database/sqlite
1
0
Fork 0
mirror of https://github.com/sqlite/sqlite.git synced 2025-08-10 01:02:56 +03:00
Code Activity

Avoid a buffer overread when comparing against a corrupt record that spans at least one overflow page.

Browse Source 
FossilOrigin-Name: 62a5b3633a086694ef0e579a0a82322cb1ae3d60
This commit is contained in:
dan
2015-05-26 20:31:20 +00:00
parent cc7aa1f6f3
commit b95e1193d5
4 changed files with 15 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
manifest
View File

@@ -1,5 +1,5 @@
C Avoid\sbranching\son\san\suninitalized\svariable\swhen\scomparing\sSQL\svalues\swith\sthe\sundefined\sserial\stypes\s10\sand\s11\s(which\sonly\sappear\sin\scorrupt\sdatabases). C Avoid\sa\sbuffer\soverread\swhen\scomparing\sagainst\sa\scorrupt\srecord\sthat\sspans\sat\sleast\sone\soverflow\spage.
D 2015-05-26T20:07:32.939 D 2015-05-26T20:31:20.007
F Makefile.arm-wince-mingw32ce-gcc d6df77f1f48d690bd73162294bbba7f59507c72f F Makefile.arm-wince-mingw32ce-gcc d6df77f1f48d690bd73162294bbba7f59507c72f
F Makefile.in 3feb7cbdad8898fe7a8a24355b4a753029c3ec3b F Makefile.in 3feb7cbdad8898fe7a8a24355b4a753029c3ec3b
F Makefile.linux-gcc 91d710bdc4998cb015f39edf3cb314ec4f4d7e23 F Makefile.linux-gcc 91d710bdc4998cb015f39edf3cb314ec4f4d7e23
@@ -192,7 +192,7 @@ F src/auth.c b56c78ebe40a2110fd361379f7e8162d23f92240
F src/backup.c ff743689c4d6c5cb55ad42ed9d174b2b3e71f1e3 F src/backup.c ff743689c4d6c5cb55ad42ed9d174b2b3e71f1e3
F src/bitvec.c 5eb7958c3bf65210211cbcfc44eff86d0ded7c9d F src/bitvec.c 5eb7958c3bf65210211cbcfc44eff86d0ded7c9d
F src/btmutex.c 45a968cc85afed9b5e6cf55bf1f42f8d18107f79 F src/btmutex.c 45a968cc85afed9b5e6cf55bf1f42f8d18107f79
F src/btree.c 82bb9ad936fc513682a68f6d9444011266e6b459 F src/btree.c 51cafeb18184dcb46285120d5574da6e19c58362
F src/btree.h 969adc948e89e449220ff0ff724c94bb2a52e9f1 F src/btree.h 969adc948e89e449220ff0ff724c94bb2a52e9f1
F src/btreeInt.h 973a22a6fd61350b454ad614832b1f0a5e25a1e4 F src/btreeInt.h 973a22a6fd61350b454ad614832b1f0a5e25a1e4
F src/build.c 9552e7490b0310a8c73fcf3a0c36e7624789d8df F src/build.c 9552e7490b0310a8c73fcf3a0c36e7624789d8df
@@ -316,7 +316,7 @@ F src/vdbe.c 6aee8a041742413ab3113e6682bc7ad1628a2bbe
F src/vdbe.h 7e538ecf47dccb307ea2d087c3ddc2dd8d70e79d F src/vdbe.h 7e538ecf47dccb307ea2d087c3ddc2dd8d70e79d
F src/vdbeInt.h f0ccddac48583d5f762dc554a9f79e85ea8807e0 F src/vdbeInt.h f0ccddac48583d5f762dc554a9f79e85ea8807e0
F src/vdbeapi.c 6a0d7757987018ff6b1b81bc5293219cd26bb299 F src/vdbeapi.c 6a0d7757987018ff6b1b81bc5293219cd26bb299
F src/vdbeaux.c d3e4b36e6e6a7ada756993f1a0c7c89f2183fcf1 F src/vdbeaux.c 46f9bc4b32866082eb87a36b461e487a0bbdbe8e
F src/vdbeblob.c 4f2e8e075d238392df98c5e03a64342465b03f90 F src/vdbeblob.c 4f2e8e075d238392df98c5e03a64342465b03f90
F src/vdbemem.c 21f9169289a804308f6cdde55e9417fb8336997f F src/vdbemem.c 21f9169289a804308f6cdde55e9417fb8336997f
F src/vdbesort.c f5009e7a35e3065635d8918b9a31f498a499976b F src/vdbesort.c f5009e7a35e3065635d8918b9a31f498a499976b
@@ -1279,7 +1279,7 @@ F tool/vdbe_profile.tcl 67746953071a9f8f2f668b73fe899074e2c6d8c1
F tool/warnings-clang.sh f6aa929dc20ef1f856af04a730772f59283631d4 F tool/warnings-clang.sh f6aa929dc20ef1f856af04a730772f59283631d4
F tool/warnings.sh 0abfd78ceb09b7f7c27c688c8e3fe93268a13b32 F tool/warnings.sh 0abfd78ceb09b7f7c27c688c8e3fe93268a13b32
F tool/win/sqlite.vsix deb315d026cc8400325c5863eef847784a219a2f F tool/win/sqlite.vsix deb315d026cc8400325c5863eef847784a219a2f
P 5e3e410bf49a29efbf9ff3ef048e158804ca0027 P b4a45d3b78fede2433ac18f20b1ab7bddee77059
R f39b315003c60aaa407135f808ae9f63 R f36cc3a04ab23b9a0c27493daaf0c4c0
U dan U dan
Z bbb0b6475f661c6ff9c98c6db1ebf479 Z 4ff3966eaffa78ba4bc7061be84a775f

