Add extra tests for database corruption inside the defragmentPage() routine,
as dbfuzz2 has found ways for corruption to leak into that point. Add test cases in fuzzdata7.db. FossilOrigin-Name: 997b65117f8c12dba5fb85434fde9765cdb0d2a49cc3e31979abba3e21350086
This commit is contained in:
commit
8061ad8abd
15
manifest
15
manifest
@ -1,5 +1,5 @@
|
||||
C Fix\sa\sproblem\sin\ssqlite3BtreeDelete()\sin\swhich\sdeleting\san\sentry\sfrom\sa\ncorrupt\sdatabase\scan\sleave\sa\sbtree\spage\swith\szero\scells.
|
||||
D 2018-12-13T21:05:45.342
|
||||
C Add\sextra\stests\sfor\sdatabase\scorruption\sinside\sthe\sdefragmentPage()\sroutine,\nas\sdbfuzz2\shas\sfound\sways\sfor\scorruption\sto\sleak\sinto\sthat\spoint.\s\sAdd\stest\ncases\sin\sfuzzdata7.db.
|
||||
D 2018-12-13T21:11:22.437
|
||||
F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
|
||||
F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
|
||||
F Makefile.in d8b254f8bb81bab43c340d70d17dc3babab40fcc8a348c8255881f780a45fee6
|
||||
@ -448,7 +448,7 @@ F src/auth.c 0fac71038875693a937e506bceb492c5f136dd7b1249fbd4ae70b4e8da14f9df
|
||||
F src/backup.c 78d3cecfbe28230a3a9a1793e2ead609f469be43e8f486ca996006be551857ab
|
||||
F src/bitvec.c 17ea48eff8ba979f1f5b04cc484c7bb2be632f33
|
||||
F src/btmutex.c 8acc2f464ee76324bf13310df5692a262b801808984c1b79defb2503bbafadb6
|
||||
F src/btree.c d4bf14ab64339017db65a17c70a3b3d5edf39e5ec5373921133407a56c3e50e5
|
||||
F src/btree.c e3e08171f90c6843d2a26d582d946a754093435acd48155b8cd339b06cc8cc1b
|
||||
F src/btree.h febb2e817be499570b7a2e32a9bbb4b607a9234f6b84bb9ae84916d4806e96f2
|
||||
F src/btreeInt.h 620ab4c7235f43572cf3ac2ac8723cbdf68073be4d29da24897c7b77dda5fd96
|
||||
F src/build.c ef9d7dc73e40dd9d10c28848343e21e8bc1baaab92cfb75eda893fff4fbf6b55
|
||||
@ -981,7 +981,7 @@ F test/fuzzdata3.db c6586d3e3cef0fbc18108f9bb649aa77bfc38aba
|
||||
F test/fuzzdata4.db b502c7d5498261715812dd8b3c2005bad08b3a26e6489414bd13926cd3e42ed2
|
||||
F test/fuzzdata5.db e35f64af17ec48926481cfaf3b3855e436bd40d1cfe2d59a9474cb4b748a52a5
|
||||
F test/fuzzdata6.db 92a80e4afc172c24f662a10a612d188fb272de4a9bd19e017927c95f737de6d7
|
||||
F test/fuzzdata7.db a1bf54eb455e9772942abae1b2d1cf1e3d3659f0e5dd14f00792fd01411ae8ef
|
||||
F test/fuzzdata7.db c8c5ef745ce43eb24d6903bff63ddc336464b6b4f9dfae817e7ec2ea0e541dbd
|
||||
F test/fuzzer1.test 3d4c4b7e547aba5e5511a2991e3e3d07166cfbb8
|
||||
F test/fuzzer2.test a85ef814ce071293bce1ad8dffa217cbbaad4c14
|
||||
F test/fuzzerfault.test 8792cd77fd5bce765b05d0c8e01b9edcf8af8536
|
||||
@ -1787,7 +1787,8 @@ F vsixtest/vsixtest.tcl 6a9a6ab600c25a91a7acc6293828957a386a8a93
|
||||
F vsixtest/vsixtest.vcxproj.data 2ed517e100c66dc455b492e1a33350c1b20fbcdc
|
||||
