Ensure that the sqlite3_value_text() interface returns a buffer that is long

enough to hold the complete string plus the zero terminator even when the
input is a zeroblob.  Fix for a problem detected by OSS-Fuzz.

FossilOrigin-Name: ca185808ade195875918b5bad1762bcd8ec39457

diff --git a/manifest b/manifest
index 7370188f60426b20c27f16cced2cc0d0bd0b6c7b..dac2da099d0532c4768ae340ccd2cd7daac4f926 100644 (file)
--- a/manifest
+++ b/manifest
@@ -1,5 +1,5 @@
-C Version\s3.16.1
-D 2017-01-03T18:27:03.194
+C Ensure\sthat\sthe\ssqlite3_value_text()\sinterface\sreturns\sa\sbuffer\sthat\sis\slong\nenough\sto\shold\sthe\scomplete\sstring\splus\sthe\szero\sterminator\seven\swhen\sthe\ninput\sis\sa\szeroblob.\s\sFix\sfor\sa\sproblem\sdetected\sby\sOSS-Fuzz.
+D 2017-01-05T13:52:54.033
 F Makefile.in 41bd4cad981487345c4a84081074bcdb876e4b2e
 F Makefile.linux-gcc 7bc79876b875010e8c8f9502eb935ca92aa3c434
 F Makefile.msc b8ca53350ae545e3562403d5da2a69cec79308da
@@ -461,7 +461,7 @@ F src/vdbeInt.h 281cb70332dc8b593b8c7afe776f3a2ba7d4255e
 F src/vdbeapi.c d6ebaa465f070eb1af8ba4e7b34583ece87bdd24
 F src/vdbeaux.c 12919c5aa354296d6b9ba808bca3e9dda836858c
 F src/vdbeblob.c f4f98ea672b242f807c08c92c7faaa79e5091b65
-F src/vdbemem.c d3fd85b7b7ef3eb75de29c6d7e1d10d3ca78b4fd
+F src/vdbemem.c 3b5a9a5b375458d3e12a50ae1aaa41eeec2175fd
 F src/vdbesort.c eda25cb2d1727efca6f7862fea32b8aa33c0face
 F src/vdbetrace.c 41963d5376f0349842b5fc4aaaaacd7d9cdc0834
 F src/vtab.c c4bbe0f870f52036553f8098aee0703997f0577a
@@ -1541,10 +1541,8 @@ F vsixtest/vsixtest.tcl 6a9a6ab600c25a91a7acc6293828957a386a8a93
 F vsixtest/vsixtest.vcxproj.data 2ed517e100c66dc455b492e1a33350c1b20fbcdc
 F vsixtest/vsixtest.vcxproj.filters 37e51ffedcdb064aad6ff33b6148725226cd608e
 F vsixtest/vsixtest_TemporaryKey.pfx e5b1b036facdb453873e7084e1cae9102ccc67a0
-P a60b60d6b6ba3e3b17b7bb7d7e19ea0e6b40fa68
-R d4f21444156ee47430dc0da1e1aa71cf
-T +bgcolor * #d0c0ff
-T +sym-release *
-T +sym-version-3.16.1 *
+P 979f04392853b8053817a3eea2fc679947b437fd
+Q +2dc7eeb5b4d2eaf1d843eda56f339fd4cc80d78e
+R abe304f6cf5138efa11a7d944267ac9d
 U drh
-Z 2e6a3477dce68797105cb19052da7dea
+Z 2f1a7774661688b3371053728c269ae5

diff --git a/manifest.uuid b/manifest.uuid
index 29df27f9edfa1014cb58c295e9735c6da103e718..4701fff9efc7ac025f78de4e6f726b3ef1b8c1c0 100644 (file)
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-979f04392853b8053817a3eea2fc679947b437fd
\ No newline at end of file
+ca185808ade195875918b5bad1762bcd8ec39457
\ No newline at end of file

diff --git a/src/vdbemem.c b/src/vdbemem.c
index 9a73b627770273dbfce397659d902b7b6c0be70b..656e19bfa890a20b63c9710bb7bbd5a4fac565c2 100644 (file)
--- a/src/vdbemem.c
+++ b/src/vdbemem.c
@@ -1010,6 +1010,7 @@ static SQLITE_NOINLINE const void *valueToText(sqlite3_value* pVal, u8 enc){
   assert( (pVal->flags & MEM_RowSet)==0 );
   assert( (pVal->flags & (MEM_Null))==0 );
   if( pVal->flags & (MEM_Blob|MEM_Str) ){
+    if( ExpandBlob(pVal) ) return 0;
     pVal->flags |= MEM_Str;
     if( pVal->enc != (enc & ~SQLITE_UTF16_ALIGNED) ){
       sqlite3VdbeChangeEncoding(pVal, enc & ~SQLITE_UTF16_ALIGNED);