mirror of
https://github.com/sqlite/sqlite.git
synced 2026-10-23 21:49:02 +03:00
Fix some problems with handling corrupt meta-value arrays in vec1.
FossilOrigin-Name: fa41e6201609f40ce9d6ec28693e4cd143363a78f072476586f6de7fd90aed66
This commit is contained in:
dan
@@ -45,13 +45,450 @@ do_execsql_test 1.3 {
|
||||
|
||||
#-------------------------------------------------------------------------
|
||||
|
||||
reset_db
|
||||
|
||||
do_test 2.0 {
|
||||
sqlite3 db {}
|
||||
db deserialize [decode_hexdb {
|
||||
| size 28672 pagesize 4096 filename poc_oob_read.db
|
||||
| page 1 offset 0
|
||||
| 0: 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00 SQLite format 3.
|
||||
| 16: 10 00 01 01 00 40 20 20 00 00 00 17 00 00 00 07 .....@ ........
|
||||
| 32: 00 00 00 00 00 00 00 00 00 00 00 07 00 00 00 04 ................
|
||||
| 48: 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 ................
|
||||
| 80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 17 ................
|
||||
| 96: 00 2e 99 b0 0d 00 00 00 07 0d a6 00 0f ca 0f 74 ...............t
|
||||
| 112: 0f 1b 0e 9f 0e 4b 0d f7 0d a6 00 00 00 00 00 00 .....K..........
|
||||
| 3488: 00 00 00 00 00 00 4f 07 06 17 19 19 01 7b 74 61 ......O.......ta
|
||||
| 3504: 62 6c 65 74 5f 6d 65 74 61 74 5f 6d 65 74 61 07 blet_metat_meta.
|
||||
| 3520: 43 52 45 41 54 45 20 54 41 42 4c 45 20 27 74 5f CREATE TABLE 't_
|
||||
| 3536: 6d 65 74 61 27 28 69 64 20 49 4e 54 45 47 45 52 meta'(id INTEGER
|
||||
| 3552: 20 50 52 49 4d 41 52 59 20 4b 45 59 2c 20 76 61 PRIMARY KEY, va
|
||||
| 3568: 6c 20 42 4c 4f 42 29 52 06 06 17 1b 1b 01 7d 74 l BLOB)R.......t
|
||||
| 3584: 61 62 6c 65 74 5f 6d 6f 64 65 6c 74 5f 6d 6f 64 ablet_modelt_mod
|
||||
| 3600: 65 6c 06 43 52 45 41 54 45 20 54 41 42 4c 45 20 el.CREATE TABLE
|
||||
| 3616: 27 74 5f 6d 6f 64 65 6c 27 28 69 64 20 49 4e 54 't_model'(id INT
|
||||
| 3632: 45 47 45 52 20 50 52 49 4d 41 52 59 20 4b 45 59 EGER PRIMARY KEY
|
||||
| 3648: 2c 20 76 61 6c 20 42 4c 4f 42 29 52 05 06 17 1f , val BLOB)R....
|
||||
| 3664: 17 01 7d 69 6e 64 65 78 74 5f 69 64 78 5f 69 64 ...indext_idx_id
|
||||
| 3680: 78 74 5f 69 64 78 05 43 52 45 41 54 45 20 49 4e xt_idx.CREATE IN
|
||||
| 3696: 44 45 58 20 27 74 5f 69 64 78 5f 69 64 78 27 20 DEX 't_idx_idx'
|
||||
| 3712: 4f 4e 20 27 74 5f 69 64 78 27 28 62 75 63 6b 65 ON 't_idx'(bucke
|
||||
| 3728: 74 2c 20 66 69 72 73 74 2c 20 6c 61 73 74 29 7a t, first, last)z
|
||||
| 3744: 04 07 17 17 17 01 81 53 74 61 62 6c 65 74 5f 69 .......Stablet_i
|
||||
| 3760: 64 78 74 5f 69 64 78 04 43 52 45 41 54 45 20 54 dxt_idx.CREATE T
|
||||
| 3776: 41 42 4c 45 20 27 74 5f 69 64 78 27 28 69 64 20 ABLE 't_idx'(id
|
||||
| 3792: 49 4e 54 45 47 45 52 20 50 52 49 4d 41 52 59 20 INTEGER PRIMARY
|
||||
| 3808: 4b 45 59 2c 20 62 75 63 6b 65 74 20 49 4e 54 45 KEY, bucket INTE
|
||||
| 3824: 47 45 52 2c 20 66 69 72 73 74 20 49 4e 54 45 47 GER, first INTEG
|
||||
| 3840: 45 52 2c 20 6c 61 73 74 20 49 4e 54 45 47 45 52 ER, last INTEGER
|
||||
| 3856: 2c 20 76 61 6c 20 42 4c 4f 42 29 57 03 07 17 19 , val BLOB)W....
|
||||
| 3872: 19 01 81 09 74 61 62 6c 65 74 5f 62 61 73 65 74 ....tablet_baset
|
||||
| 3888: 5f 62 61 73 65 03 43 52 45 41 54 45 20 54 41 42 _base.CREATE TAB
|
||||
| 3904: 4c 45 20 27 74 5f 62 61 73 65 27 28 69 64 20 49 LE 't_base'(id I
|
||||
| 3920: 4e 54 45 47 45 52 20 50 52 49 4d 41 52 59 20 4b NTEGER PRIMARY K
|
||||
| 3936: 45 59 2c 20 76 65 63 74 6f 72 20 42 4c 4f 42 2c EY, vector BLOB,
|
||||
| 3952: 20 63 30 29 54 02 06 17 1d 1d 01 7d 74 61 62 6c c0)T.......tabl
|
||||
| 3968: 65 74 5f 63 6f 6e 66 69 67 74 5f 63 6f 6e 66 69 et_configt_confi
|
||||
| 3984: 67 02 43 52 45 41 54 45 20 54 41 42 4c 45 20 27 g.CREATE TABLE '
|
||||
| 4000: 74 5f 63 6f 6e 66 69 67 27 28 69 64 20 49 4e 54 t_config'(id INT
|
||||
| 4016: 45 47 45 52 20 50 52 49 4d 41 52 59 20 4b 45 59 EGER PRIMARY KEY
|
||||
| 4032: 2c 20 76 61 6c 20 41 4e 59 29 34 01 06 17 0f 0f , val ANY)4.....
|
||||
| 4048: 08 5b 74 61 62 6c 65 74 74 43 52 45 41 54 45 20 .[tablettCREATE
|
||||
| 4064: 56 49 52 54 55 41 4c 20 54 41 42 4c 45 20 74 20 VIRTUAL TABLE t
|
||||
| 4080: 55 53 49 4e 47 20 76 65 63 31 28 76 2c 20 6d 29 USING vec1(v, m)
|
||||
| page 2 offset 4096
|
||||
| 0: 0d 00 00 00 03 0f ef 00 0f f5 0f ef 0f fa 00 00 ................
|
||||
| 4064: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 ................
|
||||
| 4080: 02 03 00 01 04 03 00 03 00 09 04 05 03 00 01 04 ................
|
||||
| page 3 offset 8192
|
||||
| 0: 0d 00 00 00 14 0e e8 00 0f f2 0f e4 0f d6 0f c8 ................
|
||||
| 16: 0f ba 0f ac 0f 9e 0f 90 0f 82 0f 74 0f 66 0f 58 ...........t.f.X
|
||||
| 32: 0f 4a 0f 3c 0f 2e 0f 20 0f 12 0f 04 0e f6 0e e8 .J.<... ........
|
||||
| 3808: 00 00 00 00 00 00 00 00 0c 14 04 00 08 07 40 69 ..............@i
|
||||
| 3824: 00 00 00 00 00 00 0c 13 04 00 08 07 40 67 c0 00 ............@g..
