Fix a buffer overread that could in fts3 when dealing with corrupt records.

FossilOrigin-Name: 1660d7733eb443ab085ddef7666b998a1c75ac81cc54a9620960a8d3b377e28e

diff --git a/ext/fts3/fts3_write.c b/ext/fts3/fts3_write.c
index 8ad48a0125362fb63424f5490cd23d986fa90d7c..7d2820e03a6fd5d266c15f55688abf24c103b123 100644 (file)
--- a/ext/fts3/fts3_write.c
+++ b/ext/fts3/fts3_write.c
@@ -2619,14 +2619,14 @@ static void fts3ColumnFilter(
 
     nList -= (int)(p - pList);
     pList = p;
-    if( nList==0 ){
+    if( nList<=0 ){
       break;
     }
     p = &pList[1];
     p += fts3GetVarint32(p, &iCurrent);
   }
 
-  if( bZero && &pList[nList]!=pEnd ){
+  if( bZero && (pEnd - &pList[nList])>0){
     memset(&pList[nList], 0, pEnd - &pList[nList]);
   }
   *ppList = pList;

diff --git a/manifest b/manifest
index e80b1e4fbc468980004e24782111abe4e8e9bca2..b3a4a300b977fe117fde51acdcc64c71163a2427 100644 (file)
--- a/manifest
+++ b/manifest
@@ -1,5 +1,5 @@
-C Combine\sthe\simplementations\sof\sthe\skey\sand\shexkey\spragmas\sinto\sa\ssingle\ncase.\s\sHave\sboth\spragmas\sreturn\s"ok"\sif\sthey\sare\simplemented.
-D 2019-05-21T17:04:27.540
+C Fix\sa\sbuffer\soverread\sthat\scould\sin\sfts3\swhen\sdealing\swith\scorrupt\srecords.
+D 2019-05-22T14:22:44.809
 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
 F LICENSE.md df5091916dbb40e6e9686186587125e1b2ff51f022cc334e886c19a0e9982724
@@ -99,7 +99,7 @@ F ext/fts3/fts3_tokenizer.h 64c6ef6c5272c51ebe60fc607a896e84288fcbc3
 F ext/fts3/fts3_tokenizer1.c 5c98225a53705e5ee34824087478cf477bdb7004
 F ext/fts3/fts3_unicode.c 4b9af6151c29b35ed09574937083cece7c31e911f69615e168a39677569b684d
 F ext/fts3/fts3_unicode2.c 416eb7e1e81142703520d284b768ca2751d40e31fa912cae24ba74860532bf0f
-F ext/fts3/fts3_write.c 766cfc4140c5609c5178b087697ccc5f5650bd915f3c6718f1547b3e994f674b
+F ext/fts3/fts3_write.c 05fd879124769bb59af4263c63a4c5bd6370e49b6dc906208150e3ad29ebf813
 F ext/fts3/fts3speed.tcl b54caf6a18d38174f1a6e84219950d85e98bb1e9
 F ext/fts3/mkfts3amal.tcl 252ecb7fe6467854f2aa237bf2c390b74e71f100
 F ext/fts3/tool/fts3cov.sh c331d006359456cf6f8f953e37f2b9c7d568f3863f00bb5f7eb87fea4ac01b73
@@ -929,7 +929,8 @@ F test/fts3conf.test c84bbaec81281c1788aa545ac6e78a6bd6cde2bdbbce2da261690e3659f
 F test/fts3corrupt.test 46b9ddda7f6588fd5a5b1f4bb4fc0618dc45010e7dddb8a3a188baf3197177ae
 F test/fts3corrupt2.test bf55c3fa0b0dc8ea1c0fe5543623bd27714585da6a129038fd6999fe3b0d25f3
 F test/fts3corrupt3.test 0d5b69a0998b4adf868cc301fc78f3d0707745f1d984ce044c205cdb764b491f
-F test/fts3corrupt4.test 72d8f1269f3ee1eb76fdf6133618225f7fc1abeece2d02456b292c90c822d78e
+F test/fts3corrupt4.test e4c038936bca89cddfb8636a442a0a5f7e027a9f6d90f194491534a2d53ea31b
+F test/fts3corrupt5.test 1911bd38381fe7eb28b204e7171937d09e113e5ceb018399ded9f42ec7e6ae66
 F test/fts3cov.test cb932743da52a1c79a1ab8983e26c8121cf02263d6ff16e1f642e6f9b8348338
