Fix some trivial cases where database corruption was causing an error code other than SQLITE_CORRUPT to be returned. (CVS 5690)

FossilOrigin-Name: 89fda074f6b4959c32f1083badba3c73cffb4995

manifest

@@ -1,5 +1,5 @@
-C Fix\sfor\shandling\sdatabase\sfiles\scorrupted\sin\ssuch\sa\swas\sas\sto\smake\sa\sb-tree\spage\sa\sdirect\sor\sindirect\sdescendant\sof\sitself.\s(CVS\s5689)
-D 2008-09-10T14:45:58
+C Fix\ssome\strivial\scases\swhere\sdatabase\scorruption\swas\scausing\san\serror\scode\sother\sthan\sSQLITE_CORRUPT\sto\sbe\sreturned.\s(CVS\s5690)
+D 2008-09-10T17:53:36
 F Makefile.arm-wince-mingw32ce-gcc fcd5e9cd67fe88836360bb4f9ef4cb7f8e2fb5a0
 F Makefile.in d15a7ebfe5e057a72a49805ffb302dbb601c8329
 F Makefile.linux-gcc d53183f4aa6a9192d249731c90dbdffbd2c68654
@@ -99,7 +99,7 @@ F src/attach.c db3f4a60538733c1e4dcb9d0217a6e0d6ccd615b
 F src/auth.c c8b2ab5c8bad4bd90ed7c294694f48269162c627
 F src/bitvec.c 95c86bd18d8fedf0533f5af196192546e10a7e7d
 F src/btmutex.c 709cad2cdca0afd013f0f612363810e53f59ec53
-F src/btree.c 9e11a68fe66c751668e9fcd1b54c88d60f832b47
+F src/btree.c 5419fcd2faa02b7759051495a5e339444c679205
 F src/btree.h 6371c5e599fab391a150c96afbc10062b276d107
 F src/btreeInt.h ab18c7b4980314e9e4b402e5dcde09f3c2545576
 F src/build.c 160c71acca8f643f436ed6c1ee2f684c88df4dfe
@@ -262,7 +262,7 @@ F test/corrupt7.test 7a3be79b93dba88ba8472d61b57cb6d7b66cb69e
 F test/corrupt8.test 9992ef7f67cefc576b92373f6bf5ab8775280f51
 F test/corrupt9.test 794d284109c65c8f10a2b275479045e02d163bae
 F test/corruptA.test 99e95620b980161cb3e79f06a884a4bb8ae265ff
-F test/corruptB.test 547c5f96a6c2b6d316f4b888c2d8186fc186579f
+F test/corruptB.test 505331779fe7a96fe38ecbb817f19c63bc27d171
 F test/crash.test 1b6ac8410689ff78028887f445062dc897c9ac89
 F test/crash2.test 5b14d4eb58b880e231361d3b609b216acda86651
 F test/crash3.test 776f9363554c029fcce71d9e6600fa0ba6359ce7
@@ -354,7 +354,7 @@ F test/fts3near.test 2d4dadcaac5025ab65bb87e66c45f39e92966194
 F test/func.test 628dc9b321fc66dd6d055fca6525e157004744e1
 F test/fuzz.test 62fc19dd36a427777fd671b569df07166548628a
 F test/fuzz2.test ea38692ce2da99ad79fe0be5eb1a452c1c4d37bb
-F test/fuzz3.test 5fa227c60207a18077d629144a178dd83a4ec8b9
+F test/fuzz3.test 3856b9340b801671424ff0c581ef74342962aa7d
 F test/fuzz_common.tcl ff4bc2dfc465f6878f8e2d819620914365382731
 F test/fuzz_malloc.test 4eca9d345f06d5b0b0105f7a2ef9e7f22658827b
 F test/hook.test e17d4ed2843ba4ef9b234aa63e6f056bf88f9a19
@@ -635,7 +635,7 @@ F tool/speedtest16.c c8a9c793df96db7e4933f0852abb7a03d48f2e81
 F tool/speedtest2.tcl ee2149167303ba8e95af97873c575c3e0fab58ff
 F tool/speedtest8.c 1dbced29de5f59ba2ebf877edcadf171540374d1
 F tool/speedtest8inst1.c 293327bc76823f473684d589a8160bde1f52c14e
-P edd80811d702bc0d7a25199d193c04ea057df4de
-R 86a7c41a00b3787bf3d3b2cfbbdffc97
+P 93545861a70c190d67b0d1effdd8fe038d28811c
+R ca5d96095f41db68c113b9e97492618c
 U danielk1977
-Z 5931af1cdd92a17ee908521206422339
+Z 9e0933fb92abc116c50b0b29f1654435

manifest.uuid

@@ -1 +1 @@
-93545861a70c190d67b0d1effdd8fe038d28811c
+89fda074f6b4959c32f1083badba3c73cffb4995

src/btree.c

@@ -9,7 +9,7 @@
 **    May you share freely, never taking more than you give.
 **
 *************************************************************************
-** $Id: btree.c,v 1.510 2008/09/10 14:45:58 danielk1977 Exp $
+** $Id: btree.c,v 1.511 2008/09/10 17:53:36 danielk1977 Exp $
 **
 ** This file implements a external (disk-based) database using BTrees.
 ** See the header comment on "btreeInt.h" for additional information.
@@ -1085,6 +1085,17 @@ int sqlite3BtreeGetPage(
   return SQLITE_OK;
 }
 
