Fix a problem in the sessions module causing sqlite3session_apply_strm() to

allocate enough memory for the entire input buffer - which defeats the point
of a streaming interface.

FossilOrigin-Name: 7594e60935b0b5dcf764476dccdf9b403303818a0419a30bc2c16d58e44f6d04

diff --git a/ext/session/sessionG.test b/ext/session/sessionG.test
index 2b6c0410a7c0bac91c365c05b12b60d6dc17da0d..1b5f5473f02aa39add8d4d4c48faa402a5b5fffa 100644 (file)
--- a/ext/session/sessionG.test
+++ b/ext/session/sessionG.test
@@ -204,7 +204,47 @@ do_test 5.1 {
   }
 } {1 2 3 7 8 9}
 
+#-------------------------------------------------------------------------
+
+reset_db 
+db func number_name number_name
+do_execsql_test 6.0 {
+  CREATE TABLE t1(a INTEGER PRIMARY KEY, b);
+  CREATE UNIQUE INDEX t1b ON t1(b);
+  WITH s(i) AS (
+    SELECT 1
+    UNION ALL
+    SELECT i+1 FROM s WHERE i<1000
+  )
+  INSERT INTO t1 SELECT i, number_name(i) FROM s;
+}
+
+do_test 6.1 {
+  db eval BEGIN
+  set ::C [changeset_from_sql {
+    DELETE FROM t1;
+    WITH s(i) AS (
+        SELECT 1
+        UNION ALL
+        SELECT i+1 FROM s WHERE i<1000
+    )
+    INSERT INTO t1 SELECT i, number_name(i+1) FROM s;
+  }]
+  db eval ROLLBACK
+  execsql { SELECT count(*) FROM t1 WHERE number_name(a) IS NOT b }
+} {0}
+
+proc xConflict {args} { exit ; return "OMIT" }
+do_test 6.2 {
+  sqlite3changeset_apply db $C xConflict
+} {}
+
+do_execsql_test 6.3 { SELECT count(*) FROM t1; } {1000}
+do_execsql_test 6.4 { 
+  SELECT count(*) FROM t1 WHERE number_name(a+1) IS NOT b; 
+} {0}
 
+# db eval { SELECT * FROM t1 } { puts "$a || $b" }
 
 
 finish_test

diff --git a/ext/session/session_common.tcl b/ext/session/session_common.tcl
index d08d142df853c7592a26141590a247c39330537e..543b97032776431a4acc42b157effe8b5ae1f9a6 100644 (file)
--- a/ext/session/session_common.tcl
+++ b/ext/session/session_common.tcl
@@ -170,3 +170,29 @@ proc changeset_to_list {c} {
   lsort $list
 }
 
+set ones {zero one two three four five six seven eight nine
+          ten eleven twelve thirteen fourteen fifteen sixteen seventeen
+          eighteen nineteen}
+set tens {{} ten twenty thirty forty fifty sixty seventy eighty ninety}
+proc number_name {n} {
+  if {$n>=1000} {
+    set txt "[number_name [expr {$n/1000}]] thousand"
+    set n [expr {$n%1000}]
+  } else {
+    set txt {}
+  }
+  if {$n>=100} {
+    append txt " [lindex $::ones [expr {$n/100}]] hundred"
+    set n [expr {$n%100}]
+  }
+  if {$n>=20} {
+    append txt " [lindex $::tens [expr {$n/10}]]"
+    set n [expr {$n%10}]
+  }
+  if {$n>0} {
+    append txt " [lindex $::ones $n]"
+  }
+  set txt [string trim $txt]
+  if {$txt==""} {set txt zero}
+  return $txt
+}

diff --git a/ext/session/sqlite3session.c b/ext/session/sqlite3session.c
index 7a9de6fd253e248da0d7609f7493a78c21175711..a59d38c804c192244ad3394fe382e6b0f055a0b9 100644 (file)
--- a/ext/session/sqlite3session.c
+++ b/ext/session/sqlite3session.c
@@ -68,7 +68,7 @@ struct SessionBuffer {
 **  sqlite3changeset_start_strm()).
 */
 struct SessionInput {
-  int bNoDiscard;                 /* If true, discard no data */
+  int bNoDiscard;                 /* If true, do not discard in InputBuffer() */
   int iCurrent;                   /* Offset in aData[] of current change */
   int iNext;                      /* Offset in aData[] of next change */
   u8 *aData;                      /* Pointer to buffer containing changeset */
@@ -2593,7 +2593,7 @@ int sqlite3changeset_start_strm(
 ** object and the buffer is full, discard some data to free up space.
 */
 static void sessionDiscardData(SessionInput *pIn){
-  if( pIn->bEof && pIn->xInput && pIn->iNext>=SESSIONS_STRM_CHUNK_SIZE ){
+  if( pIn->xInput && pIn->iNext>=SESSIONS_STRM_CHUNK_SIZE ){
     int nMove = pIn->buf.nBuf - pIn->iNext;
     assert( nMove>=0 );
     if( nMove>0 ){

