database/sqlite
1
0
Fork 0
mirror of https://github.com/sqlite/sqlite.git synced 2025-11-14 00:22:38 +03:00
Code Activity

Further changes to guard against integer overflow in the width and precision

Browse Source 
of printf() arguments.

FossilOrigin-Name: 5ce4e7d7651e5c72a59f03f7aeb366291e62ab57
This commit is contained in:
drh
2015-04-07 13:28:41 +00:00
parent 74b42275ec
commit a30d22a7a6
4 changed files with 36 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
src/printf.c
View File

@@ -390,6 +390,7 @@ void sqlite3VXPrintf(
if( precision<etBUFSIZE-10 ){
nOut = etBUFSIZE;
zOut = buf;
if( precision<0 ) precision = 0;
}else{
nOut = precision + 10;
zOut = zExtra = sqlite3Malloc( nOut );
@@ -450,6 +451,7 @@ void sqlite3VXPrintf(
else prefix = 0;
}
if( xtype==etGENERIC && precision>0 ) precision--;
testcase( precision>0xfff );
for(idx=precision&0xfff, rounder=0.5; idx>0; idx--, rounder*=0.1){}
if( xtype==etFLOAT ) realvalue += rounder;
/* Normalize realvalue to within 10.0 > realvalue >= 1.0 */
@@ -739,7 +741,7 @@ void sqlite3VXPrintf(
*/
static int sqlite3StrAccumEnlarge(StrAccum *p, int N){
char *zNew;
assert( p->nChar+N >= p->nAlloc ); /* Only called if really needed */
assert( p->nChar+(i64)N >= p->nAlloc ); /* Only called if really needed */
if( p->accError ){
testcase(p->accError==STRACCUM_TOOBIG);
testcase(p->accError==STRACCUM_NOMEM);
@@ -788,7 +790,10 @@ static int sqlite3StrAccumEnlarge(StrAccum *p, int N){
** Append N copies of character c to the given string buffer.
*/
void sqlite3AppendChar(StrAccum *p, int N, char c){
if( p->nChar+N >= p->nAlloc && (N = sqlite3StrAccumEnlarge(p, N))<=0 ) return;
testcase( p->nChar + (i64)N > 0x7fffffff );
if( p->nChar+(i64)N >= p->nAlloc && (N = sqlite3StrAccumEnlarge(p, N))<=0 ){
return;
}
while( (N--)>0 ) p->zText[p->nChar++] = c;
}