Fix a "jump depends on unitialized value" valgrind/asan error in fts5.

FossilOrigin-Name: 66f94d623c16b4527e42f0519e32ec78eaf9ee6fd61ee7d0eb657cc59a8f7d68

diff --git a/ext/fts5/fts5_index.c b/ext/fts5/fts5_index.c
index 5e1155c2a96c291553527546266929210b424032..d923a9d9dfb337b9972ad6565f414341d36d68f0 100644 (file)
--- a/ext/fts5/fts5_index.c
+++ b/ext/fts5/fts5_index.c
@@ -4997,7 +4997,9 @@ static void fts5MergePrefixLists(
         ** at most 20 bytes of unexpected space. */
         fts5MergeAppendDocid(&out, iLastRowid, i2.iRowid);
         fts5BufferZero(&tmp);
-        sqlite3Fts5BufferSize(&p->rc, &tmp, i1.nPoslist + i2.nPoslist + 10 + 10);
+        sqlite3Fts5BufferSize(&p->rc, &tmp, 
+            i1.nPoslist + i2.nPoslist + 10 + 10 + FTS5_DATA_ZERO_PADDING
+        );
         if( p->rc ) break;
 
         sqlite3Fts5PoslistNext64(a1, i1.nPoslist, &iOff1, &iPos1);
@@ -5071,9 +5073,10 @@ static void fts5MergePrefixLists(
     }
     assert_nc( out.n<=(p1->n+p2->n+9) );
 
-    fts5BufferSet(&p->rc, p1, out.n, out.p);
+    fts5BufferFree(p1);
     fts5BufferFree(&tmp);
-    fts5BufferFree(&out);
+    memset(&out.p[out.n], 0, FTS5_DATA_ZERO_PADDING);
+    *p1 = out;
   }
 }
 

diff --git a/ext/fts5/test/fts5corrupt3.test b/ext/fts5/test/fts5corrupt3.test
index 8b3e6c8dc3cb4deaa32d726d17e819a775e0721d..a8a7ae9a54fe5b1e4cf30c90ec46bc4b8618e5ff 100644 (file)
--- a/ext/fts5/test/fts5corrupt3.test
+++ b/ext/fts5/test/fts5corrupt3.test
@@ -10324,6 +10324,109 @@ do_catchsql_test 69.2 {
   SELECT * FROM t1 WHERE a MATCH 'fx*'
 } {1 {database disk image is malformed}}
 