diff --git a/manifest b/manifest
index 95257b302ab3b904e8379b33c1da9a6341023317..60b8475b363553e17e2c2203c9efe8aec3e6cce1 100644 (file)
--- a/manifest
+++ b/manifest
@@ -1,5 +1,5 @@
-C Fix\san\sinstance\swhere\san\suninitialized\sVM\sregister\smight\sbe\saccessed.\sFix\sfor\n[093420fc0].\sThis\sproblem\swas\sfound\sby\sOSSFuzz.
-D 2018-04-05T16:26:39.633
+C Fix\sa\sproblem\sin\sthe\ssessions\smodule\scausing\ssqlite3session_apply_strm()\sto\nallocate\senough\smemory\sfor\sthe\sentire\sinput\sbuffer\s-\swhich\sdefeats\sthe\spoint\nof\sa\sstreaming\sinterface.
+D 2018-04-06T16:22:25.544
 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
 F Makefile.in 7016fc56c6b9bfe5daac4f34be8be38d8c0b5fab79ccbfb764d3b23bf1c6fff3
@@ -393,9 +393,9 @@ F ext/session/sessionC.test 97556f5164ac29f2344b24bd7de6a3a35a95c390
 F ext/session/sessionD.test d3617e29aa15c9413aee5286d99587633245d58d2ad28f3f331c822735418a22
 F ext/session/sessionE.test 0a616c4ad8fd2c05f23217ebb6212ef80b7fef30f5f086a6633a081f93e84637
 F ext/session/sessionF.test c2f178d4dfd723a5fd94a730ea2ccb44c669e3ce
-F ext/session/sessionG.test 63f9a744341d670775af29e4f19c1ef09a4810798400f28cd76704803a2e56ff
+F ext/session/sessionG.test 3edde849c4071078d92bd682c836186f6e4e5a3fb6bcf3fc1de1a7caa5e4427d
 F ext/session/sessionH.test 332b60e4c2e0a680105e11936201cabe378216f307e2747803cea56fa7d9ebae
-F ext/session/session_common.tcl 748141b02042b942e04a7afad9ffb2212a3997de536ed95f6dec7bb5018ede2c
+F ext/session/session_common.tcl ee925e0d233677e45e395fb1f559b84068ce7baa8aa1034441739d3e87ee249c
 F ext/session/session_speed_test.c edc1f96fd5e0e4b16eb03e2a73041013d59e8723
 F ext/session/sessionat.test efe88965e74ff1bc2af9c310b28358c02d420c1fb2705cc7a28f0c1cc142c3ec
 F ext/session/sessiondiff.test ad13dd65664bae26744e1f18eb3cbd5588349b7e9118851d8f9364248d67bcec
@@ -404,7 +404,7 @@ F ext/session/sessionfault2.test 555a8504de03d59b369ef20209585da5aeb2671dedabc45
 F ext/session/sessionrebase.test 4e1bcfd26fd8ed8ac571746f56cceeb45184f4d65490ea0d405227cfc8a9cba8
 F ext/session/sessionstat1.test 41cd97c2e48619a41cdf8ae749e1b25f34719de638689221aa43971be693bf4e
 F ext/session/sessionwor.test 2f3744236dc8b170a695b7d8ddc8c743c7e79fdc
-F ext/session/sqlite3session.c 4e21db8d2abb7960ded6f66e745671442e3ae2156a5ff8f7cf07567c507c324e
+F ext/session/sqlite3session.c 305010d5bc85f362584bfb72a5efea30e8826f13c44ab9dddd19484d627e2b5a
 F ext/session/sqlite3session.h 85fd2dc3df1532b0695beb345e2ff375c2745a4654b405fcbe33afa18baa6cc7
 F ext/session/test_session.c f253742ea01b089326f189b5ae15a5b55c1c9e97452e4a195ee759ba51b404d5
 F ext/userauth/sqlite3userauth.h 7f3ea8c4686db8e40b0a0e7a8e0b00fac13aa7a3
@@ -1717,7 +1717,7 @@ F vsixtest/vsixtest.tcl 6a9a6ab600c25a91a7acc6293828957a386a8a93
 F vsixtest/vsixtest.vcxproj.data 2ed517e100c66dc455b492e1a33350c1b20fbcdc
 F vsixtest/vsixtest.vcxproj.filters 37e51ffedcdb064aad6ff33b6148725226cd608e
 F vsixtest/vsixtest_TemporaryKey.pfx e5b1b036facdb453873e7084e1cae9102ccc67a0
-P 813224363d9ac22fcb37f657c4ac988f76fa39989301faec7206e9ba0b1f4476
-R cae01c8291d23da69cc5aa77b99118c4
+P a3b02db74681a215996c5ed110eb0ece5ed24f71a1b131c10e9f33e666af0256
+R 5059e4d4d3f966cfa7e79d77bd6fbafb
 U dan
-Z 1966dc25d6a57735507047d33d15df2f
+Z dbbf8c12c9669496ce9d7e293c2273c3

diff --git a/manifest.uuid b/manifest.uuid
index 3b340bb861bea5e831a52d189c21d37081b899d6..04fae7dc930881e578bbf9a67fdb45bfcc1f7e27 100644 (file)
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-a3b02db74681a215996c5ed110eb0ece5ed24f71a1b131c10e9f33e666af0256
\ No newline at end of file
+7594e60935b0b5dcf764476dccdf9b403303818a0419a30bc2c16d58e44f6d04
\ No newline at end of file