|
||||
| 3840: 00 00 00 00 0c 12 04 00 08 07 40 66 80 00 00 00 ..........@f....
|
||||
| 3856: 00 00 0c 11 04 00 08 07 40 65 40 00 00 00 00 00 ........@e@.....
|
||||
| 3872: 0c 10 04 00 08 07 40 64 00 00 00 00 00 00 0c 0f ......@d........
|
||||
| 3888: 04 00 08 07 40 62 c0 00 00 00 00 00 0c 0e 04 00 ....@b..........
|
||||
| 3904: 08 07 40 61 80 00 00 00 00 00 0c 0d 04 00 08 07 ..@a............
|
||||
| 3920: 40 60 40 00 00 00 00 00 0c 0c 04 00 08 07 40 5e @`@...........@^
|
||||
| 3936: 00 00 00 00 00 00 0c 0b 04 00 08 07 40 5b 80 00 ............@[..
|
||||
| 3952: 00 00 00 00 0c 0a 04 00 08 07 40 59 00 00 00 00 ..........@Y....
|
||||
| 3968: 00 00 0c 09 04 00 08 07 40 56 80 00 00 00 00 00 ........@V......
|
||||
| 3984: 0c 08 04 00 08 07 40 54 00 00 00 00 00 00 0c 07 ......@T........
|
||||
| 4000: 04 00 08 07 40 51 80 00 00 00 00 00 0c 06 04 00 ....@Q..........
|
||||
| 4016: 08 07 40 4e 00 00 00 00 00 00 0c 05 04 00 08 07 ..@N............
|
||||
| 4032: 40 49 00 00 00 00 00 00 0c 04 04 00 08 07 40 44 @I............@D
|
||||
| 4048: 00 00 00 00 00 00 0c 03 04 00 08 07 40 3e 00 00 ............@>..
|
||||
| 4064: 00 00 00 00 0c 02 04 00 08 07 40 34 00 00 00 00 ..........@4....
|
||||
| 4080: 00 00 0c 01 04 00 08 07 40 24 00 00 00 00 00 00 ........@$......
|
||||
| page 4 offset 12288
|
||||
| 0: 0d 00 00 00 01 0e 59 00 0e 59 00 00 00 00 00 00 ......Y..Y......
|
||||
| 3664: 00 00 00 00 00 00 00 00 00 83 24 01 07 00 08 09 ..........$.....
|
||||
| 3680: 01 86 44 14 00 00 00 02 00 00 00 14 00 00 00 00 ..D.............
|
||||
| 3696: 00 00 00 01 00 00 00 02 00 00 00 03 00 00 00 04 ................
|
||||
| 3712: 00 00 00 05 00 00 00 06 00 00 00 07 00 00 00 08 ................
|
||||
| 3728: 00 00 00 09 00 00 00 0a 00 00 00 0b 00 00 00 0c ................
|
||||
| 3744: 00 00 00 0d 00 00 00 0e 00 00 00 0f 00 00 00 10 ................
|
||||
| 3760: 00 00 00 11 00 00 00 12 00 00 00 13 00 00 00 14 ................
|
||||
| 3776: 00 00 80 3f 00 00 00 40 00 00 40 40 00 00 80 40 ...?...@..@@...@
|
||||
| 3792: 00 00 00 40 00 00 40 40 00 00 80 40 00 00 a0 40 ...@..@@...@...@
|
||||
| 3808: 00 00 40 40 00 00 80 40 00 00 a0 40 00 00 c0 40 ..@@...@...@...@
|
||||
| 3824: 00 00 80 40 00 00 a0 40 00 00 c0 40 00 00 e0 40 ...@...@...@...@
|
||||
| 3840: 00 00 a0 40 00 00 c0 40 00 00 e0 40 00 00 00 41 ...@...@...@...A
|
||||
| 3856: 00 00 c0 40 00 00 e0 40 00 00 00 41 00 00 10 41 ...@...@...A...A
|
||||
| 3872: 00 00 e0 40 00 00 00 41 00 00 10 41 00 00 20 41 ...@...A...A.. A
|
||||
| 3888: 00 00 00 41 00 00 10 41 00 00 20 41 00 00 30 41 ...A...A.. A..0A
|
||||
| 3904: 00 00 10 41 00 00 20 41 00 00 30 41 00 00 40 41 ...A.. A..0A..@A
|
||||
| 3920: 00 00 20 41 00 00 30 41 00 00 40 41 00 00 50 41 .. A..0A..@A..PA
|
||||
| 3936: 00 00 30 41 00 00 40 41 00 00 50 41 00 00 60 41 ..0A..@A..PA..`A
|
||||
| 3952: 00 00 40 41 00 00 50 41 00 00 60 41 00 00 70 41 ..@A..PA..`A..pA
|
||||
| 3968: 00 00 50 41 00 00 60 41 00 00 70 41 00 00 80 41 ..PA..`A..pA...A
|
||||
| 3984: 00 00 60 41 00 00 70 41 00 00 80 41 00 00 88 41 ..`A..pA...A...A
|
||||
| 4000: 00 00 70 41 00 00 80 41 00 00 88 41 00 00 90 41 ..pA...A...A...A
|
||||
| 4016: 00 00 80 41 00 00 88 41 00 00 90 41 00 00 98 41 ...A...A...A...A
|
||||
| 4032: 00 00 88 41 00 00 90 41 00 00 98 41 00 00 a0 41 ...A...A...A...A
|
||||
| 4048: 00 00 90 41 00 00 98 41 00 00 a0 41 00 00 a8 41 ...A...A...A...A
|
||||
| 4064: 00 00 98 41 00 00 a0 41 00 00 a8 41 00 00 b0 41 ...A...A...A...A
|
||||
| 4080: 00 00 a0 41 00 00 a8 41 00 00 b0 41 00 00 b8 41 ...A...A...A...A
|
||||
| page 5 offset 16384
|
||||
| 0: 0a 00 00 00 01 0f f9 00 0f f9 00 00 00 00 00 00 ................
|
||||
| 4080: 00 00 00 00 00 00 00 00 00 06 05 08 09 01 09 14 ................
|
||||
| page 6 offset 20480
|
||||
| 0: 0d 00 00 00 01 0f e3 00 0f e3 00 00 00 00 00 00 ................
|
||||
| 4064: 00 00 00 1b 01 03 00 3c 00 00 00 04 00 00 00 01 .......<........
|
||||
| 4080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 ................
|
||||
| page 7 offset 24576
|
||||
| 0: 0d 00 00 00 01 0f f2 00 0f f2 00 00 00 00 00 00 ................
|
||||
| 3920: 81 2c 82 00 04 00 82 5c 00 00 00 08 00 00 00 14 .,..............
|
||||
| 3936: 40 24 00 00 00 00 00 00 40 34 00 00 00 00 00 00 @$......@4......
|
||||
| 3952: 40 3e 00 00 00 00 00 00 40 44 00 00 00 00 00 00 @>......@D......
|
||||
| 3968: 40 49 00 00 00 00 00 00 40 4e 00 00 00 00 00 00 @I......@N......
|
||||
| 3984: 40 51 80 00 00 00 00 00 40 54 00 00 00 00 00 00 @Q......@T......
|
||||
| 4000: 40 56 80 00 00 00 00 00 40 59 00 00 00 00 00 00 @V......@Y......
|
||||
| 4016: 40 5b 80 00 00 00 00 00 40 5e 00 00 00 00 00 00 @[......@^......
|
||||
| 4032: 40 60 40 00 00 00 00 00 40 61 80 00 00 00 00 00 @`@.....@a......
|
||||
| 4048: 40 62 c0 00 00 00 00 00 40 64 00 00 00 00 00 00 @b......@d......
|
||||
| 4064: 40 65 40 00 00 00 00 00 40 66 80 00 00 00 00 00 @e@.....@f......
