Prevent the fts5 xPhraseNext() or xPhraseFirst() APIs from returning an out-of-range...

FossilOrigin-Name: d4014c87ba9b011a6a04c2bf85879b668dc762ebcbbfb50a2f8a417ce594ef88

diff --git a/ext/fts5/fts5_main.c b/ext/fts5/fts5_main.c
index c6e7e346aaa27c1282e9937930c5fd761dfee669..c862e2f956b20670053c67caa19318545a1782cc 100644 (file)
--- a/ext/fts5/fts5_main.c
+++ b/ext/fts5/fts5_main.c
@@ -2235,11 +2235,10 @@ static void *fts5ApiGetAuxdata(Fts5Context *pCtx, int bClear){
 }
 
 static void fts5ApiPhraseNext(
-  Fts5Context *pUnused, 
+  Fts5Context *pCtx, 
   Fts5PhraseIter *pIter, 
   int *piCol, int *piOff
 ){
-  UNUSED_PARAM(pUnused);
   if( pIter->a>=pIter->b ){
     *piCol = -1;
     *piOff = -1;
@@ -2247,8 +2246,12 @@ static void fts5ApiPhraseNext(
     int iVal;
     pIter->a += fts5GetVarint32(pIter->a, iVal);
     if( iVal==1 ){
+      /* Avoid returning a (*piCol) value that is too large for the table,
+      ** even if the position-list is corrupt. The caller might not be
+      ** expecting it.  */
+      int nCol = ((Fts5Table*)(((Fts5Cursor*)pCtx)->base.pVtab))->pConfig->nCol;
       pIter->a += fts5GetVarint32(pIter->a, iVal);
-      *piCol = iVal;
+      *piCol = (iVal>=nCol ? nCol-1 : iVal);
       *piOff = 0;
       pIter->a += fts5GetVarint32(pIter->a, iVal);
     }

diff --git a/ext/fts5/test/fts5corrupt3.test b/ext/fts5/test/fts5corrupt3.test
index e2a91e51ef2a7bd4943d63fc197e56853b93ee7c..cfe1438eda33c26470937421f44de2452ddb8b05 100644 (file)
--- a/ext/fts5/test/fts5corrupt3.test
+++ b/ext/fts5/test/fts5corrupt3.test
@@ -8958,7 +8958,6 @@ do_catchsql_test 61.2 {
   SELECT * FROM t3 ORDER BY rowid;
 } {/*malformed database schema*/}
 
-breakpoint
 #-------------------------------------------------------------------------
 do_test 62.0 {
   sqlite3 db {}
@@ -10768,6 +10767,7 @@ do_catchsql_test 73.1 {
 reset_db
 do_test 74.0 {
   sqlite3 db {}
+  sqlite3_fts5_register_matchinfo db
   db deserialize [decode_hexdb {
 | size 106496 pagesize 4096 filename x.db
 | page 1 offset 0
@@ -14587,14 +14587,19 @@ do_test 74.0 {
 | end x.db
 }]} {}
 
-do_catchsql_test 74.1 {
-  SELECT rowid, quote(matchinfo(t1,'p�xyb<s')) FROM t1 WHERE t1 MATCH 'e*';
+do_catchsql_test 74.0.5 {
+  SELECT matchinfo(1,2);
 } {1 {unable to use function matchinfo in the requested context}}
 
+do_catchsql_test 74.1 {
+  SELECT rowid, quote(matchinfo(t1,'pxyb<s')) FROM t1 WHERE t1 MATCH 'e*';
+} {1 {unrecognized matchinfo flag: <}}
+
 #-------------------------------------------------------------------------
 reset_db
 do_test 75.0 {
   sqlite3 db {}
+  sqlite3_fts5_register_matchinfo db
   db deserialize [decode_hexdb {
 | size 32768 pagesize 4096 filename crash-033d665d5caa8d.db
 | page 1 offset 0
@@ -14791,7 +14796,7 @@ do_test 75.0 {
 
 do_catchsql_test 75.1 {
   SELECT rowid, quote(matchinfo(t1,'pcxybs')) FROM t1 WHERE t1 MATCH 'e*';
-} {1 {unable to use function matchinfo in the requested context}}
+} {1 {database disk image is malformed}}
 
