Fix a problem causing sqlite3_snapshot_recover() to return

SQLITE_IOERR_SHORT_READ.

FossilOrigin-Name: 525f75fa9fd4a95acc3fb3b0a01dabe2be39b383

manifest

@@ -1,5 +1,5 @@
-C Fix\sa\sbug\sin\ssqlite3_snapshot_recover()\sthat\scould\scause\ssubsequent\sread\ntransactions\sto\suse\sout-of-data\scache\sentries.
+C Fix\sa\sproblem\scausing\ssqlite3_snapshot_recover()\sto\sreturn\nSQLITE_IOERR_SHORT_READ.
-D 2016-11-19T14:53:22.181
+D 2016-11-19T16:35:53.322
 F Makefile.in 6b572807415d3f0a379cebc9461416d8df4a12c8
 F Makefile.linux-gcc 7bc79876b875010e8c8f9502eb935ca92aa3c434
 F Makefile.msc bb4d970894abbbe0e88d00aac29bd52af8bc95f4
@@ -465,7 +465,7 @@ F src/vdbesort.c 91fda3909326860382b0ca8aa251e609c6a9d62c
 F src/vdbetrace.c 41963d5376f0349842b5fc4aaaaacd7d9cdc0834
 F src/vtab.c e02cacb5c7ae742631edeb9ae9f53d399f093fd8
 F src/vxworks.h d2988f4e5a61a4dfe82c6524dd3d6e4f2ce3cdb9
-F src/wal.c df90cfbeb84788a05947da40bc821c834a29b085
+F src/wal.c 006eec60874fc502afc9e95639bbd446125cfab5
 F src/wal.h 06b2a0b599cc0f53ea97f497cf8c6b758c999f71
 F src/walker.c 91a6df7435827e41cff6bb7df50ea00934ee78b0
 F src/where.c 952f76e7a03727480b274b66ca6641b1657cd591
@@ -1104,7 +1104,7 @@ F test/skipscan5.test 67817a4b6857c47e0e33ba3e506da6f23ef68de2
 F test/skipscan6.test 5866039d03a56f5bd0b3d172a012074a1d90a15b
 F test/snapshot.test 85735bd997a4f6d710140c28fd860519a299649f
 F test/snapshot2.test aeacd61be9ad4aafdab183e9137eeca87623edad
-F test/snapshot_fault.test 062ff0438a074978d45e9f9a92e7ad459b74ee73
+F test/snapshot_fault.test 566e8a45a2ba71c67bad2077072c85ac54e9dded
 F test/soak.test 0b5b6375c9f4110c828070b826b3b4b0bb65cd5f
 F test/softheap1.test 843cd84db9891b2d01b9ab64cef3e9020f98d087
 F test/sort.test c2adc635c2564241fefec0b3a68391ef6868fd3b
@@ -1535,7 +1535,7 @@ F vsixtest/vsixtest.tcl 6a9a6ab600c25a91a7acc6293828957a386a8a93
 F vsixtest/vsixtest.vcxproj.data 2ed517e100c66dc455b492e1a33350c1b20fbcdc
 F vsixtest/vsixtest.vcxproj.filters 37e51ffedcdb064aad6ff33b6148725226cd608e
 F vsixtest/vsixtest_TemporaryKey.pfx e5b1b036facdb453873e7084e1cae9102ccc67a0
-P 174a6076a8d7bebe5efebf55f3fdc5d87c589cc7
+P 9abeb7980a34cec11a3420e14ad98a4ec0d9c599
-R d8309c01b710e62ecca9fb17e1bbb17f
+R 7b6eb1e1f049ba4c986979f464295360
 U dan
-Z 62bf95225417162d453d1041ff22e883
+Z 9f95743e0b02ecca5491496b02c4041a

manifest.uuid

@@ -1 +1 @@
-9abeb7980a34cec11a3420e14ad98a4ec0d9c599
+525f75fa9fd4a95acc3fb3b0a01dabe2be39b383

