Detect database corruption in rootpage flags (see also (2313)). (CVS 2314)

FossilOrigin-Name: 6d91a1e91bf0e8b4a0f5f78d079031f3ee69603b

manifest

@@ -1,5 +1,5 @@
-C Detect\sand\sreport\sa\ssubtle\scase\sof\sdatabase\sfile\scorruption.\s(CVS\s2313)
+C Detect\sdatabase\scorruption\sin\srootpage\sflags\s(see\salso\s(2313)).\s(CVS\s2314)
-D 2005-02-04T21:13:01
+D 2005-02-05T06:49:54
 F Makefile.in f867ff4c3353a3b10ecf823f338876a47fc7def0
 F Makefile.linux-gcc a9e5a0d309fa7c38e7c14d3ecf7690879d3a5457
 F README a01693e454a00cc117967e3f9fdab2d4d52e9bc1
@@ -74,7 +74,7 @@ F src/update.c b6f4668c11059f86b71581187d09197fa28ec4be
 F src/utf.c bda5eb85039ef16f2d17004c1e18c96e1ab0a80c
 F src/util.c 1b7b9a127b66743ab6cba8d44597aeb570723c99
 F src/vacuum.c 14d1c346234fc64b326c19ea1ffe8f9e4c73d19a
-F src/vdbe.c ce4dea911a2ebc45c965e4747ada0547a75583bb
+F src/vdbe.c d2c29d2ada955818afa910c3204e5a5d145ceaea
 F src/vdbe.h bb9186484f749a839c6c43953e79a6530253f7cd
 F src/vdbeInt.h e80721cd8ff611789e20743eec43363a9fb5a48e
 F src/vdbeapi.c 467caa6e6fb9247528b1c7ab9132ae1b4748e8ac
@@ -113,7 +113,7 @@ F test/collate4.test b8668612691c4dcf90f67a8df1eeb1544e7fdaf8
 F test/collate5.test 581775b94604b7435dc6a5c6e72fbbf7d69e3830
 F test/collate6.test 6c9470d1606ee3e564675b229653e320c49ec638
 F test/conflict.test c5b849b01cfbe0a4f63a90cba6f68e2fe3a75f87
-F test/corrupt.test 4786177a8ee6d9360fcdeae7b2c66862d34fdd57
+F test/corrupt.test 34e031add52cb1f50aff722f7d4ebd7b972637d3
 F test/corrupt2.test 88342570828f2b8cbbd8369eff3891f5c0bdd5ba
 F test/crash.test f38b980a0508655d08c957a6dd27d66bca776504
 F test/crashtest1.c 09c1c7d728ccf4feb9e481671e29dda5669bbcc2
@@ -270,7 +270,7 @@ F www/tclsqlite.tcl e73f8f8e5f20e8277619433f7970060ab01088fc
 F www/vdbe.tcl 095f106d93875c94b47367384ebc870517431618
 F www/version3.tcl 092a01f5ef430d2c4acc0ae558d74c4bb89638a0
 F www/whentouse.tcl 3e522a06ad41992023c80ca29a048ae2331ca5bd
-P 2eb90870556c90b8d85da3d5eb7554f74ec922c2
+P 9fc0a5cbf892a22eaa950f3b2ed572ab4985c220
-R 9fde37ae6ab0b7787ca0100acb8f8c8c
+R 8a70ee41a498a441e9c9ad827e56edad
-U drh
+U danielk1977
-Z 9898815e66bf58e67c97b824ac2a83df
+Z 7ca8eabd20bbe1e17778cf54c5cd6f57

manifest.uuid

@@ -1 +1 @@
-9fc0a5cbf892a22eaa950f3b2ed572ab4985c220
+6d91a1e91bf0e8b4a0f5f78d079031f3ee69603b