|
||||
| 4080: 40 67 0b 82 00 03 00 1c 00 00 00 08 00 00 00 00 @g..............
|
||||
| end poc_oob_read.db
|
||||
}]} {}
|
||||
|
||||
vec1_load db
|
||||
|
||||
do_catchsql_test 2.1 {
|
||||
SELECT rowid FROM t(vec1_from_json('[1,2,3,4]'), 10) WHERE m > 5.0;
|
||||
} {1 {database disk image is malformed}}
|
||||
|
||||
reset_db
|
||||
do_test 3.0 {
|
||||
sqlite3 db {}
|
||||
db deserialize [decode_hexdb {
|
||||
| size 28672 pagesize 4096 filename poc_oob_write.db
|
||||
| page 1 offset 0
|
||||
| 0: 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00 SQLite format 3.
|
||||
| 16: 10 00 01 01 00 40 20 20 00 00 00 04 00 00 00 07 .....@ ........
|
||||
| 32: 00 00 00 00 00 00 00 00 00 00 00 07 00 00 00 04 ................
|
||||
| 48: 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 ................
|
||||
| 80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 ................
|
||||
| 96: 00 2e 99 b0 0d 00 00 00 07 0d a6 00 0f ca 0f 74 ...............t
|
||||
| 112: 0f 1b 0e 9f 0e 4b 0d f7 0d a6 00 00 00 00 00 00 .....K..........
|
||||
| 3488: 00 00 00 00 00 00 4f 07 06 17 19 19 01 7b 74 61 ......O.......ta
|
||||
| 3504: 62 6c 65 74 5f 6d 65 74 61 74 5f 6d 65 74 61 07 blet_metat_meta.
|
||||
| 3520: 43 52 45 41 54 45 20 54 41 42 4c 45 20 27 74 5f CREATE TABLE 't_
|
||||
| 3536: 6d 65 74 61 27 28 69 64 20 49 4e 54 45 47 45 52 meta'(id INTEGER
|
||||
| 3552: 20 50 52 49 4d 41 52 59 20 4b 45 59 2c 20 76 61 PRIMARY KEY, va
|
||||
| 3568: 6c 20 42 4c 4f 42 29 52 06 06 17 1b 1b 01 7d 74 l BLOB)R.......t
|
||||
| 3584: 61 62 6c 65 74 5f 6d 6f 64 65 6c 74 5f 6d 6f 64 ablet_modelt_mod
|
||||
| 3600: 65 6c 06 43 52 45 41 54 45 20 54 41 42 4c 45 20 el.CREATE TABLE
|
||||
| 3616: 27 74 5f 6d 6f 64 65 6c 27 28 69 64 20 49 4e 54 't_model'(id INT
|
||||
| 3632: 45 47 45 52 20 50 52 49 4d 41 52 59 20 4b 45 59 EGER PRIMARY KEY
|
||||
| 3648: 2c 20 76 61 6c 20 42 4c 4f 42 29 52 05 06 17 1f , val BLOB)R....
|
||||
| 3664: 17 01 7d 69 6e 64 65 78 74 5f 69 64 78 5f 69 64 ...indext_idx_id
|
||||
| 3680: 78 74 5f 69 64 78 05 43 52 45 41 54 45 20 49 4e xt_idx.CREATE IN
|
||||
| 3696: 44 45 58 20 27 74 5f 69 64 78 5f 69 64 78 27 20 DEX 't_idx_idx'
|
||||
| 3712: 4f 4e 20 27 74 5f 69 64 78 27 28 62 75 63 6b 65 ON 't_idx'(bucke
|
||||
| 3728: 74 2c 20 66 69 72 73 74 2c 20 6c 61 73 74 29 7a t, first, last)z
|
||||
| 3744: 04 07 17 17 17 01 81 53 74 61 62 6c 65 74 5f 69 .......Stablet_i
|
||||
| 3760: 64 78 74 5f 69 64 78 04 43 52 45 41 54 45 20 54 dxt_idx.CREATE T
|
||||
| 3776: 41 42 4c 45 20 27 74 5f 69 64 78 27 28 69 64 20 ABLE 't_idx'(id
|
||||
| 3792: 49 4e 54 45 47 45 52 20 50 52 49 4d 41 52 59 20 INTEGER PRIMARY
|
||||
| 3808: 4b 45 59 2c 20 62 75 63 6b 65 74 20 49 4e 54 45 KEY, bucket INTE
|
||||
| 3824: 47 45 52 2c 20 66 69 72 73 74 20 49 4e 54 45 47 GER, first INTEG
|
||||
| 3840: 45 52 2c 20 6c 61 73 74 20 49 4e 54 45 47 45 52 ER, last INTEGER
|
||||
| 3856: 2c 20 76 61 6c 20 42 4c 4f 42 29 57 03 07 17 19 , val BLOB)W....
|
||||
| 3872: 19 01 81 09 74 61 62 6c 65 74 5f 62 61 73 65 74 ....tablet_baset
|
||||
| 3888: 5f 62 61 73 65 03 43 52 45 41 54 45 20 54 41 42 _base.CREATE TAB
|
||||
| 3904: 4c 45 20 27 74 5f 62 61 73 65 27 28 69 64 20 49 LE 't_base'(id I
|
||||
| 3920: 4e 54 45 47 45 52 20 50 52 49 4d 41 52 59 20 4b NTEGER PRIMARY K
|
||||
| 3936: 45 59 2c 20 76 65 63 74 6f 72 20 42 4c 4f 42 2c EY, vector BLOB,
|
||||
| 3952: 20 63 30 29 54 02 06 17 1d 1d 01 7d 74 61 62 6c c0)T.......tabl
|
||||
| 3968: 65 74 5f 63 6f 6e 66 69 67 74 5f 63 6f 6e 66 69 et_configt_confi
|
||||
| 3984: 67 02 43 52 45 41 54 45 20 54 41 42 4c 45 20 27 g.CREATE TABLE '
|
||||
| 4000: 74 5f 63 6f 6e 66 69 67 27 28 69 64 20 49 4e 54 t_config'(id INT
|
||||
| 4016: 45 47 45 52 20 50 52 49 4d 41 52 59 20 4b 45 59 EGER PRIMARY KEY
|
||||
| 4032: 2c 20 76 61 6c 20 41 4e 59 29 34 01 06 17 0f 0f , val ANY)4.....
|
||||
| 4048: 08 5b 74 61 62 6c 65 74 74 43 52 45 41 54 45 20 .[tablettCREATE
|
||||
| 4064: 56 49 52 54 55 41 4c 20 54 41 42 4c 45 20 74 20 VIRTUAL TABLE t
|
||||
| 4080: 55 53 49 4e 47 20 76 65 63 31 28 76 2c 20 6d 29 USING vec1(v, m)
|
||||
| page 2 offset 4096
|
||||
| 0: 0d 00 00 00 03 0f ef 00 0f f5 0f ef 0f fa 00 00 ................
|
||||
| 4064: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 ................
|
||||
| 4080: 02 03 00 01 04 03 00 03 00 09 04 05 03 00 01 04 ................
|
||||
| page 3 offset 8192
|
||||
| 0: 0d 00 00 00 01 0f f2 00 0f f2 00 00 00 00 00 00 ................
|
||||
| 4080: 00 00 0c 01 04 00 08 07 40 45 00 00 00 00 00 00 ........@E......
|
||||
| page 4 offset 12288
|
||||
| 0: 0d 00 00 00 01 0f d8 00 0f d8 00 00 00 00 00 00 ................
|
||||
| 4048: 00 00 00 00 00 00 00 00 26 01 06 00 08 09 09 4c ........&......L
|
||||
| 4064: 00 00 00 02 00 00 00 01 00 00 00 00 00 00 00 01 ................