+/*
+** Return the size of the database file in pages.  Or return -1 if
+** there is any kind of error.
+*/
+static int pagerPagecount(Pager *pPager){
+  int rc;
+  int nPage;
+  rc = sqlite3PagerPagecount(pPager, &nPage);
+  return (rc==SQLITE_OK?nPage:-1);
+}
+
 /*
 ** Get a page from the pager and initialize it.  This routine
 ** is just a convenience wrapper around separate calls to
@@ -1099,7 +1110,7 @@ static int getAndInitPage(
   int rc;
   assert( sqlite3_mutex_held(pBt->mutex) );
   assert( !pParent || pParent->isInit );
-  if( pgno==0 ){
+  if( pgno==0 || pgno>pagerPagecount(pBt->pPager) ){
     return SQLITE_CORRUPT_BKPT; 
   }
   rc = sqlite3BtreeGetPage(pBt, pgno, ppPage, 0);
@@ -2029,17 +2040,6 @@ trans_begun:
   return rc;
 }
 
-/*
-** Return the size of the database file in pages.  Or return -1 if
-** there is any kind of error.
-*/
-static int pagerPagecount(Pager *pPager){
-  int rc;
-  int nPage;
-  rc = sqlite3PagerPagecount(pPager, &nPage);
-  return (rc==SQLITE_OK?nPage:-1);
-}
-
 
 #ifndef SQLITE_OMIT_AUTOVACUUM
 
@@ -3184,7 +3184,7 @@ static int accessPayload(
   }
   if( offset+amt > nKey+pCur->info.nData ){
     /* Trying to read or write past the end of the data is an error */
-    return SQLITE_ERROR;
+    return SQLITE_CORRUPT_BKPT;
   }
 
   /* Check if data must be read/written to/from the btree page itself. */

test/corruptB.test

@@ -16,7 +16,11 @@
 # when there exists a page that is both an a descendent or ancestor of
 # itself.
 #
-# $Id: corruptB.test,v 1.1 2008/09/10 14:45:58 danielk1977 Exp $
+# Also test that an SQLITE_CORRUPT error is returned if a B-Tree page
+# contains a (corrupt) reference to a page greater than the configured
+# maximum page number.
+#
+# $Id: corruptB.test,v 1.2 2008/09/10 17:53:36 danielk1977 Exp $
 
 set testdir [file dirname $argv0]
 source $testdir/tester.tcl
@@ -140,5 +144,42 @@ do_test corruptB-1.9.2 {
   catchsql { SELECT * FROM t1 }
 } {1 {database disk image is malformed}}
 
+#---------------------------------------------------------------------------
+
+do_test corruptB-2.1.1 {
+  db close
+  file copy -force bak.db test.db
+  hexio_write test.db [expr $offset+8] [hexio_render_int32 0x6FFFFFFF]
+} {4}
+do_test corruptB-2.1.2 {
+  sqlite3 db test.db
+  catchsql { SELECT * FROM t1 }
+} {1 {database disk image is malformed}}
+
+#---------------------------------------------------------------------------
+
+# Corrupt the header-size field of a database record.
+#
+do_test corruptB-3.1.1 {
+  db close
+  file copy -force bak.db test.db
+  sqlite3 db test.db
+  set v [string repeat abcdefghij 200]
+  execsql {
+    CREATE TABLE t2(a);
+    INSERT INTO t2 VALUES($v);
+  }
+  set t2_root [execsql {SELECT rootpage FROM sqlite_master WHERE name = 't2'}]
+  set iPage [expr ($t2_root-1)*1024]
+  set iCellarray [expr $iPage + 8]
+  set iRecord [hexio_get_int [hexio_read test.db $iCellarray 2]]
+  db close
+  hexio_write test.db [expr $iPage+$iRecord+3] FF00
+} {2}
+do_test corruptB-3.1.2 {
+  sqlite3 db test.db
+  catchsql { SELECT * FROM t2 }
+} {1 {database disk image is malformed}}
+
 finish_test
 

test/fuzz3.test

@@ -13,7 +13,7 @@
 # the database file by changing the values of pseudo-randomly selected
 # bytes.
 #
-# $Id: fuzz3.test,v 1.1 2008/09/09 18:28:07 danielk1977 Exp $
+# $Id: fuzz3.test,v 1.2 2008/09/10 17:53:36 danielk1977 Exp $
 
 set testdir [file dirname $argv0]
 source $testdir/tester.tcl
@@ -123,7 +123,7 @@ do_test fuzz3-2 {
   db_checksum
 } $::cksum
 
-for {set ii 0} {$ii < 10000} {incr ii} {
+for {set ii 0} {$ii < 5000} {incr ii} {
   purge_pcache
 
   # Randomly modify a single byte of the database file somewhere within
@@ -131,12 +131,12 @@ for {set ii 0} {$ii < 10000} {incr ii} {
   set iNew [expr int(rand()*5*1024*256)]
   set iOld [modify_database $iNew]
 
-  set iTest 2
+  set iTest 0
   foreach sql {
+    {SELECT * FROM t2 ORDER BY d}      
     {SELECT * FROM t1}                 
     {SELECT * FROM t2}                 
     {SELECT * FROM t1 ORDER BY a}      
-    {SELECT * FROM t2 ORDER BY d}      
     {SELECT * FROM t1 WHERE a = (SELECT a FROM t1 WHERE rowid=25)} 
     {SELECT * FROM t2 WHERE d = (SELECT d FROM t2 WHERE rowid=1)}  
     {SELECT * FROM t2 WHERE d = (SELECT d FROM t2 WHERE rowid=50)}