diff options
| author | drh <> | 2022-01-02 11:25:51 +0000 |
|---|---|---|
| committer | drh <> | 2022-01-02 11:25:51 +0000 |
| commit | 2dfe9664a900b05ec7ca5a24c29f8fce6e36d984 (patch) | |
| tree | b57b06e5e9933ecc12248b94f0c64d87a46f400a /src/btree.c | |
| parent | 24a82eadb34162b278e0a3c2115b167d2487d300 (diff) | |
| download | sqlite-2dfe9664a900b05ec7ca5a24c29f8fce6e36d984.tar.gz sqlite-2dfe9664a900b05ec7ca5a24c29f8fce6e36d984.zip | |
Earlier detection of corruption in sqlite3BtreeDelete(). Fix for
the assertion fault reported by
[forum:/forumpost/9d78389221|forum post 9d78389221].
FossilOrigin-Name: 13e9ff9e84a114374b49986484dbee05953a496f3017dd5089fba6f495a17c40
Diffstat (limited to 'src/btree.c')
| -rw-r--r-- | src/btree.c | 11 |
1 files changed, 9 insertions, 2 deletions
diff --git a/src/btree.c b/src/btree.c index 53643fcb8..cfaffb7d7 100644 --- a/src/btree.c +++ b/src/btree.c @@ -6819,13 +6819,15 @@ static void dropCell(MemPage *pPage, int idx, int sz, int *pRC){ int hdr; /* Beginning of the header. 0 most pages. 100 page 1 */ if( *pRC ) return; - assert( idx>=0 && idx<pPage->nCell ); + assert( idx>=0 ); + assert( idx<pPage->nCell ); assert( CORRUPT_DB || sz==cellSize(pPage, idx) ); assert( sqlite3PagerIswriteable(pPage->pDbPage) ); assert( sqlite3_mutex_held(pPage->pBt->mutex) ); assert( pPage->nFree>=0 ); data = pPage->aData; ptr = &pPage->aCellIdx[2*idx]; + assert( pPage->pBt->usableSize > (int)(ptr-data) ); pc = get2byte(ptr); hdr = pPage->hdrOffset; testcase( pc==(u32)get2byte(&data[hdr+5]) ); @@ -9254,7 +9256,12 @@ int sqlite3BtreeDelete(BtCursor *pCur, u8 flags){ iCellIdx = pCur->ix; pPage = pCur->pPage; pCell = findCell(pPage, iCellIdx); - if( pPage->nFree<0 && btreeComputeFreeSpace(pPage) ) return SQLITE_CORRUPT; + if( pPage->nFree<0 && btreeComputeFreeSpace(pPage) ){ + return SQLITE_CORRUPT_BKPT; + } + if( pPage->nCell<=iCellIdx ){ + return SQLITE_CORRUPT_BKPT; + } /* If the bPreserve flag is set to true, then the cursor position must ** be preserved following this delete operation. If the current delete |