1
0
mirror of https://github.com/sqlite/sqlite.git synced 2025-08-05 15:55:57 +03:00

Earlier detection of a database corruption case in balance_nonroot(), to

prevent a possible use of an uninitialized variable.

FossilOrigin-Name: c509d8a8aebe0da4847e95cf737c21313a665de9a540da2db57b8ed22f98a402
This commit is contained in:
drh
2019-05-02 15:56:39 +00:00
parent cf1747b782
commit e12ca5abf6
3 changed files with 13 additions and 7 deletions

View File

@@ -7636,6 +7636,7 @@ static int balance_nonroot(
u16 maskPage = pOld->maskPage;
u8 *piCell = aData + pOld->cellOffset;
u8 *piEnd;
VVA_ONLY( int nCellAtStart = b.nCell; )
/* Verify that all sibling pages are of the same "type" (table-leaf,
** table-interior, index-leaf, or index-interior).
@@ -7664,6 +7665,10 @@ static int balance_nonroot(
*/
memset(&b.szCell[b.nCell], 0, sizeof(b.szCell[0])*(limit+pOld->nOverflow));
if( pOld->nOverflow>0 ){
if( limit<pOld->aiOvfl[0] ){
rc = SQLITE_CORRUPT_BKPT;
goto balance_cleanup;
}
limit = pOld->aiOvfl[0];
for(j=0; j<limit; j++){
b.apCell[b.nCell] = aData + (maskPage & get2byteAligned(piCell));
@@ -7683,6 +7688,7 @@ static int balance_nonroot(
piCell += 2;
b.nCell++;
}
assert( (b.nCell-nCellAtStart)==(pOld->nCell+pOld->nOverflow) );
cntOld[i] = b.nCell;
if( i<nOld-1 && !leafData){