From b66207d7327254c97ceb0e7686137e2229bc1cbc Mon Sep 17 00:00:00 2001
From: drh <>
Date: Fri, 23 Oct 2026 13:22:05 +0000
Subject: [PATCH] Fix a one-byte buffer overread in FTS5 associated with LIKE
 processing. [bugs:/info/2026-10-23T12:49:10Z|Bug 2026-10-23T12:49:10Z].

FossilOrigin-Name: 60222d023e889eb8c67c0a654637c3f3da741b37143f1b3351a7ac4ef09befc6
---
 ext/fts5/fts5_expr.c           |  2 +-
 ext/fts5/test/fts5trigram.test | 49 ++++++++++++++++++++++++++++++++++
 manifest                       | 14 +++++-----
 manifest.uuid                  |  2 +-
 4 files changed, 58 insertions(+), 9 deletions(-)

diff --git a/ext/fts5/fts5_expr.c b/ext/fts5/fts5_expr.c
index 844534a9e0..5d0aa7438a 100644
--- a/ext/fts5/fts5_expr.c
+++ b/ext/fts5/fts5_expr.c
@@ -401,7 +401,7 @@ int sqlite3Fts5ExprPattern(
           zExpr[iOut++] = '"';
           zExpr[iOut++] = ' ';
         }
-        if( zText[i]==aSpec[2] ){
+        if( i<nText && zText[i]==aSpec[2] ){
           i += 2;
           if( zText[i-1]=='^' ) i++;
           while( i<nText && zText[i]!=']' ) i++;
diff --git a/ext/fts5/test/fts5trigram.test b/ext/fts5/test/fts5trigram.test
index 377e3f7813..f01075397b 100644
--- a/ext/fts5/test/fts5trigram.test
+++ b/ext/fts5/test/fts5trigram.test
@@ -362,5 +362,54 @@ do_test 12.2 {
   sqlite3_fts5_tokenize db trigram ""
 } {}
 
+#-------------------------------------------------------------------------
+# Bug 402c7177cb4d53f4. A LIKE pattern pushed down to FTS5 made
+# sqlite3Fts5ExprPattern() read one byte past the end of the pattern,
+# because for LIKE aSpec[2] is 0, which matches the nul terminator.
+# The query result was correct; the over-read only showed up under a
+# sanitizer. These tests exercise the affected path and confirm the
+# results are as expected.
+#
+reset_db
+do_execsql_test 13.0 {
+  CREATE VIRTUAL TABLE t USING fts5(a, tokenize=trigram);
+  INSERT INTO t VALUES('abcdefg');     -- rowid 1
+  INSERT INTO t VALUES('xabcdefgy');   -- rowid 2
+  INSERT INTO t VALUES('abcXefg');     -- rowid 3
+  INSERT INTO t VALUES('zzz');         -- rowid 4
+}
+
+# The repro from the bug report: a LIKE with no wildcards, 3+ characters,
+# ending at the terminator (the case that triggered the over-read).
+do_execsql_test 13.1 {
+  SELECT rowid FROM t WHERE a LIKE 'abcdefg';
+} {1}
+do_execsql_test 13.2 {
+  SELECT rowid FROM t WHERE a LIKE '%abcdefg%';
+} {1 2}
+
+# A bound parameter follows the same path.
+do_test 13.3 {
+  set pat abcdefg
+  execsql { SELECT rowid FROM t WHERE a LIKE $pat }
+} {1}
+
+# GLOB, including a trailing bracket expression, still works.
+do_execsql_test 13.4 {
+  SELECT rowid FROM t WHERE a GLOB '*abc*';
+} {1 2 3}
+do_execsql_test 13.5 {
+  SELECT rowid FROM t WHERE a GLOB 'abc[d]efg';
+} {1}
+do_execsql_test 13.6 {
+  SELECT rowid FROM t WHERE a GLOB 'abc[X-Z]efg';
+} {3}
+
+# Short patterns (fewer than 3 trigram characters) are not pushed down
+# but must still return the right rows.
+do_execsql_test 13.7 {
+  SELECT rowid FROM t WHERE a LIKE '%ab%';
+} {1 2 3}
+
 finish_test
 