src/vdbe.c

@@ -43,7 +43,7 @@
 ** in this file for details.  If in doubt, do not deviate from existing
 ** commenting and indentation practices when changing or adding code.
 **
-** $Id: vdbe.c,v 1.451 2005/02/04 21:13:01 drh Exp $
+** $Id: vdbe.c,v 1.452 2005/02/05 06:49:54 danielk1977 Exp $
 */
 #include "sqliteInt.h"
 #include "os.h"
@@ -1660,11 +1660,20 @@ case OP_NotNull: {            /* same as TK_NOTNULL */
 ** opcode must be called to set the number of fields in the table.
 **
 ** This opcode sets the number of columns for cursor P1 to P2.
+**
+** If OP_KeyAsData is to be applied to cursor P1, it must be executed
+** before this op-code.
 */
 case OP_SetNumColumns: {
+  Cursor *pC;
   assert( (pOp->p1)<p->nCursor );
   assert( p->apCsr[pOp->p1]!=0 );
-  p->apCsr[pOp->p1]->nField = pOp->p2;
+  pC = p->apCsr[pOp->p1];
+  pC->nField = pOp->p2;
+  if( (!pC->keyAsData && pC->zeroData) || (pC->keyAsData && pC->intKey) ){
+    rc = SQLITE_CORRUPT;
+    goto abort_due_to_error;
+  }
   break;
 }
 

test/corrupt.test

@@ -13,7 +13,7 @@
 # This file implements tests to make sure SQLite does not crash or
 # segfault if it sees a corrupt database file.
 #
-# $Id: corrupt.test,v 1.5 2005/02/04 04:07:18 danielk1977 Exp $
+# $Id: corrupt.test,v 1.6 2005/02/05 06:49:55 danielk1977 Exp $
 
 catch {file delete -force test.db}
 catch {file delete -force test.db-journal}
@@ -112,4 +112,61 @@ for {set i [expr {1*256}]} {$i<$fsize-256} {incr i 256} {
   } {}
 }  
 
+#------------------------------------------------------------------------
+# For these tests, swap the rootpage entries of t1 (a table) and t1i1 (an
+# index on t1) in sqlite_master. Then perform a few different queries
+# and make sure this is detected as corruption.
+#
+do_test corrupt-3.1 {
+  db close
+  copy_file test.bu test.db
+  sqlite3 db test.db
+  execsql {
+    SELECT name, rootpage FROM sqlite_master
+  }
+} {t1 2 t1i1 85 t2 177}
+do_test corrupt-3.2 {
+  set t1_r [execsql {SELECT rootpage FROM sqlite_master WHERE name = 't1i1'}]
+  set t1i1_r [execsql {SELECT rootpage FROM sqlite_master WHERE name = 't1'}]
+  set cookie [expr [execsql {PRAGMA schema_version}] + 1]
+  execsql "
+    PRAGMA writable_schema = 1;
+    UPDATE sqlite_master SET rootpage = $t1_r WHERE name = 't1';
+    UPDATE sqlite_master SET rootpage = $t1i1_r WHERE name = 't1i1';
+    PRAGMA writable_schema = 0;
+    PRAGMA schema_version = $cookie;
+    SELECT name, rootpage FROM sqlite_master;
+  "
+} {t1 85 t1i1 2 t2 177}
+
+# This one tests the case caught by code in checkin [2313].
+do_test corrupt-3.3 {
+  db close
+  sqlite3 db test.db
+  catchsql {
+    INSERT INTO t1 VALUES('abc');
+  }
+} {1 {database disk image is malformed}}
+do_test corrupt-3.4 {
+  db close
+  sqlite3 db test.db
+  catchsql {
+    SELECT * FROM t1;
+  }
+} {1 {database disk image is malformed}}
+do_test corrupt-3.5 {
+  db close
+  sqlite3 db test.db
+  catchsql {
+    SELECT * FROM t1 WHERE oid = 10;
+  }
+} {1 {database disk image is malformed}}
+do_test corrupt-3.6 {
+  db close
+  sqlite3 db test.db
+  catchsql {
+    SELECT * FROM t1 WHERE x = 'abcde';
+  }
+} {1 {database disk image is malformed}}
+
 finish_test