diff options
| author | drh <> | 2022-03-22 23:33:20 +0000 |
|---|---|---|
| committer | drh <> | 2022-03-22 23:33:20 +0000 |
| commit | 500d7e542ce30c37a6427ffc20df16e942ea0820 (patch) | |
| tree | 10b8877d9a0241cd1c6d5565f09d579215f6aff4 /src/btree.c | |
| parent | 56d88aad299a57368408a69c7357963a9ddd8f89 (diff) | |
| download | sqlite-500d7e542ce30c37a6427ffc20df16e942ea0820.tar.gz sqlite-500d7e542ce30c37a6427ffc20df16e942ea0820.zip | |
Ensure that database corruption does not cause the cursor passed into
sqlite3BtreeDelete() to be invalid.
dbsqlfuzz 209bf3de9ee11ae440848ab9bc9c13858f9be2e4.
FossilOrigin-Name: a85126f96614c53b030c6e6c43ff239eae458048597a10e9a0361fcec8628ecf
Diffstat (limited to 'src/btree.c')
| -rw-r--r-- | src/btree.c | 17 |
1 files changed, 11 insertions, 6 deletions
diff --git a/src/btree.c b/src/btree.c index 41087825b..d31d30c5e 100644 --- a/src/btree.c +++ b/src/btree.c @@ -9430,12 +9430,16 @@ int sqlite3BtreeDelete(BtCursor *pCur, u8 flags){ assert( hasSharedCacheTableLock(p, pCur->pgnoRoot, pCur->pKeyInfo!=0, 2) ); assert( !hasReadConflicts(p, pCur->pgnoRoot) ); assert( (flags & ~(BTREE_SAVEPOSITION | BTREE_AUXDELETE))==0 ); - if( pCur->eState==CURSOR_REQUIRESEEK ){ - rc = btreeRestoreCursorPosition(pCur); - assert( rc!=SQLITE_OK || CORRUPT_DB || pCur->eState==CURSOR_VALID ); - if( rc || pCur->eState!=CURSOR_VALID ) return rc; + if( pCur->eState!=CURSOR_VALID ){ + if( pCur->eState>=CURSOR_REQUIRESEEK ){ + rc = btreeRestoreCursorPosition(pCur); + assert( rc!=SQLITE_OK || CORRUPT_DB || pCur->eState==CURSOR_VALID ); + if( rc || pCur->eState!=CURSOR_VALID ) return rc; + }else{ + return SQLITE_CORRUPT_BKPT; + } } - assert( CORRUPT_DB || pCur->eState==CURSOR_VALID ); + assert( pCur->eState==CURSOR_VALID ); iCellDepth = pCur->iPage; iCellIdx = pCur->ix; @@ -9467,7 +9471,8 @@ int sqlite3BtreeDelete(BtCursor *pCur, u8 flags){ bPreserve = (flags & BTREE_SAVEPOSITION)!=0; if( bPreserve ){ if( !pPage->leaf - || (pPage->nFree+pPage->xCellSize(pPage,pCell)+2)>(int)(pBt->usableSize*2/3) + || (pPage->nFree+pPage->xCellSize(pPage,pCell)+2) > + (int)(pBt->usableSize*2/3) || pPage->nCell==1 /* See dbfuzz001.test for a test case */ ){ /* A b-tree rebalance will be required after deleting this entry. |