 F test/fts3d.test 2bd8c97bcb9975f2334147173b4872505b6a41359a4f9068960a36afe07a679f
 F test/fts3defer.test f4c20e4c7153d20a98ee49ee5f3faef624fefc9a067f8d8d629db380c4d9f1de
@@ -1827,7 +1828,7 @@ F vsixtest/vsixtest.tcl 6a9a6ab600c25a91a7acc6293828957a386a8a93
 F vsixtest/vsixtest.vcxproj.data 2ed517e100c66dc455b492e1a33350c1b20fbcdc
 F vsixtest/vsixtest.vcxproj.filters 37e51ffedcdb064aad6ff33b6148725226cd608e
 F vsixtest/vsixtest_TemporaryKey.pfx e5b1b036facdb453873e7084e1cae9102ccc67a0
-P a3e77c7776ab01dadb9d30d6067ac97e9d4b09ec54834558a5fa1ffed7b52c72
-R 3dae3e0fc33f3c377f4c91b3d6a4afab
-U drh
-Z c924ae29a91263cca0c0c95662d4314e
+P b3692c406f7ba62587c9d3256f888748393519680e9e2db53f59557f1a300e05
+R f699aa16c433e23c44317dd7182cee58
+U dan
+Z 36b8ecda6615f5abd747a22791cbbe09

diff --git a/manifest.uuid b/manifest.uuid
index b664fe27c531f2b7fa5122f4d34411c4cac1a71f..4d92628ab4cbc7a08417a0fb02d9a51923c029de 100644 (file)
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-b3692c406f7ba62587c9d3256f888748393519680e9e2db53f59557f1a300e05
\ No newline at end of file
+1660d7733eb443ab085ddef7666b998a1c75ac81cc54a9620960a8d3b377e28e
\ No newline at end of file

diff --git a/test/fts3corrupt4.test b/test/fts3corrupt4.test
index 1b85abba40037fca6c9b119ac92da0f418fe175b..36b89b4186a946adc88fca6925a6a00704483d30 100644 (file)
--- a/test/fts3corrupt4.test
+++ b/test/fts3corrupt4.test
@@ -1946,7 +1946,7 @@ do_test 13.0 {
 
 do_catchsql_test 13.1 {
   SELECT quote(matchinfo(t1,'pcxybs'))==0 FROM t1 WHERE b MATCH 'e*';
-} {0 {0 0}}
+} {0 {}}
 
 #-------------------------------------------------------------------------
 reset_db
@@ -2826,7 +2826,7 @@ do_test 18.0 {
 
 do_catchsql_test 18.1 {
   SELECT quote(matchinfo(t1,'pcxybs'))==0 FROM t1 WHERE b MATCH 'e*';
-} {0 0}
+} {0 {}}
 
 #-------------------------------------------------------------------------
 reset_db
@@ -4400,6 +4400,217 @@ do_catchsql_test 25.6 {
   INSERT INTO t1(t1) SELECT x FROM t2;
   INSERT INTO t1(t1) SELECT x FROM t2;
 } {1 {database disk image is malformed}}
+
+#-------------------------------------------------------------------------
+reset_db
+do_test 26.0 {
+  sqlite3 db {}
+  db deserialize [decode_hexdb {
+.open --hexdb
+| size 28672 pagesize 4096 filename crash-26682721375870.db
+| page 1 offset 0
+|      0: 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00   SQLite format 3.
+|     16: 10 00 01 01 00 40 20 20 00 00 00 00 00 00 00 00   .....@  ........
+|     96: 00 00 00 00 0d 0e b1 00 06 0d a4 00 0f 8d 0f 21   ...............!
+|    112: 0e b9 0d c8 0e 7e 0d a4 00 00 00 00 00 00 00 00   .....~..........
+|   3488: 00 00 00 00 22 07 06 17 11 11 01 31 74 61 62 6c   ...........1tabl
+|   3504: 65 74 32 74 32 07 43 52 45 41 54 45 20 54 41 42   et2t2.CREATE TAB
+|   3520: 4c 45 20 74 32 28 78 29 81 33 05 07 17 1f 1f 01   LE t2(x).3......
