database/sqlite
1
0
Fork 0
mirror of https://github.com/sqlite/sqlite.git synced 2026-10-23 21:49:02 +03:00
Code Activity

Avoid a problem causing a use-after-free in the fts3 snippet() function. Report [bugs:/info/2026-08-17T09:18:24Z | 2026-08-17T09:18:24Z].

Browse Source 
FossilOrigin-Name: e4635c41536a0b3620780c3f1c872de33121370bafb608fce9fe7e3113e2ae01
This commit is contained in:
dan
2026-08-17 13:55:38 +00:00
parent 0085ea1443
commit a87bd2471a
4 changed files with 27 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
ext/fts3/fts3_snippet.c
View File

@@ -528,6 +528,7 @@ static int fts3BestSnippet(
sqlite3_int64 nByte; /* Number of bytes of space to allocate */
int iBestScore = -1; /* Best snippet score found so far */
int i; /* Loop counter */
Fts3Expr *pExpr = pCsr->pExpr;
memset(&sIter, 0, sizeof(sIter));
@@ -556,9 +557,12 @@ static int fts3BestSnippet(
sIter.nSnippet = nSnippet;
sIter.nPhrase = nList;
sIter.iCurrent = -1;
rc = sqlite3Fts3ExprIterate(
pCsr->pExpr, fts3SnippetFindPositions, (void*)&sIter
);
rc = sqlite3Fts3ExprIterate(pExpr, fts3SnippetFindPositions, (void*)&sIter);
if( rc==SQLITE_OK ){
/* Iterate through the expression twice, in case pointers garnered during
** the first iteration are invalidated by a call to fts5EvalRestart(). */
rc = sqlite3Fts3ExprIterate(pExpr, fts3SnippetFindPositions, (void*)&sIter);
}
if( rc==SQLITE_OK ){
/* Set the *pmSeen output variable. */