+#-------------------------------------------------------------------------
+reset_db
+do_test 70.0 {
+  sqlite3 db {}
+  db deserialize [decode_hexdb {
+.open --hexdb
+| size 24576 pagesize 4096 filename sql022250.txt.db
+| page 1 offset 0
+|      0: 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00   SQLite format 3.
+|     16: 10 00 01 01 00 40 20 20 00 00 00 00 00 00 00 00   .....@  ........
+|     96: 00 00 00 00 0d 00 00 00 06 0d e2 00 0f c4 0f 6a   ...............j
+|    112: 0e fc 0e 9d 0e 3d 0d e2 00 00 00 00 00 00 00 00   .....=..........
+|   3552: 00 00 59 06 06 17 21 21 01 7f 74 61 62 6c 65 74   ..Y...!!..tablet
+|   3568: 74 74 5f 63 6f 6e 66 69 67 74 74 74 5f 63 6f 6e   tt_configttt_con
+|   3584: 66 69 67 06 43 52 45 41 54 45 20 54 41 42 4c 45   fig.CREATE TABLE
+|   3600: 20 27 74 74 74 5f 63 6f 6e 66 69 67 27 28 6b 20    'ttt_config'(k 
+|   3616: 50 52 49 4d 41 52 59 20 4b 45 59 2c 20 76 29 20   PRIMARY KEY, v) 
+|   3632: 57 49 54 48 4f 55 54 20 52 4f 57 49 44 5e 15 07   WITHOUT ROWID^..
+|   3648: 17 23 23 01 81 03 74 61 62 6c 65 74 74 74 5f 64   .##...tablettt_d
+|   3664: 6f 63 73 69 7a 65 74 74 74 5f 64 6f 63 73 69 7a   ocsizettt_docsiz
+|   3680: 65 05 43 52 45 41 54 45 20 54 41 42 4c 45 20 27   e.CREATE TABLE '
+|   3696: 74 74 74 5f 64 6f 63 73 69 7a 65 27 28 69 64 20   ttt_docsize'(id 
+|   3712: 49 4d 54 45 47 45 52 20 50 52 49 4d 41 52 59 20   IMTEGER PRIMARY 
+|   3728: 4b 45 59 2c 20 73 7a 20 42 4c 4f 20 29 5d 04 07   KEY, sz BLO )]..
+|   3744: 17 23 23 01 81 01 74 61 62 6c 65 74 74 74 5f 63   .##...tablettt_c
+|   3760: 6f 6e 74 65 6e 74 74 74 74 5f 63 6f 6e 74 65 6e   ontentttt_conten
+|   3776: 74 04 43 52 45 41 54 45 20 54 41 42 4c 45 20 27   t.CREATE TABLE '
+|   3792: 74 74 74 5f 63 6f 6e 74 65 6e 74 27 28 69 64 20   ttt_content'(id 
+|   3808: 49 4e 54 45 47 45 52 20 50 52 49 4d 41 52 59 20   INTEGER PRIMARY 
+|   3824: 4b 45 59 2c 20 63 30 2c 20 63 31 29 6c 03 07 17   KEY, c0, c1)l...
+|   3840: 1b 1b 01 81 2f 74 61 62 6c 65 74 74 74 5f 69 64   ..../tablettt_id
+|   3856: 78 74 74 74 5f 69 64 78 03 43 52 45 41 54 45 20   xttt_idx.CREATE 
+|   3872: 54 41 42 4c 45 20 27 74 74 74 5f 69 64 78 27 28   TABLE 'ttt_idx'(
+|   3888: 73 65 67 69 64 2c 20 74 65 72 6d 2c 20 70 67 6e   segid, term, pgn
+|   3904: 6f 2c 20 50 52 49 4d 41 52 59 20 4b 45 59 28 73   o, PRIMARY KEY(s
+|   3920: 65 67 69 64 2c 20 74 65 72 6d 29 29 20 57 49 54   egid, term)) WIT
+|   3936: 48 4f 55 54 20 52 4f 57 49 44 58 02 07 17 1d 1d   HOUT ROWIDX.....
+|   3952: 01 81 03 74 61 62 6c 65 74 74 74 5f 64 61 74 61   ...tablettt_data
+|   3968: 74 74 74 5f 64 61 74 61 02 43 52 45 41 54 45 20   ttt_data.CREATE 
+|   3984: 54 41 42 4c 45 20 27 74 74 74 5f 64 61 74 61 27   TABLE 'ttt_data'
+|   4000: 28 69 64 20 49 4e 54 45 47 45 52 20 50 52 49 4d   (id INTEGER PRIM
+|   4016: 41 52 59 20 4b 45 59 2c 20 62 6c 6f 63 6b 20 42   ARY KEY, block B
+|   4032: 4c 4f 42 29 3a 01 06 17 13 13 08 5f 74 61 62 6c   LOB):......_tabl
+|   4048: 65 74 74 74 74 74 74 43 52 45 41 54 45 20 56 49   ettttttCREATE VI
+|   4064: 52 54 55 41 4c 20 54 41 42 4c 45 20 74 74 74 20   RTUAL TABLE ttt 
+|   4080: 55 53 49 4e 47 20 66 74 73 35 28 61 2c 20 62 29   USING fts5(a, b)
+| page 2 offset 4096
+|      0: 0d 0f 54 00 05 0e 81 00 0f e7 0e 81 0f af 0f 58   ..T............X
+|     16: 0e 98 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
+|   3712: 00 15 0a 03 00 30 00 00 00 00 01 03 03 00 03 01   .....0..........