+|   3536: 82 35 74 61 62 6c 65 74 31 5f 73 65 67 64 69 72   .5tablet1_segdir
+|   3552: 74 31 5f 73 65 67 64 69 72 05 43 52 45 41 54 45   t1_segdir.CREATE
+|   3568: 20 54 41 42 4c 45 20 27 74 31 5f 73 65 67 64 69    TABLE 't1_segdi
+|   3584: 72 27 28 6c 65 76 65 6c 20 49 4e 54 45 47 45 51   r'(level INTEGEQ
+|   3600: 2c 69 64 78 20 49 4e 54 45 47 45 52 2c 73 74 61   ,idx INTEGER,sta
+|   3616: 72 74 5f 62 6c 6f 63 6b 20 49 4e 54 45 47 45 52   rt_block INTEGER
+|   3632: 2c 6c 65 61 76 65 73 5f 65 6e 64 5f 62 6c 6f 63   ,leaves_end_bloc
+|   3648: 6b 20 49 4e 54 45 47 45 52 2c 65 6e 64 5f 62 6c   k INTEGER,end_bl
+|   3664: 6f 63 6b 20 49 4e 54 45 47 45 62 2c 72 6f 6f 74   ock INTEGEb,root
+|   3680: 20 42 4c 4f 42 2c 50 52 49 4d 41 52 59 20 4b 45    BLOB,PRIMARY KE
+|   3696: 59 28 6c 65 76 65 6c 2c 20 69 64 78 29 29 31 06   Y(level, idx))1.
+|   3712: 06 17 45 1f 01 00 69 6e 64 65 78 73 71 6c 69 74   ..E...indexsqlit
+|   3728: 65 5f 61 75 74 6f 69 6e 64 65 78 5f 74 31 5f 73   e_autoindex_t1_s
+|   3744: 65 67 64 69 72 5f 31 74 31 5f 73 65 67 64 69 72   egdir_1t1_segdir
+|   3760: 06 0f c7 00 08 00 00 00 00 66 04 07 17 23 23 01   .........f...##.
+|   3776: 81 13 74 61 62 6c 65 74 31 5f 73 65 66 6d 65 6e   ..tablet1_sefmen
+|   3792: 74 73 74 31 5f 73 65 67 6d 65 6e 74 73 04 43 52   tst1_segments.CR
+|   3808: 45 41 54 45 20 54 41 42 4c 45 20 27 74 31 5f 73   EATE TABLE 't1_s
+|   3824: 65 67 6d 65 6e 74 73 27 28 62 6c 6f 63 6b 69 64   egments'(blockid
+|   3840: 20 49 4e 54 45 47 45 52 20 50 52 49 4d 41 52 59    INTEGER PRIMARY
+|   3856: 20 4b 45 59 2c 20 62 6c 6f 63 6b 20 42 4c 4f 42    KEY, block BLOB
+|   3872: 29 6a 03 07 17 21 21 01 81 1f 74 61 62 6c 65 74   )j...!!...tablet
+|   3888: 31 5f 63 6f 6e 74 65 6e 74 74 31 5f 63 6f 6e 74   1_contentt1_cont
+|   3904: 65 6e 74 03 43 52 45 41 54 45 20 54 41 42 4c 45   ent.CREATE TABLE
+|   3920: 20 27 74 31 5f 63 6f 6e 74 65 6e 74 27 28 64 6f    't1_content'(do
+|   3936: 63 69 64 20 49 4e 54 45 47 45 52 20 50 52 49 4d   cid INTEGER PRIM
+|   3952: 41 52 59 20 4b 45 59 2c 20 27 63 30 61 27 2c 20   ARY KEY, 'c0a', 
+|   3968: 27 63 31 62 27 2c 20 27 63 32 63 27 29 38 02 06   'c1b', 'c2c')8..
+|   3984: 17 11 11 08 5f 74 61 62 6c 65 74 31 74 31 43 52   ...._tablet1t1CR
+|   4000: 45 41 54 45 20 56 49 52 54 55 41 4c 20 54 41 42   EATE VIRTUAL TAB
+|   4016: 4c 45 20 74 31 20 55 53 49 4e 47 20 66 74 73 33   LE t1 USING fts3
+|   4032: 28 61 2c 62 2c 63 29 00 00 00 00 00 00 00 00 00   (a,b,c).........
+| page 3 offset 8192
+|      0: 0d 00 00 00 25 0b 48 00 0f d8 0f af 0f 86 0f 74   ....%.H........t
+|     16: 0f 61 0f 4e 0f 2f 0f 0f 0e ef 0e d7 0e be 0e a5   .a.N./..........