14
manifest
View File

@@ -1,5 +1,5 @@
C Have\sthe\sfts5term\sand\sfts3aux\svirtual\stable\smodules\sonly\sprocess\sconstraints\son\sthe\sterm\scolumn\sthat\suse\sbinary\scollation.\sReport\s[bugs:/info/2026-08-17T10:17:15Z\s|\s2026-08-17T10:17:15Z].
D 2026-08-17T11:52:13.215
C Avoid\sa\sproblem\scausing\sa\suse-after-free\sin\sthe\sfts3\ssnippet()\sfunction.\sReport\s[bugs:/info/2026-08-17T09:18:24Z\s|\s2026-08-17T09:18:24Z].
D 2026-08-17T13:55:38.695
F .fossil-settings/binary-glob 61195414528fb3ea9693577e1980230d78a1f8b0a54c78cf1b9b24d0a409ed6a x
F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
@@ -89,7 +89,7 @@ F ext/fts3/fts3_hash.c d9dba473741445789330c7513d4f65737c92df23c3212784312931641
F ext/fts3/fts3_hash.h 39cf6874dc239d6b4e30479b1975fe5b22a3caaf
F ext/fts3/fts3_icu.c 305ce7fb6036484085b5556a9c8e62acdc7763f0f4cdf5fd538212a9f3720116
F ext/fts3/fts3_porter.c 024417020c57dd1ab39816f5fe6cf45222a857b78a1f6412f040ada1ceabd4ff
F ext/fts3/fts3_snippet.c 268f9d21d7cbd5f71017663c3a8c222927ec0f0c3ce4643c13326c2b0512015d
F ext/fts3/fts3_snippet.c 69d1e4011a3becbf179e62aadf40e78bb40818a3f705fbac25ba277c14df6df4
F ext/fts3/fts3_term.c 6a96027ad364001432545fe43322b6af04ed28bb5619ec51af1f59d0710d6d69
F ext/fts3/fts3_test.c cc329471e573f95a6ea9fbca87e89dcfa1d355591c80172ffcd759ac521d25d8
F ext/fts3/fts3_tokenize_vtab.c 66eba6c2baa04b2b15e80d68341b8fd0b4d3831f6b2edb33916a2906ff2d4389
@@ -1216,7 +1216,7 @@ F test/fts3rank.test cd99bc83a3c923c8d52afd90d86979cf05fc41849f892faeac3988055ef
F test/fts3rnd.test 1320d8826a845e38a96e769562bf83d7a92a15d0
F test/fts3shared.test 57e26a801f21027b7530da77db54286a6fe4997e
F test/fts3snippet.test 86486f9c797aa1b81c7397d98fb7ec4e55dfca8724365fc415413dfa829ebc8a
F test/fts3snippet2.test 03f6738ab3897bea2ba6be424a0613872e167acbf37a66200d655d737b470f65
F test/fts3snippet2.test 3e5c98b29af10b58a2555920a20488be94b58b3503841aca0cdcacdb153614ac
F test/fts3sort.test ed34c716a11cc2009a35210e84ad5f9c102362ca
F test/fts3tok1.test a663f4cac22a9505400bc22aacb818d7055240409c28729669ea7d4cc2120d15
F test/fts3tok_err.test 52273cd193b9036282f7bacb43da78c6be87418d
@@ -2219,8 +2219,8 @@ F tool/warnings-clang.sh bbf6a1e685e534c92ec2bfba5b1745f34fb6f0bc2a362850723a9ee
F tool/warnings.sh a554d13f6e5cf3760f041b87939e3d616ec6961859c3245e8ef701d1eafc2ca2
F tool/win/sqlite.vsix deb315d026cc8400325c5863eef847784a219a2f
F tool/winmain.c 00c8fb88e365c9017db14c73d3c78af62194d9644feaf60e220ab0f411f3604c
P 3f57024aecea0f3b565ed823cf94b085031c481fd6323c1f2e4319a53500864f
R e9a26de1424db0cd5c713b00df65f12d
P f26099b7fad1eab2791b574c9371021d4f05fbf824141e77cdff921a2819866a
R 6d39d056cf4751746ef7730743a7481a
U dan
Z 5f0114a283a0789bdf677ba42e3ed035
Z a4b7ddd4532af1e1ba2c611ad918a2fd
# Remove this line to create a well-formed Fossil manifest.

2
manifest.uuid
View File

@@ -1 +1 @@
f26099b7fad1eab2791b574c9371021d4f05fbf824141e77cdff921a2819866a
e4635c41536a0b3620780c3f1c872de33121370bafb608fce9fe7e3113e2ae01

12
test/fts3snippet2.test
View File

@@ -66,5 +66,17 @@ do_execsql_test 3.1 {
SELECT length(snippet(f)) FROM f WHERE b MATCH x'0565056505650565056505650565056505650565058405800565056505650565056505651e650565056505650565056505650d056505056565056505650565056505840580056505650565056505650565056505650565056505650565050565056505640565056505650565056505651e05650565056522650565056505650d051e056505650565286505650565056505056505650565056505650565056505650565056505650565056505656505650565056505650d05650505656505650565ef65056505844c746e65650565056505650565056505650565056505650565058405800565056505650565056505651e650565056505650565056505650d056505056565056505650565056505840580056505650565056f05650565056505650565056505650565050565056505640565056505650565056505651e05650565056505650565056505650505656565056505650565056505651e0565056505650565056505650565052265056505650569056505650565056505650565056505650565056505650500406505650565056505650565056505000101e5c501014b010101c501c5c501010101f50102010101010141010141010001017bf15905000000000017';
} {192}
#-------------------------------------------------------------------------
reset_db
do_execsql_test 4.0 {
CREATE VIRTUAL TABLE ft0 USING fts4;
INSERT INTO ft0 VALUES('0*bbb a');
}
do_execsql_test 4.1 {
SELECT snippet(ft0,'') FROM ft0 WHERE ft0 MATCH '"a" OR "" bbb NEAR 0 NEAR 1';
} {{0</b>*bbb</b> a</b>}}
set sqlite_fts3_enable_parentheses 0
finish_test