mirrors/sqlite
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix an integer overflow problem with the dbstat virtual table that comes up

Browse Source 
when trying to analyze a corrupt database.

FossilOrigin-Name: 1d64f4a8af81fe1235fffa54884d8f842a48ff6a33d6172f0cd65bf42fe8b2a1
This commit is contained in:
drh 2020-03-19 17:27:52 +00:00
parent 91a23dc299
commit f0a2172d1d
4 changed files with 14 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
manifest
View File

@ -1,5 +1,5 @@
C Fix\sa\stypo\sin\sa\scomment.\s\sNo\schanges\sto\scode.
D 2020-03-19T15:57:03.116
C Fix\san\sinteger\soverflow\sproblem\swith\sthe\sdbstat\svirtual\stable\sthat\scomes\sup\nwhen\strying\sto\sanalyze\sa\scorrupt\sdatabase.
D 2020-03-19T17:27:52.087
F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
F LICENSE.md df5091916dbb40e6e9686186587125e1b2ff51f022cc334e886c19a0e9982724
@ -481,7 +481,7 @@ F src/complete.c a3634ab1e687055cd002e11b8f43eb75c17da23e
F src/ctime.c 6a77ec9e0eb87aea929e002c816298907e337094a7b556898ae2d1e6be209f90
F src/date.c 6c408fdd2e9ddf6e8431aba76315a2d061bea2cec8fbb75e25d7c1ba08274712
F src/dbpage.c 8a01e865bf8bc6d7b1844b4314443a6436c07c3efe1d488ed89e81719047833a
F src/dbstat.c 0f55297469d4244ab7df395849e1af98eb5e95816af7c661e7d2d8402dea23da
F src/dbstat.c 33fc9838b5b9fba07f9ab9e9aba956f0afeeb1af0037a98d984fdc2f698c64fd
F src/delete.c 11000121c4281c0bce4e41db29addfaea0038eaa127ece02557c9207bc3e541d
F src/expr.c ed718ee2206166c9c2fc4fe89eadb1f369318aeb8645e06033566b387970fb9a
F src/fault.c 460f3e55994363812d9d60844b2a6de88826e007
@ -1016,7 +1016,7 @@ F test/fuzz3.test 9c813e6613b837cb7a277b0383cd66bfa07042b4cf0317157c35852f30043c
F test/fuzz4.test c229bcdb45518a89e1d208a21343e061503460ac69fae1539320a89f572eb634
F test/fuzz_common.tcl b7197de6ed1ee8250a4f82d67876f4561b42ee8cbbfc6160dcb66331bad3f830
F test/fuzz_malloc.test f348276e732e814802e39f042b1f6da6362a610af73a528d8f76898fde6b22f2
F test/fuzzcheck.c cdd94f1710957b8b907019b25c6cf4f7b63815a08b19021e8b215bc2419bb7f9
F test/fuzzcheck.c 1ead09510c7bb3475675e499feb721790544e57e00168d687124d9d94ea843ac
F test/fuzzdata1.db d36e88741b4f23bcbaaf55b006290669d03c6c891cf13c7b3a53bc1b097b693f
F test/fuzzdata2.db 128b3feeb78918d075c9b14b48610145a0dd4c8d6f1ca7c2870c7e425f5bf31f
F test/fuzzdata3.db c6586d3e3cef0fbc18108f9bb649aa77bfc38aba
@ -1860,7 +1860,7 @@ F vsixtest/vsixtest.tcl 6a9a6ab600c25a91a7acc6293828957a386a8a93
F vsixtest/vsixtest.vcxproj.data 2ed517e100c66dc455b492e1a33350c1b20fbcdc
F vsixtest/vsixtest.vcxproj.filters 37e51ffedcdb064aad6ff33b6148725226cd608e
F vsixtest/vsixtest_TemporaryKey.pfx e5b1b036facdb453873e7084e1cae9102ccc67a0
P 38e3dd389d142e520c71139ec84aa3c7722992af28a5f93a7f16e0ea176b74bb
R 4071bc4187fb5602ca32977f98f52f75
P 3a51919ac23ae7312d78905334dc97742b517a7476052a85aa07945d9c77697b
R 11059e9f9145d47852beb0ef202844f6
U drh
Z d2aaf73a647da547ab47de7a5b33c862
Z 6be6a8645f621862376d12081de1edc9

2
manifest.uuid
View File

@ -1 +1 @@
3a51919ac23ae7312d78905334dc97742b517a7476052a85aa07945d9c77697b
1d64f4a8af81fe1235fffa54884d8f842a48ff6a33d6172f0cd65bf42fe8b2a1

4
src/dbstat.c
View File

@ -452,7 +452,9 @@ static int statDecodePage(Btree *pBt, StatPage *p){
if( nPayload>(u32)nLocal ){
int j;
int nOvfl = ((nPayload - nLocal) + nUsable-4 - 1) / (nUsable - 4);
if( iOff+nLocal>nUsable ) goto statPageIsCorrupt;
if( iOff+nLocal>nUsable || nPayload>0x7fffffff ){
goto statPageIsCorrupt;
}
pCell->nLastOvfl = (nPayload-nLocal) - (nOvfl-1) * (nUsable-4);
pCell->nOvfl = nOvfl;
pCell->aOvfl = sqlite3_malloc64(sizeof(u32)*nOvfl);

8
test/fuzzcheck.c
View File

@ -94,11 +94,9 @@
# include <unistd.h>
#endif
#ifdef SQLITE_OSS_FUZZ
# include <stddef.h>
# if !defined(_MSC_VER)
# include <stdint.h>
# endif
#include <stddef.h>
#if !defined(_MSC_VER)
# include <stdint.h>
#endif
#if defined(_MSC_VER)