+|     32: 0e 8d 0e 74 0e 5b 0e 40 0e 24 0e 08 0d ef 00 00   ...t.[.@.$......
+|   2880: 00 00 00 00 00 00 00 00 81 3f 25 06 00 82 7f 00   .........?%.....
+|   2896: 00 43 4f 4d 50 49 4c 45 52 3d 67 63 63 2d 35 2e   .COMPILER=gcc-5.
+|   2912: 34 23 00 20 32 2f 31 36 30 36 30 39 20 44 45 42   4#. 2/160609 DEB
+|   2928: 55 47 20 45 4e 41 42 4c 45 20 44 42 53 54 41 54   UG ENABLE DBSTAT
+|   2944: 20 56 54 41 42 20 45 4e 41 42 4c 45 20 46 54 53    VTAB ENABLE FTS
+|   2960: 34 20 45 4e 41 42 4c 45 20 46 54 53 35 20 45 4e   4 ENABLE FTS5 EN
+|   2976: 41 42 4c 45 20 47 45 4f 50 4f 4c 59 20 45 4e 41   ABLE GEOPOLY ENA
+|   2992: 42 4c 45 20 4a 53 4f 4e 31 20 45 4e 41 42 4c 45   BLE JSON1 ENABLE
+|   3008: 20 4d 45 4d 53 59 53 35 20 45 4e 41 42 4c 45 20    MEMSYS5 ENABLE 
+|   3024: 52 54 52 45 45 20 4d 41 58 20 4d 45 4d 4f 52 59   RTREE MAX MEMORY
+|   3040: 3d 35 30 30 30 30 30 30 30 20 4f 4d 49 54 20 4c   =50000000 OMIT L
+|   3056: 4f 41 44 20 45 58 54 45 4e 53 59 4f 4e 20 54 48   OAD EXTENSYON TH
+|   3072: 52 45 41 44 53 41 46 45 3d 30 18 24 05 00 25 0f   READSAFE=0.$..%.
+|   3088: 19 54 48 52 45 41 44 53 41 46 45 3d 30 58 42 49   .THREADSAFE=0XBI
+|   3104: 4e 41 52 59 18 23 05 00 25 0f 19 54 48 52 45 41   NARY.#..%..THREA
+|   3120: 44 53 41 46 45 3d 30 58 4e 4f 43 41 53 45 17 22   DSAFE=0XNOCASE..
+|   3136: 05 00 25 0f 17 54 38 52 45 41 44 53 41 46 45 3d   ..%..T8READSAFE=
+|   3152: 30 58 52 54 52 49 4d 1f 21 05 00 33 0f 19 4f 4d   0XRTRIM.!..3..OM
+|   3168: 49 54 20 4c 4f 41 44 20 45 58 54 45 fc 53 49 4f   IT LOAD EXTE.SIO
+|   3184: 4e 68 42 49 4e 4a c2 59 1f 20 05 00 33 0f 19 4f   NhBINJ.Y. ..3..O
+|   3200: 4d 49 54 20 4c 4f 41 44 20 45 58 54 45 4e 53 49   MIT LOAD EXTENSI
+|   3216: 4f 4e 58 4e 4f 43 41 53 45 1e 1f 05 00 33 0f 17   ONXNOCASE....3..
+|   3232: 4f 4d 49 54 20 4c 4f 41 44 20 45 58 54 45 4e 53   OMIT LOAD EXTENS
+|   3248: 49 4f 4e 58 52 54 52 49 4d 1f 1e 05 00 33 0f 19   IONXRTRIM....3..
+|   3264: 4d 41 58 20 4d 45 4d 4f 52 59 3d 35 30 2f 30 30   MAX MEMORY=50/00
+|   3280: 30 30 30 58 42 49 4e 41 52 59 1f 1d 05 00 33 0f   000XBINARY....3.