|
||||
| 4080: 00 00 80 3f 00 00 00 40 00 00 40 40 00 00 80 40 ...?...@..@@...@
|
||||
| page 5 offset 16384
|
||||
| 0: 0a 00 00 00 01 0f fa 00 0f fa 00 00 00 00 00 00 ................
|
||||
| 4080: 00 00 00 00 00 00 00 00 00 00 05 05 08 09 09 09 ................
|
||||
| page 6 offset 20480
|
||||
| 0: 0d 00 00 00 01 0f e3 00 0f e3 00 00 00 00 00 00 ................
|
||||
| 4064: 00 00 00 1b 01 03 00 3c 00 00 00 04 00 00 00 01 .......<........
|
||||
| 4080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 ................
|
||||
| page 7 offset 24576
|
||||
| 0: 0d 00 00 00 01 0e 2e 00 0e 2e 00 00 00 00 00 00 ................
|
||||
| 3616: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 83 4e ...............N
|
||||
| 3632: 82 00 04 00 87 20 00 00 00 09 00 00 00 00 04 41 ..... .........A
|
||||
| 3648: 41 41 41 41 41 41 41 04 41 41 41 41 41 41 41 41 AAAAAAA.AAAAAAAA
|
||||
| 3664: 04 41 41 41 41 41 41 41 41 04 41 41 41 41 41 41 .AAAAAAAA.AAAAAA
|
||||
| 3680: 41 41 04 41 41 41 41 41 41 41 41 04 41 41 41 41 AA.AAAAAAAA.AAAA
|
||||
| 3696: 41 41 41 41 04 41 41 41 41 41 41 41 41 04 41 41 AAAA.AAAAAAAA.AA
|
||||
| 3712: 41 41 41 41 41 41 04 41 41 41 41 41 41 41 41 04 AAAAAA.AAAAAAAA.
|
||||
| 3728: 41 41 41 41 41 41 41 41 04 41 41 41 41 41 41 41 AAAAAAAA.AAAAAAA
|
||||
| 3744: 41 04 41 41 41 41 41 41 41 41 04 41 41 41 41 41 A.AAAAAAAA.AAAAA
|
||||
| 3760: 41 41 41 04 41 41 41 41 41 41 41 41 04 41 41 41 AAA.AAAAAAAA.AAA
|
||||
| 3776: 41 41 41 41 41 04 41 41 41 41 41 41 41 41 04 41 AAAAA.AAAAAAAA.A
|
||||
| 3792: 41 41 41 41 41 41 41 04 41 41 41 41 41 41 41 41 AAAAAAA.AAAAAAAA
|
||||
| 3808: 04 41 41 41 41 41 41 41 41 04 41 41 41 41 41 41 .AAAAAAAA.AAAAAA
|
||||
| 3824: 41 41 04 41 41 41 41 41 41 41 41 04 41 41 41 41 AA.AAAAAAAA.AAAA
|
||||
| 3840: 41 41 41 41 04 41 41 41 41 41 41 41 41 04 41 41 AAAA.AAAAAAAA.AA
|
||||
| 3856: 41 41 41 41 41 41 04 41 41 41 41 41 41 41 41 04 AAAAAA.AAAAAAAA.
|
||||
| 3872: 41 41 41 41 41 41 41 41 04 41 41 41 41 41 41 41 AAAAAAAA.AAAAAAA
|
||||
| 3888: 41 04 41 41 41 41 41 41 41 41 04 41 41 41 41 41 A.AAAAAAAA.AAAAA
|
||||
| 3904: 41 41 41 04 41 41 41 41 41 41 41 41 04 41 41 41 AAA.AAAAAAAA.AAA
|
||||
| 3920: 41 41 41 41 41 04 41 41 41 41 41 41 41 41 04 41 AAAAA.AAAAAAAA.A
|
||||
| 3936: 41 41 41 41 41 41 41 04 41 41 41 41 41 41 41 41 AAAAAAA.AAAAAAAA
|
||||
| 3952: 04 41 41 41 41 41 41 41 41 04 41 41 41 41 41 41 .AAAAAAAA.AAAAAA
|
||||
| 3968: 41 41 04 41 41 41 41 41 41 41 41 04 41 41 41 41 AA.AAAAAAAA.AAAA
|
||||
| 3984: 41 41 41 41 04 41 41 41 41 41 41 41 41 04 41 41 AAAA.AAAAAAAA.AA
|
||||
| 4000: 41 41 41 41 41 41 04 41 41 41 41 41 41 41 41 04 AAAAAA.AAAAAAAA.
|
||||
| 4016: 41 41 41 41 41 41 41 41 04 41 41 41 41 41 41 41 AAAAAAAA.AAAAAAA
|
||||
| 4032: 41 04 41 41 41 41 41 41 41 41 04 41 41 41 41 41 A.AAAAAAAA.AAAAA
|
||||
| 4048: 41 41 41 04 41 41 41 41 41 41 41 41 04 41 41 41 AAA.AAAAAAAA.AAA
|
||||
| 4064: 41 41 41 41 41 04 41 41 41 41 41 41 41 41 04 41 AAAAA.AAAAAAAA.A
|
||||
| 4080: 41 41 41 41 41 41 41 04 41 41 41 41 41 41 41 41 AAAAAAA.AAAAAAAA
|
||||
| end poc_oob_write.db
|
||||
}]} {}
|
||||
|
||||
|
||||
vec1_load db
|
||||
do_catchsql_test 3.1 {
|
||||
INSERT INTO t(rowid, v, m)
|
||||
VALUES (2, vec1_from_json('[5.0,6.0,7.0,8.0]'), 99.0);