src/wal.c

@@ -2392,9 +2392,12 @@ int sqlite3WalSnapshotRecover(Wal *pWal){
     if( rc==SQLITE_OK ){
       volatile WalCkptInfo *pInfo = walCkptInfo(pWal);
       int szPage = (int)pWal->szPage;
+      i64 szDb;                   /* Size of db file in bytes */
+
+      rc = sqlite3OsFileSize(pWal->pDbFd, &szDb);
+      if( rc==SQLITE_OK ){
         void *pBuf1 = sqlite3_malloc(szPage);
         void *pBuf2 = sqlite3_malloc(szPage);
-
         if( pBuf1==0 || pBuf2==0 ){
           rc = SQLITE_NOMEM;
         }else{
@@ -2406,14 +2409,15 @@ int sqlite3WalSnapshotRecover(Wal *pWal){
             u32 pgno;                 /* Page number in db file */
             i64 iDbOff;               /* Offset of db file entry */
             i64 iWalOff;              /* Offset of wal file entry */
-          rc = walHashGet(pWal, walFramePage(i), &dummy, &aPgno, &iZero);
 
-          if( rc==SQLITE_OK ){
+            rc = walHashGet(pWal, walFramePage(i), &dummy, &aPgno, &iZero);
+            if( rc!=SQLITE_OK ) break;
             pgno = aPgno[i-iZero];
             iDbOff = (i64)(pgno-1) * szPage;
+
+            if( iDbOff+szPage<=szDb ){
               iWalOff = walFrameOffset(i, szPage) + WAL_FRAME_HDRSIZE;
               rc = sqlite3OsRead(pWal->pWalFd, pBuf1, szPage, iWalOff);
-          }
 
               if( rc==SQLITE_OK ){
                 rc = sqlite3OsRead(pWal->pDbFd, pBuf2, szPage, iDbOff);
@@ -2422,6 +2426,7 @@ int sqlite3WalSnapshotRecover(Wal *pWal){
               if( rc!=SQLITE_OK || 0==memcmp(pBuf1, pBuf2, szPage) ){
                 break;
               }
+            }
 
             pInfo->nBackfillAttempted = i-1;
           }
@@ -2429,6 +2434,7 @@ int sqlite3WalSnapshotRecover(Wal *pWal){
 
         sqlite3_free(pBuf1);
         sqlite3_free(pBuf2);
+      }
       walUnlockExclusive(pWal, WAL_CKPT_LOCK, 1);
     }
 

test/snapshot_fault.test

@@ -17,6 +17,8 @@ source $testdir/tester.tcl
 ifcapable !snapshot {finish_test; return}
 set testprefix snapshot_fault
 
+if 1 {
+
 #-------------------------------------------------------------------------
 # Check that an sqlite3_snapshot_open() client cannot be tricked into
 # reading a corrupt snapshot even if a second client fails while 
@@ -159,6 +161,35 @@ do_faultsim_test 3.0 -prep {
   sqlite3_snapshot_free $::snapshot
 }
 
+}
+
+#-------------------------------------------------------------------------
+# Test the handling of faults that occur within sqlite3_snapshot_recover().
+#
+reset_db
+do_execsql_test 4.0 {
+  PRAGMA journal_mode = wal;
+  CREATE TABLE t1(zzz);
+  INSERT INTO t1 VALUES('abc');
+  INSERT INTO t1 VALUES('def');
+} {wal}
+faultsim_save_and_close
+
+do_test 4.1 {
+  faultsim_restore_and_reopen
+  db eval { SELECT * FROM sqlite_master } 
+  sqlite3_snapshot_recover db main
+} {}
+db close
+
+do_faultsim_test 4 -faults oom* -prep {
+  faultsim_restore_and_reopen
+  db eval { SELECT * FROM sqlite_master } 
+} -body {
+  sqlite3_snapshot_recover db main
+} -test {
+  faultsim_test_result {0 {}} {1 SQLITE_NOMEM} {1 SQLITE_IOERR_NOMEM}
+}
 
 
 finish_test