+|   3296: 19 4d 41 58 20 4d 45 4d 4f 52 59 3d 35 30 30 30   .MAX MEMORY=5000
+|   3312: 30 30 30 30 48 4e 4f 43 41 53 45 1e 1c 05 00 33   0000HNOCASE....3
+|   3328: 0f 17 4d 41 58 20 4d 45 4d 4f 52 59 3d 35 30 30   ..MAX MEMORY=500
+|   3344: 30 30 30 30 30 58 52 54 52 49 4d 18 1b 05 00 25   00000XRTRIM....%
+|   3360: 0f 19 45 4e 41 42 4c 45 20 52 54 52 45 45 58 42   ..ENABLE RTREEXB
+|   3376: 49 4e 41 52 59 18 1a 05 00 25 0f 19 45 4e 41 42   INARY....%..ENAB
+|   3392: 4c 45 20 52 54 52 45 45 58 4e 4f 53 41 53 45 17   LE RTREEXNOSASE.
+|   3408: 19 05 00 25 0f 17 45 4e 41 42 4c 45 20 52 54 52   ...%..ENABLE RTR
+|   3424: 45 45 58 52 54 52 49 4d 1a 18 05 00 29 0f 19 45   EEXRTRIM....)..E
+|   3440: 4e 41 42 4c 45 20 4d 45 4d 53 59 53 35 58 42 49   NABLE MEMSYS5XBI
+|   3456: 4e 41 52 59 1a 17 05 00 29 0f 19 45 4e 41 42 4c   NARY....)..ENABL
+|   3472: 45 20 4d 45 4d 53 59 53 35 58 4e 4f 43 41 53 45   E MEMSYS5XNOCASE
+|   3488: 19 16 05 00 29 0f 17 45 4e 41 42 4c 45 20 4d 45   ....)..ENABLE ME
+|   3504: 4d 53 59 53 35 58 52 54 52 49 4d 18 15 05 00 25   MSYS5XRTRIM....%
+|   3520: 0f 19 45 4e 41 42 4c 45 20 4a 53 4f 4e 31 58 42   ..ENABLE JSON1XB
+|   3536: 49 4e 41 52 59 18 14 05 00 25 0f 19 45 4e 42 42   INARY....%..ENBB
+|   3552: 4d 45 20 4a 53 4f 4e 31 58 4e 4f 43 41 53 45 17   ME JSON1XNOCASE.
+|   3568: 13 05 00 25 0f 17 45 4e 41 42 4c 45 20 4a 53 4f   ...%..ENABLE JSO
+|   3584: 4e 31 58 52 54 52 49 4d 1a 12 05 00 29 0f 19 45   N1XRTRIM....)..E
+|   3600: 4e 41 42 4c 45 20 47 45 4f 50 4f 4c 59 58 42 49   NABLE GEOPOLYXBI
+|   3616: 4e 41 52 59 1a 11 05 00 29 0f 19 45 4e 41 1e 4c   NARY....)..ENA.L
+|   3632: 45 20 47 45 4f 50 4f 4c 59 58 4e 4f 43 41 53 45   E GEOPOLYXNOCASE
+|   3648: 19 10 05 00 29 0f 17 45 4e 41 42 4c 45 20 47 45   ....)..ENABLE GE
+|   3664: 4f 50 4f 4c 59 58 62 54 52 49 4d 17 0f 05 00 23   OPOLYXbTRIM....#
+|   3680: 0f 19 45 4e 41 42 4c 45 20 46 54 53 35 58 42 49   ..ENABLE FTS5XBI
+|   3696: 4e 41 52 59 17 0e 05 00 23 0f 19 45 4e 41 42 4c   NARY....#..ENABL
+|   3712: 45 20 46 54 fc 35 58 4e 4f 43 41 53 45 16 0d 05   E FT.5XNOCASE...
+|   3728: 00 23 0f 17 45 4e 41 42 4c 45 20 46 54 53 35 58   .#..ENABLE FTS5X
+|   3744: 52 54 52 49 4d 17 0c 05 00 23 0f 19 45 4e 41 42   RTRIM....#..ENAB
+|   3760: 4c 45 20 46 54 53 34 58 42 49 4e 41 52 59 17 0b   LE FTS4XBINARY..
+|   3776: 05 00 23 0f 19 45 4e 41 42 4c 45 20 46 54 53 35   ..#..ENABLE FTS5
+|   3792: 58 4e 4f 43 40 53 45 16 0a 05 00 23 0f 17 45 4e   XNOC@SE....#..EN
+|   3808: 41 42 4c 45 20 56 54 53 34 58 52 54 52 49 4d 1e   ABLE VTS4XRTRIM.