F vsixtest/vsixtest.vcxproj.filters 37e51ffedcdb064aad6ff33b6148725226cd608e
|
||||
F vsixtest/vsixtest_TemporaryKey.pfx e5b1b036facdb453873e7084e1cae9102ccc67a0
|
||||
P 1f583c53f3b7318c69f6e235934d97ef9493278feeab0837217076d7d071c35b
|
||||
R bdea9a4eb87ba8aa256dc24af3d20da1
|
||||
P 682053d1e603c21b8085c39db618a39b23ec8d2c4d822fd19634db0e03038ea2 b386fce9a23e628dce7362dcca2904b8d0af6da58a6fe6eb7f12f058a8363e49
|
||||
R a1122995324223304196c0f63a35c59e
|
||||
T +closed b386fce9a23e628dce7362dcca2904b8d0af6da58a6fe6eb7f12f058a8363e49
|
||||
U drh
|
||||
Z 2389e6a9c76519655c1cfe39d2b8ef15
|
||||
Z b4a67e64bc03ae62ccd56c8eb96ba51d
|
||||
|
@ -1 +1 @@
|
||||
682053d1e603c21b8085c39db618a39b23ec8d2c4d822fd19634db0e03038ea2
|
||||
997b65117f8c12dba5fb85434fde9765cdb0d2a49cc3e31979abba3e21350086
|
21
src/btree.c
21
src/btree.c
@ -1412,19 +1412,14 @@ static int defragmentPage(MemPage *pPage, int nMaxFrag){
|
||||
** reconstruct the entire page. */
|
||||
if( (int)data[hdr+7]<=nMaxFrag ){
|
||||
int iFree = get2byte(&data[hdr+1]);
|
||||
|
||||
/* If the initial freeblock offset were out of bounds, that would
|
||||
** have been detected by btreeInitPage() when it was computing the
|
||||
** number of free bytes on the page. */
|
||||
assert( iFree<=usableSize-4 );
|
||||
if( iFree ){
|
||||
int iFree2 = get2byte(&data[iFree]);
|
||||
|
||||
/* pageFindSlot() has already verified that free blocks are sorted
|
||||
** in order of offset within the page, and that no block extends
|
||||
** past the end of the page. Provided the two free slots do not
|
||||
** overlap, this guarantees that the memmove() calls below will not
|
||||
** overwrite the usableSize byte buffer, even if the database page
|
||||
** is corrupt. */
|
||||
assert( iFree2==0 || iFree2>iFree );
|
||||
assert( iFree+get2byte(&data[iFree+2]) <= usableSize );
|
||||
assert( iFree2==0 || iFree2+get2byte(&data[iFree2+2]) <= usableSize );
|
||||
|
||||
if( iFree2>usableSize-4 ) return SQLITE_CORRUPT_PAGE(pPage);
|
||||
if( 0==iFree2 || (data[iFree2]==0 && data[iFree2+1]==0) ){
|
||||
u8 *pEnd = &data[cellOffset + nCell*2];
|
||||
u8 *pAddr;
|
||||
@ -1435,9 +1430,9 @@ static int defragmentPage(MemPage *pPage, int nMaxFrag){
|
||||
return SQLITE_CORRUPT_PAGE(pPage);
|
||||
}
|
||||
if( iFree2 ){
|
||||
assert( iFree+sz<=iFree2 ); /* Verified by pageFindSlot() */
|
||||
if( iFree+sz>iFree2 ) return SQLITE_CORRUPT_PAGE(pPage);
|
||||
sz2 = get2byte(&data[iFree2+2]);
|
||||
assert( iFree+sz+sz2+iFree2-(iFree+sz) <= usableSize );
|
||||
if( iFree2+sz2 > usableSize ) return SQLITE_CORRUPT_PAGE(pPage);
|
||||
memmove(&data[iFree+sz+sz2], &data[iFree+sz], iFree2-(iFree+sz));
|
||||
sz += sz2;
|
||||
}
|
||||
|
Binary file not shown.
Loading…
Reference in New Issue
Block a user