diff --git a/manifest b/manifest
index c93542273f..713c80b90b 100644
--- a/manifest
+++ b/manifest
@@ -1,5 +1,5 @@
-C Fix\sa\sUAF\sin\sFTS5\son\sa\squery\sthat\suses\sa\sprefix\squery\sand\sa\sordinary\sterm\ninside\sof\sa\stransaction.\n[bugs:/info/2026-10-23T03:10:17Z|Bug\s2026-10-23T03:10:17Z].
-D 2026-10-23T12:23:36.605
+C Fix\sa\sone-byte\sbuffer\soverread\sin\sFTS5\sassociated\swith\sLIKE\sprocessing.\n[bugs:/info/2026-10-23T12:49:10Z|Bug\s2026-10-23T12:49:10Z].
+D 2026-10-23T13:22:05.022
 F .fossil-settings/binary-glob 61195414528fb3ea9693577e1980230d78a1f8b0a54c78cf1b9b24d0a409ed6a x
 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
@@ -112,7 +112,7 @@ F ext/fts5/fts5Int.h 8d98f8e180fe28d6067e240ed45b9011735d29d5cfb5bac194e1e376baa
 F ext/fts5/fts5_aux.c 9b51513ade609641d27643abd992dbb72307580b18642fc90b1ccd6ba69beae7
 F ext/fts5/fts5_buffer.c dcc3f0352339fe79c9d8abbc1c2009bc3469206467880bf43558447ef4f846fb
 F ext/fts5/fts5_config.c d5df08345abc813a0b58be6b2e08ad9b3ba9be355c3ca3ae36226ffea760876f
-F ext/fts5/fts5_expr.c b906c59e9e842805cc3eea4e131b822e586bb01260e542f67920c61798dcb53d
+F ext/fts5/fts5_expr.c 1b80d93e5d163a90253ec99c2568e419bc9b224115b3bcd34709ea522de52ae0
 F ext/fts5/fts5_hash.c 341a08ad0153b397b819ef3d7a7959c1dc3c84a6988a431d93dece8bd62ae10e
 F ext/fts5/fts5_index.c b8d1e352ef82016e5620da3c4471cd963bb167a1feddf9a808e08e3712605ca5
 F ext/fts5/fts5_main.c b740ae52955fc27426aa0e63deb4734dceead35952ce994f5f4d28a1dd69704d
@@ -260,7 +260,7 @@ F ext/fts5/test/fts5tokendata.test 7cad79af82e8e81b7a36b450087233d2fca051bb0d584
 F ext/fts5/test/fts5tokenizer.test 738e9c3e1b338028e202d0fcd33aa39f1bd3f8444d14f9a408e8a617b1361d3f
 F ext/fts5/test/fts5tokenizer2.test ddb8b10fbe4b84b2a75812671f127774c1d2e3e2bf82d2e0e4f0bb1cd8a2b2d6
 F ext/fts5/test/fts5tokenizer3.test eea778f7bb7024c3e904e28915f9d53286141671b138722148be22a9c758bdc3
-F ext/fts5/test/fts5trigram.test a55fde7065ae69a0f82c5a7a5bf5286a97de11ae4bff6537fd3e27ca9a01416f
+F ext/fts5/test/fts5trigram.test 52d1072f180da1a8ceba1052f366832027e00b4c799b782f34b05d28f6e67115
 F ext/fts5/test/fts5trigram2.test 6fde9de7f63a6b4aa18dc731be56dbd6be4e755c9b13dcd55479e200d1df0e61
 F ext/fts5/test/fts5ubsan.test 9a2dcf399dc8d0e0de661f0d93884d1d27e5b7f0693cfceb97dd24d818df5dd2
 F ext/fts5/test/fts5umlaut.test a42fe2fe6387c40c49ab27ccbd070e1ae38e07f38d05926482cc0bccac9ad602
@@ -2287,8 +2287,8 @@ F tool/warnings-clang.sh bbf6a1e685e534c92ec2bfba5b1745f34fb6f0bc2a362850723a9ee
 F tool/warnings.sh a554d13f6e5cf3760f041b87939e3d616ec6961859c3245e8ef701d1eafc2ca2
 F tool/win/sqlite.vsix deb315d026cc8400325c5863eef847784a219a2f
 F tool/winmain.c 00c8fb88e365c9017db14c73d3c78af62194d9644feaf60e220ab0f411f3604c
-P d7e1c85c176083d78b60b3098a863754160edada5b0cb924b3468650713c1075
-R f1be68735d5ace2b904acfb4644d06fc
+P 599f3345b99b79e11a71bd0087555d0980f2af5cffb6b78683a5027e78f67831
+R b4624b749fb8bdcb2d00b99b1c1771b1
 U drh
-Z e0c370924b1fdb647ed49f5b4b7d631f
+Z 7bbeca39677907088cfa3dbae40c5666
 # Remove this line to create a well-formed Fossil manifest.
diff --git a/manifest.uuid b/manifest.uuid
index d6d9012560..f9f5f2534d 100644
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-599f3345b99b79e11a71bd0087555d0980f2af5cffb6b78683a5027e78f67831
+60222d023e889eb8c67c0a654637c3f3da741b37143f1b3351a7ac4ef09befc6