|
||||
} {1 {database disk image is malformed}}
|
||||
|
||||
|
||||
#-------------------------------------------------------------------------
|
||||
# Tests for corrupt GENERIC format meta-value arrays. Each test case builds
|
||||
# a table with a single list in %_idx and a GENERIC meta-value array in
|
||||
# %_meta, corrupts the meta-value array using an SQL UPDATE, then attempts
|
||||
# one of the following:
|
||||
#
|
||||
# .1 a query with a meta-value filter (vec1DoMetaFilters()),
|
||||
# .2 PRAGMA integrity_check,
|
||||
# .3 an INSERT that appends to the existing list (vec1ListBuilderLoad()
|
||||
# followed by vec1WriteMeta()),
|
||||
# .4 two DELETEs, the second of which causes the list to be compacted
|
||||
# (vec1ListBuilderCompress()).
|
||||
#
|
||||
# GENERIC meta-value arrays are not checked when they are loaded. Corruption
|
||||
# is only reported if an operation actually trips over it while parsing the
|
||||
# array. So:
|
||||
#
|
||||
# * The INSERT (.3) never parses the existing array, so it succeeds
|
||||
# unless the 8-byte header itself is corrupt.
|
||||
#
|
||||
# * Corruption that leaves every value parseable within the bounds of
|
||||
# the array, such as extra data following the last value, is not
|
||||
# reported by .1 or .4. PRAGMA integrity_check (.2) only reports it if
|
||||
# the values it parses do not match those in %_base.
|
||||
#
|
||||
# The meta-value array contains one value of each type. Its layout, with
|
||||
# 1-based byte offsets, is:
|
||||
#
|
||||
# 1..8 header (flags=GENERIC|HASNULL, nEntry=7)
|
||||
# 9..12 'one' 0B 6F6E65
|
||||
# 13..14 2 01 02
|
||||
# 15..23 3.5 04 400C000000000000
|
||||
# 24 NULL 00
|
||||
# 25..27 x'0102' 0A 0102
|
||||
# 28..32 100000 02 000186A0
|
||||
# 33..41 10000000000 03 00000002540BE400
|
||||
#
|
||||
proc vec1corrupt_build {} {
|
||||
reset_db
|
||||
vec1_load db
|
||||
execsql {
|
||||
CREATE VIRTUAL TABLE v1 USING vec1(v, m);
|
||||
INSERT INTO v1(rowid, v, m) VALUES
|
||||
(1, vec1_from_json('[1,0,0,0]'), 'one'),
|
||||
(2, vec1_from_json('[0,1,0,0]'), 2),
|
||||
(3, vec1_from_json('[0,0,1,0]'), 3.5),
|
||||
(4, vec1_from_json('[0,0,0,1]'), NULL),
|
||||
(5, vec1_from_json('[1,1,0,0]'), x'0102'),
|
||||
(6, vec1_from_json('[1,1,1,0]'), 100000),
|
||||
(7, vec1_from_json('[1,1,1,1]'), 10000000000);
|
||||
INSERT INTO v1(cmd, arg) VALUES('rebuild', '{index:"flat"}');
|
||||
}
|
||||
}
|
||||
|
||||
# Return the varint encoding of integer $v, as written by vec1PutVarint(),
|
||||
# as a hex string.
|
||||
proc vec1corrupt_varint {v} {
|
||||
set res [format %02X [expr {$v & 0x7F}]]
|
||||
set v [expr {$v >> 7}]
|
||||
while {$v>0} {
|
||||
set res "[format %02X [expr {($v & 0x7F) | 0x80}]]$res"
|
||||
set v [expr {$v >> 7}]
|
||||
}
|
||||
set res
|
||||
}
|
||||
|
||||
# Expected results for the 4 operations described above.
|
||||
#
|
||||
# vec1corrupt_ok: results for an array that is either not corrupt,
|
||||
# or is corrupt in a way that is never tripped over.
|
||||
#
|
||||
# vec1corrupt_parse: results for an array with a valid header, but that
|
||||
# cannot be parsed. Everything except the INSERT
|
||||
# reports corruption.
|
||||
#
|
||||
# vec1corrupt_header: results for an array with a corrupt header. All
|
||||
# 4 operations report corruption.
|
||||
#
|
||||
set vec1corrupt_malformed {1 {database disk image is malformed}}
|
||||
set vec1corrupt_intck [list "v1: error reading meta-list id=1,meta=0"]
|
||||
set vec1corrupt_ok [list {0 1} ok {0 {}} {0 {}}]
|
||||
set vec1corrupt_parse [list \
|
||||
$vec1corrupt_malformed $vec1corrupt_intck {0 {}} $vec1corrupt_malformed
|
||||
]
|
||||
set vec1corrupt_header [list \
|
||||
$vec1corrupt_malformed $vec1corrupt_intck \
|
||||
$vec1corrupt_malformed $vec1corrupt_malformed
|
||||
]
|
||||
|
||||
# Run the 4 operations described above against the meta-value array
|
||||
# produced by SQL expression $expr (which may refer to the uncorrupted
|
||||
# array as "val"). Test case names are $tn.1 through $tn.4. Parameter
|
||||
# $lExpect is a list of the 4 expected results.
|
||||
proc vec1corrupt_generic_test {tn expr lExpect} {
|
||||
set corrupt "UPDATE v1_meta SET val = ($expr) WHERE id=256"
|
||||
|
||||
vec1corrupt_build
|
||||
execsql $corrupt
|
||||
do_catchsql_test $tn.1 {
|
||||
SELECT rowid FROM v1(vec1_from_json('[1,0,0,0]'), 10) WHERE m='one'
|
||||
} [lindex $lExpect 0]
|
||||
|
||||
vec1corrupt_build
|
||||
execsql $corrupt
|
||||
do_execsql_test $tn.2 {
|
||||
PRAGMA integrity_check
|
||||
} [lindex $lExpect 1]
|
||||
|
||||
vec1corrupt_build
|
||||
execsql $corrupt
|
||||
do_catchsql_test $tn.3 {
|
||||
INSERT INTO v1(rowid, v, m) VALUES(8, vec1_from_json('[1,2,3,4]'), 'eight')
|
||||
} [lindex $lExpect 2]
|
||||
|
||||
vec1corrupt_build
|
||||
execsql $corrupt
|
||||
do_catchsql_test $tn.4 {
|
||||
DELETE FROM v1 WHERE rowid=1;
|
||||
DELETE FROM v1 WHERE rowid=2;
|
||||
} [lindex $lExpect 3]
|
||||
}
|
||||
|
||||
# Check the layout of the meta-value array is as described above. And
|
||||
# that the uncorrupted array works.
|
||||
vec1corrupt_build
|
||||
do_execsql_test 4.0 {
|
||||
SELECT id, hex(val) FROM v1_meta;
|
||||
} {256
|
||||
00000011000000070B6F6E65010204400C000000000000000A010202000186A00300000002540BE400
|
||||
}
|
||||
vec1corrupt_generic_test 4.1 { val } $vec1corrupt_ok
|
||||
|
||||
# Truncate the array at every possible point. Truncating it to less than
|
||||
# 8 bytes corrupts the header.
|
||||
for {set n 0} {$n<41} {incr n} {
|
||||
set lExpect [expr {$n<8 ? $vec1corrupt_header : $vec1corrupt_parse}]
|
||||
vec1corrupt_generic_test 4.2.$n "
|
||||
unhex(substr(hex(val), 1, $n*2))
|
||||
" $lExpect
|
||||
}
|
||||
|
||||
# Extra data following the last value. This is never tripped over.
|
||||
vec1corrupt_generic_test 4.3.1 { unhex(hex(val) || '00') } $vec1corrupt_ok
|
||||
vec1corrupt_generic_test 4.3.2 {
|
||||
unhex(hex(val) || '0B6F6E65')
|
||||
} $vec1corrupt_ok
|
||||
|
||||
# Bad text/blob length varints for the first value. Lengths that are too
|
||||
# small, too large, negative when cast to a 32-bit int, or a varint that
|
||||
# runs off the end of the array.
|
||||
#
|
||||
# Case 9 is a length just smaller than 2^31. When added to the offset of
|
||||
# the value within the array (8), plus the size of the varint (5), this
|
||||
# overflows a 32-bit signed int.
|
||||
#
|
||||
# Case 2 makes the first value 1 byte longer than it should be. This
|
||||
# misaligns the rest of the array, but by chance all 7 values can still
|
||||
# be parsed without running off the end of it. So the query and DELETE
|
||||
# succeed, and integrity_check only notices because the parsed values do
|
||||
# not match those in %_base.
|
||||
set vec1corrupt_misaligned [list \
|
||||
{0 {}} [list "v1: meta-value value mismatch for row 1"] {0 {}} {0 {}}
|
||||
]
|
||||
foreach {tn varint lExpect} [list \
|
||||
1 09 $vec1corrupt_parse \
|
||||
2 0D $vec1corrupt_misaligned \
|
||||
3 8F7F $vec1corrupt_parse \
|
||||
4 FF $vec1corrupt_parse \
|
||||
5 [vec1corrupt_varint [expr {0x1FFFFFFFF}]] $vec1corrupt_parse \
|
||||
6 [vec1corrupt_varint [expr {2*0xFFFFFF00 + 5}]] $vec1corrupt_parse \
|
||||
7 [vec1corrupt_varint [expr {2*0x7FFFFFFF + 5}]] $vec1corrupt_parse \
|
||||
8 FFFFFFFFFFFFFFFFFF7F $vec1corrupt_parse \
|
||||
9 [vec1corrupt_varint [expr {2*0x7FFFFFF6 + 5}]] $vec1corrupt_parse \
|
||||
] {
|
||||
vec1corrupt_generic_test 4.4.$tn "
|
||||
unhex(substr(hex(val), 1, 16) || '$varint' || substr(hex(val), 19))
