Fix two instances where a malformed header in a database file (in other words

a corrupt database file) can lead to an assertion fault. (CVS 6712)

FossilOrigin-Name: 4e92c7f20afa51849128aa1d784ab885b517a73d

manifest

@@ -1,5 +1,5 @@
-C Change\sthe\spcache1.c\simplementation\sso\sthat\sthe\s"header"\soccurs\sat\sthe\send\nof\spage\sbuffer,\snot\sat\sthe\sbeginning.\s\sThis\sinsures\sthat\sthe\s20\sbytes\nimmediately\sfollowing\sthe\spage\sbuffer\sare\smapped\sif\sa\sread\sof\sthe\spage\nbuffer\soverruns\sdue\sto\sa\smalformed\scell.\s(CVS\s6711)
-D 2009-06-03T21:04:36
+C Fix\stwo\sinstances\swhere\sa\smalformed\sheader\sin\sa\sdatabase\sfile\s(in\sother\swords\na\scorrupt\sdatabase\sfile)\scan\slead\sto\san\sassertion\sfault.\s(CVS\s6712)
+D 2009-06-04T00:11:56
 F Makefile.arm-wince-mingw32ce-gcc fcd5e9cd67fe88836360bb4f9ef4cb7f8e2fb5a0
 F Makefile.in 8b8fb7823264331210cddf103831816c286ba446
 F Makefile.linux-gcc d53183f4aa6a9192d249731c90dbdffbd2c68654
@@ -106,7 +106,7 @@ F src/auth.c 98db07c2088455797678eb1031f42d4d94d18a71
 F src/backup.c ff50af53184a5fd7bdee4d620b5dabef74717c79
 F src/bitvec.c 0ef0651714728055d43de7a4cdd95e703fac0119
 F src/btmutex.c 9b899c0d8df3bd68f527b0afe03088321b696d3c
-F src/btree.c f8636b7a6fdd0fef8087bbc7dcd64962e40af691
+F src/btree.c 708b9373d573aeb6c61899ed2fcc498a98a20b12
 F src/btree.h f70b694e8c163227369a66863b01fbff9009f323
 F src/btreeInt.h df64030d632f8c8ac217ed52e8b6b3eacacb33a5
 F src/build.c 20e02fd72249159ff6829009f3029d16d59cdff5
@@ -153,7 +153,7 @@ F src/pcache.c 395f752a13574120bd7513a400ba02a265aaa76d
 F src/pcache.h 9b927ccc5a538e31b4c3bc7eec4f976db42a1324
 F src/pcache1.c 3de4feb556a11a62febe172ca98655dff68a0df3
 F src/pragma.c 06b3a4b93a5e587f1c04b4a40016eb360792cdf3
-F src/prepare.c c98c1d306ef72dd448ecbc3c52624439c72ad413
+F src/prepare.c 889208e3567a98bb3d345a30f63240beb9ac90f9
 F src/printf.c 508a1c59433353552b6553cba175eaa7331f8fc1
 F src/random.c 676b9d7ac820fe81e6fb2394ac8c10cff7f38628
 F src/resolve.c f86d3490cf93a12f8a451720defc622cbc79873a
@@ -733,7 +733,7 @@ F tool/speedtest2.tcl ee2149167303ba8e95af97873c575c3e0fab58ff
 F tool/speedtest8.c 2902c46588c40b55661e471d7a86e4dd71a18224
 F tool/speedtest8inst1.c 293327bc76823f473684d589a8160bde1f52c14e
 F tool/vdbe-compress.tcl 672f81d693a03f80f5ae60bfefacd8a349e76746
-P 7fa5d3cb0fa05f7d901bcc139c2c037ce5944caa
-R 239128eec97f3bd718312f4ed9a40574
+P c54de1f54080de7e134d7b562498abb5337a0a46
+R 7496aea7018fc89b15559ae6cbed5102
 U drh
-Z 51f7f97ff293b0e414ff2ed7ce212f49
+Z 1fb96255d6fa155bab373917c29f3303

manifest.uuid

@@ -1 +1 @@
-c54de1f54080de7e134d7b562498abb5337a0a46
+4e92c7f20afa51849128aa1d784ab885b517a73d

src/btree.c

@@ -9,7 +9,7 @@
 **    May you share freely, never taking more than you give.
 **
 *************************************************************************
-** $Id: btree.c,v 1.612 2009/06/03 21:04:36 drh Exp $
+** $Id: btree.c,v 1.613 2009/06/04 00:11:56 drh Exp $
 **
 ** This file implements a external (disk-based) database using BTrees.
 ** See the header comment on "btreeInt.h" for additional information.
@@ -2686,6 +2686,7 @@ static int autoVacuumCommit(BtShared *pBt){
     while( PTRMAP_ISPAGE(pBt, nFin) || nFin==PENDING_BYTE_PAGE(pBt) ){
       nFin--;
     }
+    if( nFin>nOrig ) return SQLITE_CORRUPT_BKPT;
 
     for(iFree=nOrig; iFree>nFin && rc==SQLITE_OK; iFree--){
       rc = incrVacuumStep(pBt, nFin, iFree);

src/prepare.c

@@ -13,7 +13,7 @@
 ** interface, and routines that contribute to loading the database schema
 ** from disk.
 **
-** $Id: prepare.c,v 1.120 2009/06/03 11:25:07 danielk1977 Exp $
+** $Id: prepare.c,v 1.121 2009/06/04 00:11:56 drh Exp $
 */
 #include "sqliteInt.h"
 
@@ -247,8 +247,11 @@ static int sqlite3InitOne(sqlite3 *db, int iDb, char **pzErrMsg){
   */
   if( meta[BTREE_TEXT_ENCODING-1] ){  /* text encoding */
     if( iDb==0 ){
+      u8 encoding;
       /* If opening the main database, set ENC(db). */
-      ENC(db) = (u8)meta[BTREE_TEXT_ENCODING-1];
+      encoding = (u8)meta[BTREE_TEXT_ENCODING-1] & 3;
+      if( encoding==0 ) encoding = SQLITE_UTF8;
+      ENC(db) = encoding;
       db->pDfltColl = sqlite3FindCollSeq(db, SQLITE_UTF8, "BINARY", 0);
     }else{
       /* If opening an attached database, the encoding much match ENC(db) */