+|   3824: 09 05 00 31 0f 19 45 4e 41 42 4c 45 20 44 42 53   ...1..ENABLE DBS
+|   3840: 54 41 54 20 56 54 41 42 58 42 49 4e 41 b3 58 1e   TAT VTABXBINA.X.
+|   3856: 08 05 00 31 0f 19 45 4e 40 42 4c 45 20 44 42 53   ...1..EN@BLE DBS
+|   3872: 54 41 54 20 56 54 41 42 58 4e 4f 43 41 53 45 1d   TAT VTABXNOCASE.
+|   3888: 07 05 00 31 0f 17 45 4e 41 42 4c 45 20 45 42 53   ...1..ENABLE EBS
+|   3904: 54 41 54 20 56 54 41 42 58 52 54 52 49 4d 11 06   TAT VTABXRTRIM..
+|   3920: 05 00 17 0f 19 44 45 42 55 47 58 42 49 4e 41 52   .....DEBUGXBINAR
+|   3936: 59 11 05 05 00 17 0f 19 44 45 42 55 47 58 4e 4f   Y.......DEBUGXNO
+|   3952: 43 41 53 45 10 04 05 00 17 0f 17 44 45 42 55 47   CASE.......DEBUG
+|   3968: 58 52 54 52 49 4d 27 03 05 00 43 0f 19 43 4f 4d   XRTRIM'...C..COM
+|   3984: 50 49 4c 45 52 3d 67 63 63 2d 35 2e 34 2e 30 20   PILER=gcc-5.4.0 
+|   4000: 32 30 31 36 30 36 30 39 58 4b 19 4e 41 52 59 27   20160609XK.NARY'
+|   4016: 02 05 00 43 0f 19 43 4f 4d 50 49 4c 45 52 3d 67   ...C..COMPILER=g
+|   4032: 63 63 2d 35 2e 34 2e 30 20 32 30 31 36 30 36 30   cc-5.4.0 2016060
+| page 5 offset 16384
+|      0: 0d 00 00 00 02 0b a0 00 0c ad 0b a0 00 00 00 00   ................
+|   2976: 82 0a 02 08 08 09 08 08 17 84 06 30 20 32 34 33   ...........0 243
+|   2992: 00 01 30 04 25 06 1b 00 00 08 32 30 31 36 30 36   ..0.%.....201606
+|   3008: 30 39 03 25 07 00 00 01 34 03 25 05 00 00 01 35   09.%....4.%....5
+|   3024: 03 25 04 00 01 07 30 30 30 30 30 30 30 03 25 1a   .%....0000000.%.
+|   3040: 00 00 08 63 6f 6d 70 69 6c 65 72 03 25 02 00 00   ...compiler.%...
+|   3056: 06 64 62 73 74 51 74 03 25 0a 00 01 04 65 62 75   .dbstQt.%....ebu
+|   3072: 67 03 25 08 00 00 06 65 6e 61 62 6c 65 09 25 09   g.%....enable.%.
+|   3088: 05 04 04 04 04 04 00 01 08 78 74 65 6e 73 69 6f   .........xtensio
+|   3104: 6e 03 25 1d 00 00 04 66 74 73 34 03 25 0d 00 03   n.%....fts4.%...
+|   3120: 01 35 03 25 0f 00 00 03 67 63 63 03 25 03 00 01   .5.%....gcc.%...
+|   3136: 06 65 6f 70 6f 6c 79 03 25 11 00 00 05 6a 73 6f   .eopoly.%....jso
+|   3152: 6e 31 03 25 13 00 00 04 6c 6f 61 64 03 25 1c 00   n1.%....load.%..
+|   3168: 00 03 6d 61 78 03 25 18 00 01 05 65 6d 6f 72 79   ..max.%....emory
+|   3184: 03 25 19 00 03 04 73 79 73 35 03 25 15 00 00 04   .%....sys5.%....
+|   3200: 6f 6d 69 74 03 25 1b 00 00 05 72 74 72 65 65 03   omit.%....rtree.
+|   3216: 25 17 00 00 0a 74 68 72 65 61 64 73 61 66 65 03   %....threadsafe.
+|   3232: 25 1e 00 00 04 76 74 61 62 03 25 0b 00 86 50 01   %....vtab.%...P.
+|   3248: 08 08 08 08 08 17 8d 12 30 20 38 33 35 00 01 30   ........0 835..0
+|   3264: 12 01 06 00 01 06 00 01 06 00 1e f3 00 01 03 00   ................