|
||||
" $lExpect
|
||||
}
|
||||
|
||||
# Bad blob length varint for the 5th value.
|
||||
foreach {tn varint} [list \
|
||||
1 08 \
|
||||
2 [vec1corrupt_varint [expr {2*0xFFFFFF00 + 6}]] \
|
||||
] {
|
||||
vec1corrupt_generic_test 4.5.$tn "
|
||||
unhex(substr(hex(val), 1, 48) || '$varint' || substr(hex(val), 51))
|
||||
" $vec1corrupt_parse
|
||||
}
|
||||
|
||||
# A varint that is not terminated before the end of the array.
|
||||
vec1corrupt_generic_test 4.6.1 {
|
||||
unhex(substr(hex(val), 1, 16) || 'FFFFFFFF')
|
||||
} $vec1corrupt_parse
|
||||
vec1corrupt_generic_test 4.6.2 {
|
||||
unhex(substr(hex(val), 1, 64) || 'FFFFFFFFFFFFFFFFFF')
|
||||
} $vec1corrupt_parse
|
||||
|
||||
finish_test
|
||||
|
||||
|
||||
154
ext/vec1/vec1.c
154
ext/vec1/vec1.c
@@ -668,7 +668,7 @@ static void vec1HeapInsert(Vec1AnnHeap *p, sqlite3_int64 iRowid, double fDist){
|
||||
** encountered.
|
||||
*/
|
||||
static int vec1BufferGrow(Vec1Buffer *pBuf, sqlite3_int64 nByte){
|
||||
if( pBuf->n+nByte>pBuf->nAlloc ){
|
||||
if( nByte>pBuf->nAlloc-pBuf->n ){
|
||||
sqlite3_int64 nNew = pBuf->nAlloc;
|
||||
unsigned char *aNew = 0;
|
||||
|
||||
@@ -5421,6 +5421,11 @@ static void vec1ModelFreeTCent(Vec1Model *pMod){
|
||||
#define VEC1_META_4BYTEMAX +2147483646
|
||||
#define VEC1_META_4BYTENULL +2147483647
|
||||
|
||||
/* When a meta-value array is loaded from disk, at least VEC1_META_PADDING
|
||||
** extra bytes of memory are allocated. This is to allow readers to safely
|
||||
** overread the record slightly if it is corrupt. */
|
||||
#define VEC1_META_PADDING 20
|
||||
|
||||
typedef struct Vec1Tab Vec1Tab;
|
||||
typedef struct Vec1Csr Vec1Csr;
|
||||
|
||||
@@ -7020,13 +7025,21 @@ static int vec1PutVarint(u8 *aBuf, u64 v){
|
||||
}
|
||||
|
||||
static int vec1GetVarint(const u8 *aBuf, u64 *piVal){
|
||||
int nRet = 0;
|
||||
u64 out = 0;
|
||||
do {
|
||||
out = (out<<7) + (aBuf[nRet] & 0x7F);
|
||||
} while( aBuf[nRet++] & 0x80 );
|
||||
int ii = 0;
|
||||
|
||||
out = (aBuf[0] & 0x7F);
|
||||
if( aBuf[0] & 0x80 ){
|
||||
for(ii=1; ii<9; ii++){
|
||||
out = (out<<7) + (aBuf[ii] & 0x7F);
|
||||
if( (aBuf[ii] & 0x80)==0 ){
|
||||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
*piVal = out;
|
||||
return nRet;
|
||||
return ii+1;
|
||||
}
|
||||
|
||||
/*
|
||||
@@ -7122,6 +7135,7 @@ static void vec1BinaryQuantLUTBuild(
|
||||
*/
|
||||
static int vec1ReadMeta(
|
||||
Vec1Tab *pTab, /* Vec1 virtual table */
|
||||
u32 nExpect, /* Expected number of entries */
|
||||
Vec1Buffer *pBuf, /* Buffer to read into */
|
||||
i64 iId, /* Id of %_idx row */
|
||||
int iMeta /* Index of meta-column */
|
||||
@@ -7137,18 +7151,47 @@ static int vec1ReadMeta(
|
||||
sqlite3_bind_int64(pStmt, 1, iMetaId);
|
||||
if( SQLITE_ROW==sqlite3_step(pStmt) ){
|
||||
int nByte = sqlite3_column_bytes(pStmt, 0);
|
||||
rc = vec1BufferGrow(pBuf, nByte);
|
||||
rc = vec1BufferGrow(pBuf, nByte + VEC1_META_PADDING);
|
||||
if( rc==SQLITE_OK ){
|
||||
const u8 *a = sqlite3_column_blob(pStmt, 0);
|
||||
memcpy(pBuf->a, a, nByte);
|
||||
memset(&pBuf->a[nByte], 0, VEC1_META_PADDING);
|
||||
pBuf->n = nByte;
|
||||
}
|
||||
}
|
||||
|
||||
vec1StmtReset(&rc, pStmt);
|
||||
if( rc==SQLITE_OK && pBuf->n==0 ){
|
||||
rc = VEC1_CORRUPT;
|
||||
|
||||
/* Check, so far as is possible, that the meta-value blob is the
|
||||
** expected size. It is not possible to check if the meta-value blob
|
||||
** uses the GENERIC format, due to the variable length fields. Code
|
||||
** that handles GENERIC meta-value blobs has to dynamically verify
|
||||
** the buffer size. */
|
||||
if( rc==SQLITE_OK ){
|
||||
if( pBuf->n<VEC1_META_SZHDR ){
|
||||
rc = VEC1_CORRUPT;
|
||||
}else{
|
||||
u32 tflag = (vec1GetU32(&pBuf->a[0]) & VEC1_META_TYPEMASK);
|
||||
u32 nEntry = vec1GetU32(&pBuf->a[4]);
|
||||
i64 sz = 0;
|
||||
if( nEntry!=nExpect ){
|
||||
rc = VEC1_CORRUPT;
|
||||
}
|
||||
if( tflag==VEC1_META_1BYTEINT ){
|
||||
sz = 1;
|
||||
}else if( tflag==VEC1_META_4BYTEINT ){
|
||||
sz = sizeof_u32;
|
||||
}else if( tflag==VEC1_META_REAL ){
|
||||
sz = sizeof_f64;
|
||||
}else if( tflag!=VEC1_META_GENERIC ){
|
||||
rc = VEC1_CORRUPT;
|
||||
}
|
||||
|
||||
if( sz && pBuf->n!=(VEC1_META_SZHDR + sz*nEntry) ){
|
||||
rc = VEC1_CORRUPT;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
return rc;