2
manifest.uuid
View File

@@ -1 +1 @@
b4a45d3b78fede2433ac18f20b1ab7bddee77059 62a5b3633a086694ef0e579a0a82322cb1ae3d60

8
src/btree.c
View File

@@ -4951,18 +4951,22 @@ int sqlite3BtreeMovetoUnpacked(
/* The record flows over onto one or more overflow pages. In /* The record flows over onto one or more overflow pages. In
** this case the whole cell needs to be parsed, a buffer allocated ** this case the whole cell needs to be parsed, a buffer allocated
** and accessPayload() used to retrieve the record into the ** and accessPayload() used to retrieve the record into the
** buffer before VdbeRecordCompare() can be called. */ ** buffer before VdbeRecordCompare() can be called. An extra
** byte of zeroed padding is allocated at the end of the buffer,
** as this stops the record-compare routines from reading past
** the end of the buffer if the record is corrupt. */
void *pCellKey; void *pCellKey;
u8 * const pCellBody = pCell - pPage->childPtrSize; u8 * const pCellBody = pCell - pPage->childPtrSize;
btreeParseCellPtr(pPage, pCellBody, &pCur->info); btreeParseCellPtr(pPage, pCellBody, &pCur->info);
nCell = (int)pCur->info.nKey; nCell = (int)pCur->info.nKey;
pCellKey = sqlite3Malloc( nCell ); pCellKey = sqlite3Malloc( nCell+1 );
if( pCellKey==0 ){ if( pCellKey==0 ){
rc = SQLITE_NOMEM; rc = SQLITE_NOMEM;
goto moveto_finish; goto moveto_finish;
} }
pCur->aiIdx[pCur->iPage] = (u16)idx; pCur->aiIdx[pCur->iPage] = (u16)idx;
rc = accessPayload(pCur, 0, nCell, (unsigned char*)pCellKey, 2); rc = accessPayload(pCur, 0, nCell, (unsigned char*)pCellKey, 2);
((unsigned char *)pCellKey)[nCell] = 0;
if( rc ){ if( rc ){
sqlite3_free(pCellKey); sqlite3_free(pCellKey);
goto moveto_finish; goto moveto_finish;

2
src/vdbeaux.c
View File

@@ -3651,7 +3651,7 @@ int sqlite3VdbeRecordCompareWithSkip(
if( pRhs->flags & MEM_Int ){ if( pRhs->flags & MEM_Int ){
serial_type = aKey1[idx1]; serial_type = aKey1[idx1];
testcase( serial_type==12 ); testcase( serial_type==12 );
if( serial_type>=12 ){ if( serial_type>=10 ){
rc = +1; rc = +1;
}else if( serial_type==0 ){ }else if( serial_type==0 ){
rc = -1; rc = -1;