+|   3280: 01 03 00 00 08 32 30 31 36 30 36 30 39 09 01 07   .....20160609...
+|   3296: 00 01 07 00 01 07 00 00 01 34 09 01 05 00 01 05   .........4......
+|   3312: 00 01 05 00 00 01 35 09 01 04 00 01 04 00 01 04   ......5.........
+|   3328: 00 01 07 30 30 30 30 2f 30 30 09 1c 04 00 01 04   ...0000/00......
+|   3344: 00 01 04 00 00 06 62 69 6e 61 72 79 3c 03 01 02   ......binary<...
+|   3360: 02 00 03 01 02 02 00 03 01 02 02 00 03 01 02 02   ................
+|   3376: 00 03 01 02 02 00 03 01 02 02 00 03 01 02 02 00   ................
+|   3392: 03 01 02 02 00 03 01 02 02 00 03 01 02 02 00 03   ................
+|   3408: 01 02 02 00 03 01 02 02 00 00 08 63 6f 6d 70 69   ...........compi
+|   3424: 6c 65 72 09 01 02 00 01 02 00 01 02 00 00 06 64   ler............d
+|   3440: 62 73 74 61 74 09 07 03 00 01 03 00 01 03 00 01   bstat...........
+|   3456: 04 65 62 75 67 09 04 02 00 01 02 00 01 02 00 00   .ebug...........
+|   3472: 06 65 6e 61 62 6c 65 3f 07 02 00 01 02 00 01 02   .enable?........
+|   3488: 00 01 02 00 01 02 00 01 01 f0 01 02 00 57 02 00   .............W..
+|   3504: 01 02 00 01 02 00 01 02 00 01 02 00 01 02 10 01   ................
+|   3520: 02 00 01 02 00 01 02 00 01 02 00 01 02 00 01 02   ................
+|   3536: 00 00 02 00 01 02 00 01 08 78 74 65 6e 73 69 6f   .........xtensio
+|   3552: 6e 09 1f 04 00 01 04 00 01 04 00 00 04 66 74 73   n............fts
+|   3568: 34 09 0a 03 00 01 03 00 01 03 00 03 01 35 09 0d   4............5..
+|   3584: 03 00 01 03 00 a9 03 00 00 03 67 63 63 09 01 03   ..........gcc...
+|   3600: 00 01 03 00 01 03 00 01 06 65 6f 70 6f 6c 79 09   .........eopoly.
+|   3616: 10 03 00 01 03 00 01 03 00 00 05 6a 73 6f 6e 31   ...........json1
+|   3632: 09 13 03 00 01 03 00 01 03 00 00 04 6c 6f 61 64   ............load
+|   3648: 09 1f 03 00 01 03 00 01 03 00 00 03 6d 61 78 09   ............max.
+|   3664: 1c 02 0b 31 02 00 01 02 00 01 05 65 6d 6f 72 79   ...1.......emory
+|   3680: 09 1c 03 00 01 03 00 01 03 00 03 04 73 79 73 35   ............sys5
+|   3696: 09 16 03 00 01 03 00 01 03 00 00 06 6e 6f 63 61   ............noca
+|   3712: 73 65 3c 02 01 02 02 00 03 01 02 02 00 03 01 02   se<.............
+|   3728: 02 00 03 01 02 02 00 03 01 02 02 00 03 01 02 02   ................
+|   3744: 00 03 01 02 02 00 f3 01 02 02 00 03 01 02 02 00   ................
+|   3760: 03 01 02 02 00 03 01 02 02 00 03 01 02 02 00 00   ................
+|   3776: 04 6f 6d 69 74 09 1f 02 00 01 02 00 01 02 00 00   .omit...........
+|   3792: 05 72 74 72 65 65 09 19 03 00 01 03 00 01 03 00   .rtree..........
+|   3808: 03 02 69 6d 3c 01 01 02 02 00 03 01 02 02 00 03   ..im<...........
+|   3824: 01 02 02 00 03 01 02 02 00 03 01 02 02 00 03 01   ................
+|   3840: 02 02 00 03 01 02 02 00 03 01 02 02 00 03 01 02   ................
+|   3856: 02 00 03 01 02 02 00 03 01 02 02 00 03 01 02 02   ................
+|   3872: 00 00 0a 74 68 72 65 61 64 63 61 66 65 09 22 02   ...threadcafe...
