database/sqlite
1
0
Fork 0
mirror of https://github.com/sqlite/sqlite.git synced 2025-07-27 20:41:58 +03:00
Code Activity

Fix a potential UAF in FTS3.

Browse Source 
FossilOrigin-Name: 75f3d87448793fc7fd68d817874d561842e029a2d6c1ea4abcec39764cd38469
This commit is contained in:
drh
2025-02-03 23:19:42 +00:00
parent 0d9f2a15f2
commit 51dd67080a
5 changed files with 49 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
ext/fts3/fts3_snippet.c
View File

@ -1586,6 +1586,21 @@ static int fts3ExprTermOffsetInit(Fts3Expr *pExpr, int iPhrase, void *ctx){
return rc;
}
/*
** If expression pExpr is a phrase expression that uses an MSR query,
** restart it as a regular, non-incremental query. Return SQLITE_OK
** if successful, or an SQLite error code otherwise.
*/
static int fts3ExprRestartIfCb(Fts3Expr *pExpr, int iPhrase, void *ctx){
TermOffsetCtx *p = (TermOffsetCtx*)ctx;
int rc = SQLITE_OK;
if( pExpr->pPhrase && pExpr->pPhrase->bIncr ){
rc = sqlite3Fts3MsrCancel(p->pCsr, pExpr);
pExpr->pPhrase->bIncr = 0;
}
return rc;
}
/*
** Implementation of offsets() function.
*/
@ -1622,6 +1637,12 @@ void sqlite3Fts3Offsets(
sCtx.iDocid = pCsr->iPrevId;
sCtx.pCsr = pCsr;
/* If a query restart will be required, do it here, rather than later of
** after pointers to poslist buffers that may be invalidated by a restart
** have been saved. */
rc = sqlite3Fts3ExprIterate(pCsr->pExpr, fts3ExprRestartIfCb, (void*)&sCtx);
if( rc!=SQLITE_OK ) goto offsets_out;
/* Loop through the table columns, appending offset information to
** string-buffer res for each column.
*/