+|   3728: 01 01 02 01 01 03 01 01 81 24 8c 80 80 80 80 01   .........$......
+|   3744: 04 00 82 4c 00 00 00 9b 02 30 65 03 1a 02 05 05   ...L.....0e.....
+|   3760: 07 05 01 01 04 03 03 08 03 03 01 2e 02 05 05 07   ................
+|   3776: 05 07 05 07 05 01 01 14 03 03 08 03 03 08 03 bf   ................
+|   3792: 07 f2 f3 02 01 65 03 1e 03 05 05 04 05 05 01 01   .....e..........
+|   3808: 03 06 04 04 06 04 03 01 36 03 05 05 04 05 05 04   ........6.......
+|   3824: 05 15 04 05 05 01 01 03 06 04 04 06 04 04 a1 04   ................
+|   3840: 04 06 04 03 03 01 65 03 14 04 05 07 05 05 01 01   ......e.........
+|   3856: 02 09 0a 01 20 04 05 07 05 07 05 07 05 05 01 01   .... ...........
+|   3872: 02 0f da 0a 0a 04 01 64 f3 02 0a 01 06 0a 0a 0a   .......d........
+|   3888: 05 01 65 03 06 01 01 0a 01 0a 01 01 0a 0a 0a 04   ..e.............
+|   3904: 2b 31 21 0b 0f ef 00 14 2a 00 00 00 00 01 02 02   +1!.....*.......
+|   3920: 00 02 01 01 01 02 01 01 50 88 80 80 80 80 01 04   ........P.......
+|   3936: 00 81 24 00 00 00 47 01 30 65 02 1a 02 05 05 07   ..$...G.0e......
+|   3952: 05 01 01 04 03 03 08 03 03 02 01 65 02 1d f3 05   ...........e....
+|   3968: 05 04 05 05 01 01 04 06 04 04 06 04 03 03 01 65   ...............e
+|   3984: 02 14 04 05 07 05 05 01 01 02 08 0a 04 01 65 02   ..............e.
+|   4000: 02 0a 05 01 65 02 06 01 01 0a 04 12 14 0f 06 31   ....e..........1
+|   4016: 84 80 80 80 80 01 03 00 68 00 00 00 2b 02 30 65   ........h...+.0e
+|   4032: 01 10 02 05 05 01 01 04 03 03 02 01 66 01 12 03   ............f...
+|   4048: 05 05 01 01 03 06 04 03 03 01 65 01 0e 04 05 05   ..........e.....
+|   4064: 01 01 02 08 04 0d 0e 06 01 03 00 12 04 4c 4c 00   .............LL.
+|   4080: 00 00 11 24 00 00 00 00 01 01 01 00 01 01 01 01   ...$............
+| page 3 offset 8192
+|      0: 0a 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ./..............
+| page 4 offset 12288
+|   3344: 00 00 00 00 00 00 00 00 00 00 81 52 04 06 10 81   ...........R....
+|   3360: 5d 81 55 65 20 65 65 20 65 65 65 20 65 20 65 65   ].Ue ee eee e ee
+|   3376: 20 65 65 65 20 65 20 65 65 20 65 65 65 65 20 65    eee e ee eeee e
+|   3392: 65 20 65 65 65 24 a5 20 65 65 20 65 65 65 20 65   e eee$. ee eee e
+|   3408: 24 05 65 20 65 65 65 65 20 65 65 20 65 65 65 20   $.e eeee ee eee 
+|   3424: 65 20 65 65 20 65 65 65 20 65 20 65 65 20 65 65   e ee eee e ee ee
+|   3440: 65 65 20 65 65 20 65 65 65 20 65 20 65 65 10 65   ee ee eee e ee.e
+|   3456: 65 65 20 65 20 65 65 20 65 65 65 65 65 65 20 65   ee e ee eeeeee e
+|   3472: 65 20 65 20 65 20 65 20 65 65 20 65 65 65 20 65   e e e e ee eee e
+|   3488: 1f 20 65 65 66 65 65 20 65 65 20 65 20 65 20 2d   . eefee ee e e -
+| page 5 offset 16384
+|   4064: 00 00 00 00 05 04 d0 00 10 21 21 05 03 03 00 10   .........!!.....
+|   4080: 11 11 05 02 03 00 10 11 10 05 01 03 00 10 09 09   ................
+| page 6 offset 20480
+|      0: 0a 00 00 00 01 0f f4 00 0f f4 00 00 00 00 00 00   ................
+|   4080: 00 00 00 00 0b 03 1b 01 76 65 72 73 69 6f 6e 04   ........version.
+| end sql022250.txt.db
+}]} {}
+
+do_catchsql_test 70.1 {
+  SELECT snippet(ttt, -1, '', '','','>')FROM ttt('e* NOT ee*e* NOT ee*');
+} {1 {database disk image is malformed}}
+
+do_catchsql_test 70.2 {
+  SELECT snippet(ttt, -1, '', '','',13)FROM ttt('e* NOT ee*e* NOT ee*')
+} {1 {database disk image is malformed}}
+
 sqlite3_fts5_may_be_corrupt 0
 finish_test
 

