database/sqlite
1
0
Fork 0
mirror of https://github.com/sqlite/sqlite.git synced 2026-10-23 21:49:02 +03:00
Code Activity

Fix an integer overflow that could lead to a buffer overrun in the zipfile extension. Bug [bugs:/info/2026-06-01T10:16:47Z | 2026-06-01T10:16:47Z].

Browse Source 
FossilOrigin-Name: 7c740d2cfd22a89258be2221860ca10985f0fc16dc7a17a99fc282d7105dc38e
This commit is contained in:
dan
2026-06-01 10:56:11 +00:00
parent 6c218ba0ad
commit 5481274912
4 changed files with 24 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
ext/misc/zipfile.c
View File

@@ -2000,10 +2000,10 @@ struct ZipfileCtx {
};
static int zipfileBufferGrow(ZipfileBuffer *pBuf, i64 nByte){
if( pBuf->n+nByte>pBuf->nAlloc ){
if( (pBuf->nAlloc-pBuf->n)<nByte ){
u8 *aNew;
sqlite3_int64 nNew = pBuf->n ? pBuf->n*2 : 512;
int nReq = pBuf->n + nByte;
i64 nNew = pBuf->n ? (i64)pBuf->n*2 : 512;
i64 nReq = pBuf->n + nByte;
while( nNew<nReq ) nNew = nNew*2;
aNew = sqlite3_realloc64(pBuf->a, nNew);

16
manifest
View File

@@ -1,5 +1,5 @@
C Extra\sdefenses\sagainst\sinteger\soverflows\sin\sthe\suntested,\sunused,\sand\nunsupported\stransliterate()\sSQL\sextension\sfunction\sfound\sin\sthe\next/misc/spellfix.c\sextension.\n[bugs:/info/2026-06-01T10:34:57Z|Bug\s2026-06-01T10:34:57Z].
D 2026-06-01T10:53:28.842
C Fix\san\sinteger\soverflow\sthat\scould\slead\sto\sa\sbuffer\soverrun\sin\sthe\szipfile\sextension.\sBug\s[bugs:/info/2026-06-01T10:16:47Z\s|\s2026-06-01T10:16:47Z].
D 2026-06-01T10:56:11.670
F .fossil-settings/binary-glob 61195414528fb3ea9693577e1980230d78a1f8b0a54c78cf1b9b24d0a409ed6a x
F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
@@ -419,7 +419,7 @@ F ext/misc/vtablog.c 6c0c11c4822ab6c1a205718ea7c6d1bb561d96b27104b9c1fe84d01aa62
F ext/misc/vtshim.c f5ab480d1e33fa46a0b138359bedc9979e32798d72348e04bbe6093f9ae95c7b
F ext/misc/wholenumber.c aa5e6d786fe8d79bc100ea0e852249c026a91ae65a5c1bcb2b869cd1a7cdd6d5
F ext/misc/windirent.h 02211ce51f3034c675f2dbf4d228194d51b3ee05734678bad5106fff6292e60c
F ext/misc/zipfile.c d865756e2eaaf4d39497affbfb295f2330516120f7598be68c03b8171638a618
F ext/misc/zipfile.c 38211d2b23e1fcb57af2d7c597458112e6c3d6130bf97dc4c224816d9f8218fa
F ext/misc/zorder.c bddff2e1b9661a90c95c2a9a9c7ecd8908afab5763256294dd12d609d4664eee
F ext/qrf/README.md 9e644615d7d7b77ef7e9db798765679e50c5ed12eda48bce21c9ef9eb4715e9d
F ext/qrf/dev-notes.md e68a6d91ce4c7eb296ef2daadc2bb79c95c317ad15b9fafe40850c67b29c2430
@@ -2109,7 +2109,7 @@ F test/writecrash.test 13520af28f376bfc8c0bcd130efc1fff20bb165198e8b94cf153f1f75
F test/zeroblob.test 7b74cefc7b281dfa2b07cd237987fbe94b4a2037a7771e9e83f2d5f608b1d99e
F test/zeroblobfault.test 861d8191a0d944dfebb3cb4d2c5b4e46a5a119eaec5a63dd996c2389f8063441
F test/zerodamage.test 9c41628db7e8d9e8a0181e59ea5f189df311a9f6ce99cc376dc461f66db6f8dc
F test/zipfile.test 0b9e26dec5ba3904d4382e9394330bd233e3fe77e6ef507e9d329ce67b71df8b
F test/zipfile.test 8e2bedf097956dff02c5bcee73876c183fe24ddb98bb74c144b83f846cdcdf33
F test/zipfile2.test 21afaffcf4f7769df38bf16e4a9c4dfa6ba1b0f5b695f844ec61fafb92db0db7
F test/zipfilefault.test 44d4d7a7f7cca7521d569d7f71026b241d65a6b1757aa409c1a168827edbbc2c
F tool/GetFile.cs 47852aa0d806fe47ed1ac5138bdce7f000fe87aaa7f28107d0cb1e26682aeb44
@@ -2207,8 +2207,8 @@ F tool/warnings-clang.sh bbf6a1e685e534c92ec2bfba5b1745f34fb6f0bc2a362850723a9ee
F tool/warnings.sh a554d13f6e5cf3760f041b87939e3d616ec6961859c3245e8ef701d1eafc2ca2
F tool/win/sqlite.vsix deb315d026cc8400325c5863eef847784a219a2f
F tool/winmain.c 00c8fb88e365c9017db14c73d3c78af62194d9644feaf60e220ab0f411f3604c
P 3c0a277e6741c72281e12c44d85902aa6780890a7f59bacc3ac2b35ba27f7211
R 3bd88975f95471549391672b1622c193
U drh
Z 4d79a37e6e6b4de0f03774c92dda2604
P 2b073519b6080abc8872b0728c64827cc088d1b43f132cd2aeb396f06de3d36f
R f791f1b1a44faf5cc9f729637c6068ee
U dan
Z cd6adb3820c6769b0caac2c0e91a3c94
# Remove this line to create a well-formed Fossil manifest.

2
manifest.uuid
View File

@@ -1 +1 @@
2b073519b6080abc8872b0728c64827cc088d1b43f132cd2aeb396f06de3d36f
7c740d2cfd22a89258be2221860ca10985f0fc16dc7a17a99fc282d7105dc38e

12
test/zipfile.test
View File

@@ -951,4 +951,16 @@ do_execsql_test 22.0 {
81560200006e65772d656e7472792e747874555405000159531c6a504b050600
000000020002006c0100008f0200000000',char(0xa,0xd,0x20)));
} {A 33188 312768000 0 {} {} 0 new-entry.txt 33188 1780241241 5 HELLO HELLO 0}
#--------------------------------------------------------------------------
reset_db
load_static_extension db zipfile
do_catchsql_test 23.0 {
SELECT length(zipfile(name,0,0,data,0)) FROM (
SELECT 'a' AS name, zeroblob(1000000000) AS data
UNION ALL SELECT 'b', zeroblob(1200000000)
);
} {1 {out of memory}}
finish_test