From ec1ee47f4cf00cf3abe98dcdbbc320dc667b940a Mon Sep 17 00:00:00 2001
From: drh <>
Date: Tue, 18 Aug 2026 00:30:58 +0000
Subject: [PATCH] Declare fts5 structure records corrupt if they contain a page
 number greater than 0x7FFFFF00.

FossilOrigin-Name: 14be580d240496f1615dad42c5442443c0629f3aff6ba8ac77485992d5e8d625
---
 ext/fts5/fts5_index.c           |  9 +++++++--
 ext/fts5/test/fts5corruptB.test | 34 +++++++++++++++++++++++++++++++++
 manifest                        | 16 ++++++++--------
 manifest.uuid                   |  2 +-
 4 files changed, 50 insertions(+), 11 deletions(-)

diff --git a/ext/fts5/fts5_index.c b/ext/fts5/fts5_index.c
index 7758f18a3e..ac32d2c622 100644
--- a/ext/fts5/fts5_index.c
+++ b/ext/fts5/fts5_index.c
@@ -285,7 +285,12 @@
 #define FTS5_DATA_ID_B     16     /* Max seg id number 65535 */
 #define FTS5_DATA_DLI_B     1     /* Doclist-index flag (1 bit) */
 #define FTS5_DATA_HEIGHT_B  5     /* Max dlidx tree height of 32 */
-#define FTS5_DATA_PAGE_B   31     /* Max page number of 2147483648 */
+#define FTS5_DATA_PAGE_B   31     /* 31-bit page numbers */
+
+/* Maximum page number within a segment. Declare any structure read from
+** the database with a page number greater than this corrupt. It is not
+** actually possible to create a database this large.  */
+#define FTS5_MAX_PGNO 0x7FFFFF00
 
 #define fts5_dri(segid, dlidx, height, pgno) (                                 \
  ((i64)(segid)  << (FTS5_DATA_PAGE_B+FTS5_DATA_HEIGHT_B+FTS5_DATA_DLI_B)) +    \
@@ -1198,7 +1203,7 @@ static int fts5StructureDecode(
             i += fts5GetVarint(&pData[i], &pSeg->nEntry);
             nOriginCntr = MAX(nOriginCntr, pSeg->iOrigin2);
           }
-          if( pSeg->pgnoLast<pSeg->pgnoFirst ){
+          if( pSeg->pgnoLast<pSeg->pgnoFirst || pSeg->pgnoLast>FTS5_MAX_PGNO ){
             rc = FTS5_CORRUPT;
             break;
           }
diff --git a/ext/fts5/test/fts5corruptB.test b/ext/fts5/test/fts5corruptB.test
index 0567b50e2b..d3c4af1c44 100644
--- a/ext/fts5/test/fts5corruptB.test
+++ b/ext/fts5/test/fts5corruptB.test
@@ -2743,5 +2743,39 @@ do_catchsql_test 4.1 {
   DELETE FROM t WHERE rowid = 1;
 } {1 {fts5: corruption in table "t"}}
 