 #-------------------------------------------------------------------------
 reset_db

diff --git a/manifest b/manifest
index 8e63952a76dd50bed231eb9ee8a3c81503e747e9..f7516ccb9008ed0c2d43fb61a13fca7a60cc4715 100644 (file)
--- a/manifest
+++ b/manifest
@@ -1,5 +1,5 @@
-C Revision\sto\scheck-in\s[d9f726ade6b258f8]\sso\sthat\sOOM\sand\sother\sunrelated\sfailures\nare\snot\soverridden\sby\sa\ssyntax\serror\sin\sthe\stokenizer\sspec.
-D 2024-08-10T15:46:57.398
+C Prevent\sthe\sfts5\sxPhraseNext()\sor\sxPhraseFirst()\sAPIs\sfrom\sreturning\san\sout-of-range\scolumn\snumber,\seven\sif\sthe\sdatabase\sis\scorrupt.
+D 2024-08-10T19:57:28.413
 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
 F LICENSE.md df5091916dbb40e6e9686186587125e1b2ff51f022cc334e886c19a0e9982724
@@ -100,7 +100,7 @@ F ext/fts5/fts5_config.c 68cb87a49215f8e7028000b681df4057c430a4a6afbd676463886da
 F ext/fts5/fts5_expr.c 3a24c6ab5b7545312a5ec03085ae705ede820a08f9a63f1d72829ed4a35da6f6
 F ext/fts5/fts5_hash.c adda4272be401566a6e0ba1acbe70ee5cb97fce944bc2e04dc707152a0ec91b1
 F ext/fts5/fts5_index.c eb9a0dda3bc6ef969a6be8d2746af56856e67251810ddba08622b45be8477abe
-F ext/fts5/fts5_main.c 77fefb37e7931095a5ff271a28fbe4f73ec46d5492ef1f35d405d98e137ad8ed
+F ext/fts5/fts5_main.c 6ec7a7d005c632d86e510ddfaca56b197a5b20b61848415764b91bd27d1e4f84
 F ext/fts5/fts5_storage.c 1d7e08d4331da2f3f7e78e70eef2ed6a013d91ba16175c651adbc5ad672235aa
 F ext/fts5/fts5_tcl.c 5ca3e3e35010d326f5b821a563e4fcde3913e052935f5c2c72c264122a26b48f
 F ext/fts5/fts5_test_mi.c 08c11ec968148d4cb4119d96d819f8c1f329812c568bac3684f5464be177d3ee
@@ -147,7 +147,7 @@ F ext/fts5/test/fts5contentless4.test ec34dc69ef474ca9997dae6d91e072906e0e9a5a4b
 F ext/fts5/test/fts5contentless5.test 40cdcb4fe751672450829c5a96bd32c25fc2f6076279dd2ce5c58ac9a390132a
 F ext/fts5/test/fts5corrupt.test a9bda1ded5112ebf1ee85c5381bd1fe8974952e2523cede4d5072804d2011503
 F ext/fts5/test/fts5corrupt2.test 335911e3f68b9625d850325f9e29a128db3f4276a8c9d4e32134580da8f924c4
-F ext/fts5/test/fts5corrupt3.test 3cbb18b8970c66ed4d741eb3eecf42c986bd4c430572a5050350a72030de66cf
+F ext/fts5/test/fts5corrupt3.test b5f35d72af85b1d5a092b3d5e437f7944d142dd0b0c87b928fd0436a0aec6987
 F ext/fts5/test/fts5corrupt4.test dc08d19f5b8943e95a7778a7d8da592042504faf18dd93f68f7d7a0d7d7dd733
 F ext/fts5/test/fts5corrupt5.test 11b47126f5772cc37b67e3e8b2ed05895c4d07c05338bc07e4eea225bfe32c76
 F ext/fts5/test/fts5corrupt6.test 2d72db743db7b5d9c9a6d0cfef24d799ed1aa5e8192b66c40e871a37ed9eed06
@@ -2204,8 +2204,8 @@ F vsixtest/vsixtest.tcl 6195aba1f12a5e10efc2b8c0009532167be5e301abe5b31385638080
 F vsixtest/vsixtest.vcxproj.data 2ed517e100c66dc455b492e1a33350c1b20fbcdc
 F vsixtest/vsixtest.vcxproj.filters 37e51ffedcdb064aad6ff33b6148725226cd608e
 F vsixtest/vsixtest_TemporaryKey.pfx e5b1b036facdb453873e7084e1cae9102ccc67a0
-P c86ef65545485eae6aca23b4582e8115d4edfdd6084afa77858e11b21aa270f6
-R ebd14146d6fe15d97f2e7243900bc453
-U drh
-Z fd712f59ba7388bc8eea12ab1bbe8630
+P 3778b2a9ca1cc12a88ef6c32a1ee7c58a0a829ed9715a3d32a225d377d7527ef
+R e552f961f7d429a11cf017943b4b9f14
+U dan
+Z 0df3f7a0f800270be689e5fef89cec38
 # Remove this line to create a well-formed Fossil manifest.

diff --git a/manifest.uuid b/manifest.uuid
index ee6795d147af9dc77b18331fed2c2652e2fe4040..0b2355bfab34c26e4aa6df13089d10cdc5239476 100644 (file)
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-3778b2a9ca1cc12a88ef6c32a1ee7c58a0a829ed9715a3d32a225d377d7527ef
+d4014c87ba9b011a6a04c2bf85879b668dc762ebcbbfb50a2f8a417ce594ef88