+|   3888: 00 01 02 00 02 02 00 00 04 76 74 61 62 09 07 04   .........vtab...
+|   3904: 00 01 04 00 01 04 00 00 01 78 b4 01 01 01 01 02   .........x......
+|   3920: 00 01 01 01 02 00 01 01 01 02 00 01 01 01 02 00   ................
+|   3936: 01 01 01 02 00 01 01 01 02 00 01 01 01 02 00 01   ................
+|   3952: 01 01 02 00 01 01 01 02 00 01 01 01 02 00 01 01   ................
+|   3968: 01 02 00 01 01 01 02 00 01 01 01 02 00 01 01 01   ................
+|   3984: 02 00 01 01 01 02 00 01 01 01 02 00 01 01 01 02   ................
+|   4000: 00 01 01 01 02 00 01 01 01 02 00 01 01 01 02 00   ................
+|   4016: 01 01 01 02 00 01 01 01 02 00 01 00 01 02 00 01   ................
+|   4032: 01 01 02 00 01 01 00 e2 00 01 01 01 02 00 01 01   ................
+|   4048: 01 02 00 01 01 01 02 00 01 01 01 02 00 01 01 01   ................
+|   4064: 02 00 01 01 01 02 00 01 01 01 02 00 01 01 01 02   ................
+|   4080: 00 01 01 01 02 00 01 01 01 02 00 01 01 01 02 00   ................
+| page 6 offset 20480
+|      0: 0a 00 00 00 02 0f f5 00 0f fb 0f f5 00 00 00 00   ................
+|   4080: 00 00 00 00 00 05 04 08 09 01 02 04 04 08 08 09   ................
+| page 7 offset 24576
+|      0: 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
+|   4016: 00 00 00 00 00 00 00 00 0d 05 02 23 61 00 00 00   ...........#a...
+| end crash-26682721375870.db
+}]} {}
+
+do_execsql_test 26.1 {
+  SELECT count(*) FROM (
+    SELECT t1, (t1) FROM t1 WHERE b MATCH 'x'
+  )
+} 34
  
 finish_test
 

diff --git a/test/fts3corrupt5.test b/test/fts3corrupt5.test
new file mode 100644 (file)
index 0000000..d60a8c0
--- /dev/null
+++ b/test/fts3corrupt5.test
@@ -0,0 +1,60 @@
+# 2019 May 22
+#
+# The author disclaims copyright to this source code.  In place of
+# a legal notice, here is a blessing:
+#
+#    May you do good and not evil.
+#    May you find forgiveness for yourself and forgive others.
+#    May you share freely, never taking more than you give.
+#
+#*************************************************************************
+#
+#
+
+set testdir [file dirname $argv0]
+source $testdir/tester.tcl
+source $testdir/fts3_common.tcl
+set testprefix fts3corrupt5
+
+# If SQLITE_ENABLE_FTS3 is defined, omit this file.
+ifcapable !fts3 {
+  finish_test
+  return
+}
+
+sqlite3_fts3_may_be_corrupt 1
+
+do_execsql_test 1.0 {
+  BEGIN;
+    CREATE VIRTUAL TABLE ft USING fts3(a, b, c);
+    INSERT INTO ft VALUES('one', 'one', 'one');
+  COMMIT;
+}
+
+do_execsql_test 1.1 {
+  SELECT * FROM ft WHERE ft MATCH 'b:one'
+} {one one one}
+
+do_execsql_test 1.2 {
+  SELECT quote(root) FROM ft_segdir;
+} {X'00036F6E6509010201010201020200'}
+
+breakpoint
+foreach {tn val q bCorrupt} {
+  1 X'00036F6E650901'                   'b:one'  1
+  2 X'00036F6E6509010201010201FFFFFF'   'c:one'  1
+  3 X'00036F6E6501'                     'b:one'  1
+  4 X'00036F6E650101'                   'b:one'  1
+  5 X'00036F6E650100'                   'b:one'  0
+} {
+  do_execsql_test 1.3.$tn.1 "UPDATE ft_segdir SET root = $val"
+
+  set res {0 {}}
+  if {$bCorrupt} { set res {1 {database disk image is malformed}}}
+  do_catchsql_test 1.3.$tn.2 {
+    SELECT * FROM ft WHERE ft MATCH $q
+  } $res
+}
+
+finish_test
+