diff options
| author | drh <drh@noemail.net> | 2020-03-19 17:27:52 +0000 |
|---|---|---|
| committer | drh <drh@noemail.net> | 2020-03-19 17:27:52 +0000 |
| commit | f0a2172d1d2004ac1ac358c63cf4b464fea10bf6 (patch) | |
| tree | 683420f2a2a26317f2abe35727190feb36aa53a0 | |
| parent | 91a23dc2999ebbdd8041f41a11dc81c63484f39a (diff) | |
| download | sqlite-f0a2172d1d2004ac1ac358c63cf4b464fea10bf6.tar.gz sqlite-f0a2172d1d2004ac1ac358c63cf4b464fea10bf6.zip | |
Fix an integer overflow problem with the dbstat virtual table that comes up
when trying to analyze a corrupt database.
FossilOrigin-Name: 1d64f4a8af81fe1235fffa54884d8f842a48ff6a33d6172f0cd65bf42fe8b2a1
| -rw-r--r-- | manifest | 14 | ||||
| -rw-r--r-- | manifest.uuid | 2 | ||||
| -rw-r--r-- | src/dbstat.c | 4 | ||||
| -rw-r--r-- | test/fuzzcheck.c | 8 |
4 files changed, 14 insertions, 14 deletions
@@ -1,5 +1,5 @@ -C Fix\sa\stypo\sin\sa\scomment.\s\sNo\schanges\sto\scode. -D 2020-03-19T15:57:03.116 +C Fix\san\sinteger\soverflow\sproblem\swith\sthe\sdbstat\svirtual\stable\sthat\scomes\sup\nwhen\strying\sto\sanalyze\sa\scorrupt\sdatabase. +D 2020-03-19T17:27:52.087 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea F LICENSE.md df5091916dbb40e6e9686186587125e1b2ff51f022cc334e886c19a0e9982724 @@ -481,7 +481,7 @@ F src/complete.c a3634ab1e687055cd002e11b8f43eb75c17da23e F src/ctime.c 6a77ec9e0eb87aea929e002c816298907e337094a7b556898ae2d1e6be209f90 F src/date.c 6c408fdd2e9ddf6e8431aba76315a2d061bea2cec8fbb75e25d7c1ba08274712 F src/dbpage.c 8a01e865bf8bc6d7b1844b4314443a6436c07c3efe1d488ed89e81719047833a -F src/dbstat.c 0f55297469d4244ab7df395849e1af98eb5e95816af7c661e7d2d8402dea23da +F src/dbstat.c 33fc9838b5b9fba07f9ab9e9aba956f0afeeb1af0037a98d984fdc2f698c64fd F src/delete.c 11000121c4281c0bce4e41db29addfaea0038eaa127ece02557c9207bc3e541d F src/expr.c ed718ee2206166c9c2fc4fe89eadb1f369318aeb8645e06033566b387970fb9a F src/fault.c 460f3e55994363812d9d60844b2a6de88826e007 @@ -1016,7 +1016,7 @@ F test/fuzz3.test 9c813e6613b837cb7a277b0383cd66bfa07042b4cf0317157c35852f30043c F test/fuzz4.test c229bcdb45518a89e1d208a21343e061503460ac69fae1539320a89f572eb634 F test/fuzz_common.tcl b7197de6ed1ee8250a4f82d67876f4561b42ee8cbbfc6160dcb66331bad3f830 F test/fuzz_malloc.test f348276e732e814802e39f042b1f6da6362a610af73a528d8f76898fde6b22f2 -F test/fuzzcheck.c cdd94f1710957b8b907019b25c6cf4f7b63815a08b19021e8b215bc2419bb7f9 +F test/fuzzcheck.c 1ead09510c7bb3475675e499feb721790544e57e00168d687124d9d94ea843ac F test/fuzzdata1.db d36e88741b4f23bcbaaf55b006290669d03c6c891cf13c7b3a53bc1b097b693f F test/fuzzdata2.db 128b3feeb78918d075c9b14b48610145a0dd4c8d6f1ca7c2870c7e425f5bf31f F test/fuzzdata3.db c6586d3e3cef0fbc18108f9bb649aa77bfc38aba @@ -1860,7 +1860,7 @@ F vsixtest/vsixtest.tcl 6a9a6ab600c25a91a7acc6293828957a386a8a93 F vsixtest/vsixtest.vcxproj.data 2ed517e100c66dc455b492e1a33350c1b20fbcdc F vsixtest/vsixtest.vcxproj.filters 37e51ffedcdb064aad6ff33b6148725226cd608e F vsixtest/vsixtest_TemporaryKey.pfx e5b1b036facdb453873e7084e1cae9102ccc67a0 -P 38e3dd389d142e520c71139ec84aa3c7722992af28a5f93a7f16e0ea176b74bb -R 4071bc4187fb5602ca32977f98f52f75 +P 3a51919ac23ae7312d78905334dc97742b517a7476052a85aa07945d9c77697b +R 11059e9f9145d47852beb0ef202844f6 U drh -Z d2aaf73a647da547ab47de7a5b33c862 +Z 6be6a8645f621862376d12081de1edc9 diff --git a/manifest.uuid b/manifest.uuid index 88395c495..0081a7113 100644 --- a/manifest.uuid +++ b/manifest.uuid @@ -1 +1 @@ -3a51919ac23ae7312d78905334dc97742b517a7476052a85aa07945d9c77697b
\ No newline at end of file +1d64f4a8af81fe1235fffa54884d8f842a48ff6a33d6172f0cd65bf42fe8b2a1
\ No newline at end of file diff --git a/src/dbstat.c b/src/dbstat.c index 2fea48ce8..2931024e1 100644 --- a/src/dbstat.c +++ b/src/dbstat.c @@ -452,7 +452,9 @@ static int statDecodePage(Btree *pBt, StatPage *p){ if( nPayload>(u32)nLocal ){ int j; int nOvfl = ((nPayload - nLocal) + nUsable-4 - 1) / (nUsable - 4); - if( iOff+nLocal>nUsable ) goto statPageIsCorrupt; + if( iOff+nLocal>nUsable || nPayload>0x7fffffff ){ + goto statPageIsCorrupt; + } pCell->nLastOvfl = (nPayload-nLocal) - (nOvfl-1) * (nUsable-4); pCell->nOvfl = nOvfl; pCell->aOvfl = sqlite3_malloc64(sizeof(u32)*nOvfl); diff --git a/test/fuzzcheck.c b/test/fuzzcheck.c index 378502436..992b225d3 100644 --- a/test/fuzzcheck.c +++ b/test/fuzzcheck.c @@ -94,11 +94,9 @@ # include <unistd.h> #endif -#ifdef SQLITE_OSS_FUZZ -# include <stddef.h> -# if !defined(_MSC_VER) -# include <stdint.h> -# endif +#include <stddef.h> +#if !defined(_MSC_VER) +# include <stdint.h> #endif #if defined(_MSC_VER) |