diff --git a/manifest b/manifest
index eced676a27c58bc75671d81cabbc16f74b8358e7..d9ff67a4105826a25c8af7e313178d301fddb2df 100644 (file)
--- a/manifest
+++ b/manifest
@@ -1,5 +1,5 @@
-C Earlier\sdetection\sof\scorruption\sin\sthe\srtreecheck()\sSQL\sfunction\sto\sprevent\na\s(harmless)\sread\sof\san\suninitialized\svalue.
-D 2020-09-17T11:56:04.753
+C Fix\sa\s"jump\sdepends\son\sunitialized\svalue"\svalgrind/asan\serror\sin\sfts5.
+D 2020-09-17T14:16:02.879
 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
 F LICENSE.md df5091916dbb40e6e9686186587125e1b2ff51f022cc334e886c19a0e9982724
@@ -118,7 +118,7 @@ F ext/fts5/fts5_buffer.c 5a5fe0159752c0fb0a5a93c722e9db2662822709490769d482b76a6
 F ext/fts5/fts5_config.c b447948f35ad3354e8fe5e242e0a7e7b5b941555400b9404259944e3aa570037
 F ext/fts5/fts5_expr.c b7b28ed203a3140f2fc503507d2c614a6cf1bd2e8987497f8894abc3f1477ec4
 F ext/fts5/fts5_hash.c 1cc0095646f5f3b46721aa112fb4f9bf29ae175cb5338f89dcec66ed97acfe75
-F ext/fts5/fts5_index.c de14c9a30f45e2b847ff9284b14776d9d07961e545e8f1546a6aa3f915af721f
+F ext/fts5/fts5_index.c 203a8db4c35923f584e1a79cb43aa389710db6fb3ace72aad476e15b4dbd7b3e
 F ext/fts5/fts5_main.c e881a2ea0bf01b3a3ff0bc1b31373c58fd54b6c9f3c43ea3d431bea4e5d4025e
 F ext/fts5/fts5_storage.c 34774cac00302fee7c6ffe05e12ec38f90777fb1681245538c97357cf5eb5d0e
 F ext/fts5/fts5_tcl.c 39bcbae507f594aad778172fa914cad0f585bf92fd3b078c686e249282db0d95
@@ -159,7 +159,7 @@ F ext/fts5/test/fts5connect.test 08030168fc96fc278fa81f28654fb7e90566f33aff269c0
 F ext/fts5/test/fts5content.test 213506436fb2c87567b8e31f6d43ab30aab99354cec74ed679f22aad0cdbf283
 F ext/fts5/test/fts5corrupt.test 77ae6f41a7eba10620efb921cf7dbe218b0ef232b04519deb43581cb17a57ebe
 F ext/fts5/test/fts5corrupt2.test 7453752ba12ce91690c469a6449d412561cc604b1dec994e16ab132952e7805f
-F ext/fts5/test/fts5corrupt3.test 4f5b2f278c1ce8a03b3de77de3bd698216986cc3f6b8428075708ae9eebe0656
+F ext/fts5/test/fts5corrupt3.test b8d4d6f167b8189999dac7162ddec614ab9dca4fe5e9dcfd315e383a5e15444b
 F ext/fts5/test/fts5corrupt4.test ea805c4d7c68b5f185b9db5d2060a7ae5875339738dd48203c92162f41e7ca91
 F ext/fts5/test/fts5delete.test 4a15fb03b6c7eac62ac807a3a32b7f0dc74f0d479c410e3e3568ae96b9469290
 F ext/fts5/test/fts5detail.test 31b240dbf6d44ac3507e2f8b65f29fdc12465ffd531212378c7ce1066766f54e
@@ -1880,7 +1880,7 @@ F vsixtest/vsixtest.tcl 6a9a6ab600c25a91a7acc6293828957a386a8a93
 F vsixtest/vsixtest.vcxproj.data 2ed517e100c66dc455b492e1a33350c1b20fbcdc
 F vsixtest/vsixtest.vcxproj.filters 37e51ffedcdb064aad6ff33b6148725226cd608e
 F vsixtest/vsixtest_TemporaryKey.pfx e5b1b036facdb453873e7084e1cae9102ccc67a0
-P 751fe4edb2d4602e652523c2759de3f4fffd29d5c66cae68caf45b30fd8b750a
-R 46006fc1e92c35a627434427e02a14ec
-U drh
-Z 71d35069d355b0f119ebbc1395c98fe2
+P e2074b24788149562b15022ccd2784d6649f08ebc41410e3bfb2401baf0892e2
+R bd8ccc85abca0add0ad4396bb891f5d8
+U dan
+Z ca21c240461161621919580474841b3f

diff --git a/manifest.uuid b/manifest.uuid
index 3dd2d87f5d8879b652bc2d2af31d04d465e5721e..89eb9b710830c476ca3ab1f8d6c1a7b9dfd8b969 100644 (file)
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-e2074b24788149562b15022ccd2784d6649f08ebc41410e3bfb2401baf0892e2
\ No newline at end of file
+66f94d623c16b4527e42f0519e32ec78eaf9ee6fd61ee7d0eb657cc59a8f7d68
\ No newline at end of file