+#-------------------------------------------------------------------------
+reset_db
+do_execsql_test 5.0 {
+  CREATE VIRTUAL TABLE x1 USING fts5(c);
+  INSERT INTO x1 VALUES('yellow brick road');
+  INSERT INTO x1 VALUES('one two three');
+  INSERT INTO x1 VALUES('not at this hour');
+}
+
+db close
+sqlite3 db test.db
+
+do_execsql_test 5.1 {
+  SELECT quote(block) FROM x1_data WHERE id=10
+} {
+  X'000000000103030003010101020101030101'
+}
+
+do_execsql_test 5.2 {
+  SELECT rowid FROM x1('two');
+} {2}
+
+do_execsql_test 5.3 {
+  UPDATE x1_data SET block = X'000000000103030003010187FFFFFF7F020101030101'
+}
+
+db close
+sqlite3 db test.db
+
+do_catchsql_test 5.4 {
+  SELECT rowid FROM x1('two');
+} {1 {fts5: corrupt structure record for table "x1"}}
+
+
 sqlite3_fts5_may_be_corrupt 0
 finish_test
diff --git a/manifest b/manifest
index 594ad42322..30e568c694 100644
--- a/manifest
+++ b/manifest
@@ -1,5 +1,5 @@
-C Avoid\sa\sproblem\scausing\sa\suse-after-free\sin\sthe\sfts3\ssnippet()\sfunction.
-D 2026-08-18T00:23:42.757
+C Declare\sfts5\sstructure\srecords\scorrupt\sif\sthey\scontain\sa\spage\snumber\sgreater\sthan\s0x7FFFFF00.
+D 2026-08-18T00:30:58.486
 F .fossil-settings/binary-glob 61195414528fb3ea9693577e1980230d78a1f8b0a54c78cf1b9b24d0a409ed6a x
 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
@@ -113,7 +113,7 @@ F ext/fts5/fts5_buffer.c dcc3f0352339fe79c9d8abbc1c2009bc3469206467880bf43558447
 F ext/fts5/fts5_config.c bfba970fe1e4eed18ee57c8d51458e226db9a960ddf775c5e50e3d76603a667e
 F ext/fts5/fts5_expr.c b906c59e9e842805cc3eea4e131b822e586bb01260e542f67920c61798dcb53d
 F ext/fts5/fts5_hash.c d5871df92ce3fa210a650cf419ee916b87c29977e86084d06612edf772bff6f5
-F ext/fts5/fts5_index.c 8653118c670d70b9c9ca8feddf843896d40a56deead9fecc5446065967754026
+F ext/fts5/fts5_index.c 4080ebf295b0d9076e49b6a1903aa26a4d5fd34f94f34c8e169e5609e855f3ca
 F ext/fts5/fts5_main.c 7819fc80808a135c3ad7bec65071a053827d1e8fe7b77ddfd734ed451c2db7a9
 F ext/fts5/fts5_storage.c 46b0024fdd8002fbfba162230e5cc212c8f019ba4075396860354bfaf549a546
 F ext/fts5/fts5_tcl.c 2be6cc14f9448f720fd4418339cd202961a0801ea9424cb3d9de946f8f5a051c
@@ -170,7 +170,7 @@ F ext/fts5/test/fts5corrupt7.test 9664c15360e8b649ad76f457a0bbf5a7271b8eff1a8ee1
 F ext/fts5/test/fts5corrupt8.test 0b10750caf8aa23fa1c379ca4caf6130d41454505e4d5315590f4061eedcbe44
 F ext/fts5/test/fts5corrupt9.test 4253b9b59f33effac8b67da72ec34309c738aca2d5e8e2656bfbbd6a489a1dfe
 F ext/fts5/test/fts5corruptA.test 50b48f15548a3466dbd17000956ee86c2eb7d18d5a649bc11126ec917113b807
-F ext/fts5/test/fts5corruptB.test 3bd904aeeb7e69c290e1c0d045c7e97505d79b782f12578f2b351c021a31c55b
+F ext/fts5/test/fts5corruptB.test 6625ad7c6a77b5e036939231331a0ed79cb2d20e94ea99b1611dc3ad8d04a3be
 F ext/fts5/test/fts5corruptbig.test 9f95b40fa36e292feceab02b2ef06e21878bfa1ac7afefa138aae05518b51774
 F ext/fts5/test/fts5delete.test 2a5008f8b1174ef41d1974e606928c20e4f9da77d9f8347aed818994d89cced4
 F ext/fts5/test/fts5detail.test 54015e9c43ec4ba542cfb93268abdf280e0300f350efd08ee411284b03595cc4
@@ -2206,9 +2206,9 @@ F tool/warnings-clang.sh bbf6a1e685e534c92ec2bfba5b1745f34fb6f0bc2a362850723a9ee
 F tool/warnings.sh a554d13f6e5cf3760f041b87939e3d616ec6961859c3245e8ef701d1eafc2ca2
 F tool/win/sqlite.vsix deb315d026cc8400325c5863eef847784a219a2f
 F tool/winmain.c 00c8fb88e365c9017db14c73d3c78af62194d9644feaf60e220ab0f411f3604c
-P f7371f41f96f5b94d037c073863fe94ed8f1f7b9bb050d2d0405e162fcafa318
-Q +e4635c41536a0b3620780c3f1c872de33121370bafb608fce9fe7e3113e2ae01
-R 360c4de72a0ac88269798e9446518048
+P 9a367c177f4cf7b065e0361ef848ffb2eb4956ef94084f440bc07958ef076bf5
+Q +c97a940ceb4c21adc68123e084c8b8b688bcd309579a82951b2e160dc7bacf44
+R a42968ea2a15288b2f7cde30db8fc6c5
 U drh
-Z b6bfa6187f8f85ff6173e4c52d684804
+Z 7fb5b1b193d7fb73656011a0d4d273b3
 # Remove this line to create a well-formed Fossil manifest.
diff --git a/manifest.uuid b/manifest.uuid
index 2a44d16be4..5f20d3c4fb 100644
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-9a367c177f4cf7b065e0361ef848ffb2eb4956ef94084f440bc07958ef076bf5
+14be580d240496f1615dad42c5442443c0629f3aff6ba8ac77485992d5e8d625