|
||||
@@ -7162,11 +7205,12 @@ static int vec1ReadMeta(
|
||||
** 4: Real value. 8 byte payload.
|
||||
*/
|
||||
static int vec1MetaValueRead(
|
||||
Vec1Buffer *pMeta,
|
||||
int *piOff,
|
||||
Vec1Buffer *pMeta,
|
||||
int *piOff,
|
||||
Vec1MetaValue *pVal
|
||||
){
|
||||
int iOff = *piOff;
|
||||
i64 iOff = (i64)*piOff;
|
||||
|
||||
switch( pMeta->a[iOff] ){
|
||||
case 0: {
|
||||
pVal->eType = SQLITE_NULL;
|
||||
@@ -7207,14 +7251,18 @@ static int vec1MetaValueRead(
|
||||
u64 eType = 0;
|
||||
iOff += vec1GetVarint(&pMeta->a[iOff], &eType);
|
||||
pVal->pPtr = &pMeta->a[iOff];
|
||||
pVal->iVal = (eType-5) / 2;
|
||||
iOff += (int)pVal->iVal;
|
||||
pVal->iVal = (((eType-5) / 2) & (u64)0xFFFFFFFF);
|
||||
iOff += pVal->iVal;
|
||||
pVal->eType = (eType & 0x01) ? SQLITE_TEXT : SQLITE_BLOB;
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
*piOff = iOff;
|
||||
if( iOff>pMeta->n || iOff<0 ){
|
||||
return VEC1_CORRUPT;
|
||||
}
|
||||
|
||||
*piOff = (int)iOff;
|
||||
return SQLITE_OK;
|
||||
}
|
||||
|
||||
@@ -7907,7 +7955,7 @@ static VEC1_NOINLINE int vec1DoMetaFilters(
|
||||
for(ii=0; rc==SQLITE_OK && ii<pQuery->nFilter; ii++){
|
||||
Vec1Filter *pFilter = &pQuery->aFilter[ii];
|
||||
VEC1_QINSTR_START(pTab, VEC1_QINSTR_METAREAD);
|
||||
rc = vec1ReadMeta(pTab, pMeta, iId, pFilter->iMeta);
|
||||
rc = vec1ReadMeta(pTab, nEntry, pMeta, iId, pFilter->iMeta);
|
||||
VEC1_QINSTR_STOP(pTab, VEC1_QINSTR_METAREAD);
|
||||
|
||||
VEC1_QINSTR_START(pTab, VEC1_QINSTR_METASCAN);
|
||||
@@ -7944,7 +7992,8 @@ static VEC1_NOINLINE int vec1DoMetaFilters(
|
||||
int iOff = VEC1_META_SZHDR;
|
||||
for(jj=0; jj<nEntry; jj++){
|
||||
Vec1MetaValue val;
|
||||
vec1MetaValueRead(pMeta, &iOff, &val);
|
||||
rc = vec1MetaValueRead(pMeta, &iOff, &val);
|
||||
if( rc!=SQLITE_OK ) break;
|
||||
if( vec1MetaValueFilter(pFilter, &val) ){
|
||||
pBitmask->a[jj / 8] |= (1 << (jj % 8));
|
||||
}
|
||||
@@ -9805,7 +9854,8 @@ static int vec1WriteMeta(
|
||||
if( rc!=SQLITE_OK ) return rc;
|
||||
|
||||
while( iIn<p->buf.n ){
|
||||
vec1MetaValueRead(&p->buf, &iIn, &val);
|
||||
rc = vec1MetaValueRead(&p->buf, &iIn, &val);
|
||||
if( rc!=SQLITE_OK ) break;
|
||||
if( val.eType==SQLITE_NULL ){
|
||||
val.iVal = iNull;
|
||||
}else if( p->format==VEC1_META_REAL ){
|
||||
@@ -9839,7 +9889,7 @@ static int vec1WriteMeta(
|
||||
** A serialized meta-value is stored in buffer aBuf. Return the size in
|
||||
** bytes of the meta value.
|
||||
*/
|
||||
static int vec1MetaValueSize(const u8 *aBuf){
|
||||
static i64 vec1MetaValueSize(const u8 *aBuf){
|
||||
switch( aBuf[0] ){
|
||||
case 0: return 1; /* NULL */
|
||||
case 1: return 2; /* 1-byte integer */
|
||||
@@ -9855,27 +9905,11 @@ static int vec1MetaValueSize(const u8 *aBuf){
|
||||
*/
|
||||
i64 V = 0;
|
||||
int n = vec1GetVarint(aBuf, (u64*)&V);
|
||||
return (int)(((V-5)/2) + n);
|
||||
return (((V-5)/2) & (i64)0xFFFFFFFF) + n;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
#ifndef NDEBUG
|
||||
/*
|
||||
** This may be used in assert() statements to check that the meta-value
|
||||
** list contains the expected number of elements.
|
||||
*/
|
||||
static int vec1MetaValueCheck(Vec1Buffer *pBuf, int nEntry){
|
||||
int iOff = 0;
|
||||
int ii;
|
||||
for(ii=0; ii<nEntry; ii++){
|
||||
iOff += vec1MetaValueSize(&pBuf->a[iOff]);
|
||||
}
|
||||
assert( iOff==pBuf->n );
|
||||
return 1;
|
||||
}
|
||||
#endif
|
||||
|
||||
static int vec1ListBuilderLoad(
|
||||
Vec1ListBuilder *p,
|
||||
i64 iId,
|
||||
@@ -9932,7 +9966,7 @@ static int vec1ListBuilderLoad(
|
||||
/* Load the array for each meta-data column from the %_meta table */
|
||||
for(ii=0; rc==SQLITE_OK && ii<pTab->nMeta; ii++){
|
||||
Vec1MetaBuilder *pMeta = &p->aMeta[ii];
|
||||
rc = vec1ReadMeta(pTab, &pMeta->buf, iId, ii);
|
||||
rc = vec1ReadMeta(pTab, nEntry, &pMeta->buf, iId, ii);
|
||||
if( rc==SQLITE_OK ){
|
||||
u32 f = vec1GetU32(pMeta->buf.a);
|
||||
pMeta->format = (f & VEC1_META_TYPEMASK);
|
||||
@@ -10159,9 +10193,12 @@ static int vec1ListBuilderCompress(
|
||||
Vec1MetaBuilder *pMeta = &p->aMeta[iMeta];
|
||||
u8 *a = pMeta->buf.a;
|
||||
|
||||
|
||||
if( pMeta->format==VEC1_META_GENERIC ){
|
||||
int nIn = vec1MetaValueSize(&a[aMetaIn[iMeta]]);
|
||||
i64 nIn = vec1MetaValueSize(&a[aMetaIn[iMeta]]);
|
||||
if( nIn<=0 || nIn>pMeta->buf.n-aMetaIn[iMeta] ){
|
||||
sqlite3_free(aMetaIn);
|
||||
return VEC1_CORRUPT;
|
||||
}
|
||||
if( bTombstone==0 ){
|
||||
if( aMetaIn[iMeta]!=aMetaOut[iMeta] ){
|
||||
memmove(&a[ aMetaOut[iMeta] ], &a[ aMetaIn[iMeta] ], nIn);
|
||||
@@ -10758,6 +10795,10 @@ static int vec1WriterMetaFromStmt(
|
||||
/*
|
||||
** Read nMeta values from buffer pBuf. Use them as the meta values associated
|
||||
** with the (compressed) vector just appended to bucket iBucket.
|
||||
**
|
||||
** This is only called on a buffer that has been constructed in process,
|
||||
** not one loaded from disk, so it is safe to assume that pBuf really does
|
||||
** contain nMeta well-formed values.
|
||||
*/
|
||||
static int vec1WriterMetaFromPacked(
|
||||
Vec1Writer *pWriter, /* Writer object accumulating changes */
|
||||
@@ -10769,7 +10810,7 @@ static int vec1WriterMetaFromPacked(
|
||||
int iOff = *piOff;
|
||||
for(ii=0; ii<pWriter->pTab->nMeta; ii++){
|
||||
Vec1MetaBuilder *pTo = &pWriter->aBld[iBucket].aMeta[ii];
|
||||
int n = vec1MetaValueSize(&pBuf->a[iOff]);
|
||||
i64 n = vec1MetaValueSize(&pBuf->a[iOff]);
|
||||
int rc = vec1BufferGrow(&pTo->buf, n);
|
||||
vec1MetaValueUpdateFlags(&pBuf->a[iOff], &pTo->flags);
|
||||
if( rc!=SQLITE_OK ) return rc;
|
||||
@@ -11551,7 +11592,7 @@ static int vec1DeleteByRowid(Vec1Tab *pTab, i64 iRowid){
|
||||
** the threshold. So reorganize the list and remove iRowid in
|
||||
** one go. */
|
||||
if( loc.pList ){
|
||||
vec1ListBuilderCompress(loc.pList, iRowid);
|
||||
rc = vec1ListBuilderCompress(loc.pList, iRowid);
|
||||
}else{
|
||||
/* Load the list into memory, compress it so there are no
|
||||
** tombstones, then write it back to the database. */
|
||||
@@ -11910,7 +11951,7 @@ static int vec1IntegrityMetaValue(
|
||||
vec1MetaValueRead(pBuf, &iOff, &val);
|
||||
}
|
||||
|
||||
if( pVal ){
|
||||
if( rc==SQLITE_OK && pVal ){
|
||||
int eType = sqlite3_value_type(pVal);
|
||||
int bMatch = 0;
|
||||
switch( eType ){
|
||||
@@ -12075,6 +12116,27 @@ static int vec1IntegrityCheckEncoded(
|
||||
return 0;
