||
|
Reference in New Issue
Block a user