|
||||
}
|
||||
|
||||
/*
|
||||
** The buffer passed as the only argument contains a meta-value array. If
|
||||
** it is of type GENERIC, test that it is well-formed. Return VEC1_CORRUPT
|
||||
** if it is not, or SQLITE_OK if it looks ok.
|
||||
*/
|
||||
static int vec1IntegrityCheckMetaArray(Vec1Buffer *pBuf){
|
||||
int rc = SQLITE_OK;
|
||||
int bGeneric = vec1GetU32(pBuf->a) & VEC1_META_GENERIC;
|
||||
if( bGeneric ){
|
||||
u32 nEntry = vec1GetU32(&pBuf->a[4]);
|
||||
u32 ii;
|
||||
int iOff = VEC1_META_SZHDR;
|
||||
for(ii=0; rc==SQLITE_OK && ii<nEntry; ii++){
|
||||
Vec1MetaValue dummy;
|
||||
rc = vec1MetaValueRead(pBuf, &iOff, &dummy);
|
||||
}
|
||||
}
|
||||
return rc;
|
||||
}
|
||||
|
||||
|
||||
/*
|
||||
** Integrity check method. If the table has been supplied with a model,
|
||||
** loop through the %_idx table. For each
|
||||
@@ -12172,7 +12234,11 @@ static int vec1IntegrityMethod(
|
||||
|
||||
/* Load the array for each meta-value column from disk */
|
||||
for(iMeta=0; iMeta<pTab->nMeta; iMeta++){
|
||||
rc = vec1ReadMeta(pTab, &aBufMeta[iMeta], iId, iMeta);
|
||||
rc = vec1ReadMeta(pTab, nEntry, &aBufMeta[iMeta], iId, iMeta);
|
||||
|
||||
if( rc==SQLITE_OK ){
|
||||
rc = vec1IntegrityCheckMetaArray(&aBufMeta[iMeta]);
|
||||
}
|
||||
if( rc!=SQLITE_OK ){
|
||||
if( rc==SQLITE_CORRUPT_VTAB ){
|
||||
const char *zFmt = "%s: error reading meta-list id=%lld,meta=%d";
|
||||
|
||||
16
manifest
16
manifest
@@ -1,5 +1,5 @@
|
||||
C Bump\sthe\sversion\snumber\sto\s3.55\sto\sbegin\sthe\snext\sdevelopment\scycle.
|
||||
D 2026-10-09T18:11:52.665
|
||||
C Fix\ssome\sproblems\swith\shandling\scorrupt\smeta-value\sarrays\sin\svec1.
|
||||
D 2026-10-09T19:12:32.029
|
||||
F .fossil-settings/binary-glob 61195414528fb3ea9693577e1980230d78a1f8b0a54c78cf1b9b24d0a409ed6a x
|
||||
F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
|
||||
F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
|
||||
@@ -597,7 +597,7 @@ F ext/vec1/test/vec1blocksize.test dd7d9460f5cac98bc5d2c18f1211a503fb0625afed828
|
||||
F ext/vec1/test/vec1cat.test 8cea568d8823519044053d39f4eec8d77a806bf85e1e14817b448729038306de
|
||||
F ext/vec1/test/vec1cat2.test 9e0d9a9cfa33b6aade9150c73064be53e52de9d693f53b7600e7696ed8022e02
|
||||
F ext/vec1/test/vec1config.test fa0d8e3c83fd5ceeb36b7c481f9207e15f17020357ecde1b243fe03b12cea1b0
|
||||
F ext/vec1/test/vec1corrupt.test 8711434b742673c57154332cbfefb83f83b2d40d2399f9d7c3f1a2e8676ece25
|
||||
F ext/vec1/test/vec1corrupt.test 973a7442adebb6520aaabb61c3e88588f921cac8f272f41378cdbc22d7a60689
|
||||
F ext/vec1/test/vec1create.test fdf7dc7d4e62d5654c1ac27bb9aea9451f024280dce5d0ec97d2698a040b3914
|
||||
F ext/vec1/test/vec1delete.test 1dc56bbc8a6753991dbc8cdca558a933ae6280c01bee261b1b2561e0390b57e6
|
||||
F ext/vec1/test/vec1error.test 3d1b74cd535dd5c9d303309f0b18ec606b100139a6483cbbd495b0aa3a9c8a09
|
||||
@@ -641,7 +641,7 @@ F ext/vec1/tool/vec1_algo_test.c c62b828a3e46a39a8656f26b74804906cc3160758f8afc6
|
||||
F ext/vec1/tool/vec1bench.tcl a117caee3cb99712f0477fe2fa85c94c260866951d3a9d667b62631b480c2d2d
|
||||
F ext/vec1/tool/vec1bench_addcols.tcl 8c509253d07b179928f2ee32e3591a2c70d13c914217e1328c01afa148717051
|
||||
F ext/vec1/tool/vec1bench_vibe2db.py 84ddb0236bc3d02a0393abce41986a1b7dad7f0d83884576f8318c2883e3aed3
|
||||
F ext/vec1/vec1.c e74bc93b4f03f34037458dd5ea87b9a69cf73eec34f3831e8b11a3306d00c008
|
||||
F ext/vec1/vec1.c ffcccf5b04776502da29330fdb13430366c3255107754dcbfc506539027e0741
|
||||
F ext/wasm/GNUmakefile cc28e65dec12f1b992957152d8395484f4fcf7f94e6b6736a09ee4f48e7ec048
|
||||
F ext/wasm/README-dist.txt f01081a850ce38a56706af6b481e3a7878e24e42b314cfcd4b129f0f8427066a
|
||||
F ext/wasm/README.md 2e87804e12c98f1d194b7a06162a88441d33bb443efcfe00dc6565a780d2f259
|
||||
@@ -2281,8 +2281,8 @@ F tool/warnings-clang.sh bbf6a1e685e534c92ec2bfba5b1745f34fb6f0bc2a362850723a9ee
|
||||
F tool/warnings.sh a554d13f6e5cf3760f041b87939e3d616ec6961859c3245e8ef701d1eafc2ca2
|
||||
F tool/win/sqlite.vsix deb315d026cc8400325c5863eef847784a219a2f
|
||||
F tool/winmain.c 00c8fb88e365c9017db14c73d3c78af62194d9644feaf60e220ab0f411f3604c
|
||||
P be8d059e9a49089ab2dce5ed26dd87aaf598fdc5fbe0b107c0dd758464bcd5e3
|
||||
R eb597edd7ac7b531bfa70359d945f295
|
||||
U drh
|
||||
Z 8eab8efe429ad19a18ae9d816f910631
|
||||
P 0dc7d0aaf5bacf17095a0ae7d4739458eb2c9cbaf049294589449b8787e6c48c
|
||||
R 51b579cd3aaddb4a3b6589ed73cda4d1
|
||||
U dan
|
||||
Z 69931eb50c086bc559d246580a91135d
|
||||
# Remove this line to create a well-formed Fossil manifest.
|
||||
|
||||
@@ -1 +1 @@
|
||||
0dc7d0aaf5bacf17095a0ae7d4739458eb2c9cbaf049294589449b8787e6c48c
|
||||
fa41e6201609f40ce9d6ec28693e4cd143363a78f072476586f6de7fd90aed66
|
||||
|
||||
Reference in New Issue
Block a user