Fix a potential buffer overrun in fts5 caused by corrupted database records.

FossilOrigin-Name: c465d0eb478e42045e08efe8b6fa64d4bd4d747cdf743beae4608562b014169e

diff --git a/ext/fts5/fts5_index.c b/ext/fts5/fts5_index.c
index 3fa97c2feae20cbab888595009d51837f393d365..c0f7ac551afd4aa2f7a26aac141f9f9b799b0c7e 100644 (file)
--- a/ext/fts5/fts5_index.c
+++ b/ext/fts5/fts5_index.c
@@ -5050,6 +5050,12 @@ static void fts5MergePrefixLists(
         }
 
         /* WRITEPOSLISTSIZE */
+        assert_nc( tmp.n<=i1.nPoslist+i2.nPoslist );
+        assert( tmp.n<=i1.nPoslist+i2.nPoslist+10+10 );
+        if( tmp.n>i1.nPoslist+i2.nPoslist ){
+          if( p->rc==SQLITE_OK ) p->rc = FTS5_CORRUPT;
+          break;
+        }
         fts5BufferSafeAppendVarint(&out, tmp.n * 2);
         fts5BufferSafeAppendBlob(&out, tmp.p, tmp.n);
         fts5DoclistIterNext(&i1);

diff --git a/ext/fts5/test/fts5corrupt3.test b/ext/fts5/test/fts5corrupt3.test
index 306ae9fe03f6bd498a4ef0808d94c07ad273d9af..a7da137b1173801dd27d6fc05177c8f2b96067ba 100644 (file)
--- a/ext/fts5/test/fts5corrupt3.test
+++ b/ext/fts5/test/fts5corrupt3.test
@@ -6908,7 +6908,7 @@ do_catchsql_test 50.1 {
 
 #-------------------------------------------------------------------------
 reset_db
-do_execsql_test 51.1 {
+do_execsql_test 51.0 {
 BEGIN TRANSACTION;
 PRAGMA writable_schema=ON;
 CREATE VIRTUAL TABLE t1 USING fts5(a,b,c);
@@ -6976,7 +6976,7 @@ COMMIT;
 
 do_catchsql_test 51.1 {
   SELECT max(rowid)==0 FROM t1('e*');
-} {0 0}
+} {1 {database disk image is malformed}}
 
 #--------------------------------------------------------------------------
 reset_db
@@ -8544,7 +8544,7 @@ do_test 59.0 {
 
 do_catchsql_test 59.1 {
   SELECT (matchinfo(591,t1)) FROM t1 WHERE t1 MATCH 'e*e\9f'
-} {0 {}}
+} {1 {database disk image is malformed}}
 
 #-------------------------------------------------------------------------
 do_test 60.0 {
@@ -8750,7 +8750,7 @@ do_test 60.0 {
 
 do_catchsql_test 60.2 {
   SELECT (matchinfo(t1,591)) FROM t1 WHERE t1 MATCH 'e*e\9f'
-} {0 {}}
+} {1 {database disk image is malformed}}
 
 #-------------------------------------------------------------------------
 do_test 61.0 {
@@ -9491,6 +9491,209 @@ do_catchsql_test 64.1 {
   SELECT * FROM ttt('e*');
 } {1 {database disk image is malformed}}
 
+#---------------------------------------------------------------------------
+do_test 65.0 {
+  sqlite3 db {}
+  db deserialize [decode_hexdb {
+.open --hexdb
+| size 28672 pagesize 4096 filename crash-3aef66940ace0c.db
+| page 1 offset 0
+|      0: 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00   SQLite format 3.
+|     16: 10 00 01 01 00 40 20 20 00 00 00 00 00 00 00 00   .....@  ........
+|     96: 00 00 00 00 0d 0f c7 00 07 0d 92 00 0f 8d 0f 36   ...............6
+|    112: 0e cb 0e 6b 0e 0e 0d b6 0d 92 00 00 00 00 00 00   ...k............
+|   3472: 00 00 22 08 06 17 11 11 01 31 74 61 62 6c 65 74   .........1tablet
+|   3488: 32 74 32 08 43 52 45 41 54 45 20 54 41 42 4c 45   2t2.CREATE TABLE
+|   3504: 20 74 32 28 78 29 56 07 06 17 1f 1f 01 7d 74 61    t2(x)V.......ta
+|   3520: 62 6c 65 74 31 5f 63 6f 6e 66 69 67 74 31 5f 63   blet1_configt1_c
+|   3536: 6f 6e 66 69 67 07 43 52 45 41 54 45 20 54 41 42   onfig.CREATE TAB
+|   3552: 4c 45 20 27 74 31 5f 63 6f 6e 66 69 67 27 28 6b   LE 't1_config'(k
+|   3568: 20 50 52 49 4d 41 52 59 20 4b 45 59 2c 20 76 29    PRIMARY KEY, v)
+|   3584: 20 57 49 54 48 4f 55 54 20 52 4f 57 49 44 5b 06    WITHOUT ROWID[.
+|   3600: 07 17 21 21 01 81 01 74 61 62 6c 65 74 31 5f 64   ..!!...tablet1_d
+|   3616: 6f 63 73 69 7a 65 74 31 5f 64 6f 63 73 69 7a 65   ocsizet1_docsize
+|   3632: 06 43 52 45 41 54 45 20 54 41 42 4c 45 20 27 74   .CREATE TABLE 't
+|   3648: 31 5f 64 6f 63 73 69 7a 65 27 28 69 64 20 49 4e   1_docsize'(id IN
+|   3664: 54 45 47 45 52 20 50 52 49 4d 41 52 59 20 4b 45   TEGER PRIMARY KE
+|   3680: 59 2c 20 73 7a 20 42 4c 4f 42 29 5e 05 07 17 21   Y, sz BLOB)^...!
+|   3696: 21 01 81 07 74 61 62 6c 65 74 31 5f 63 6f 6e 74   !...tablet1_cont
+|   3712: 65 6e 74 74 31 5f 63 6f 6e 74 65 6e 74 05 43 52   entt1_content.CR
+|   3728: 45 41 54 45 20 54 41 42 4c 45 20 27 74 31 5f 63   EATE TABLE 't1_c
+|   3744: 6f 6e 74 65 6e 74 27 28 69 64 20 49 4e 54 45 47   ontent'(id INTEG
+|   3760: 45 52 20 50 52 49 4d 41 52 59 20 4b 45 59 2c 20   ER PRIMARY KEY, 
+|   3776: 63 30 2c 20 63 31 2c d6 63 32 29 69 04 07 17 19   c0, c1,.c2)i....
+|   3792: 19 01 81 2d 74 61 62 6c 65 74 31 5f 69 64 78 74   ...-tablet1_idxt
+|   3808: 31 5f 69 64 78 04 43 52 45 41 54 45 20 54 41 42   1_idx.CREATE TAB
+|   3824: 4c 45 20 27 74 31 5f 69 64 78 27 28 73 65 67 69   LE 't1_idx'(segi
+|   3840: 64 2c 20 74 65 72 6d 2c 20 70 67 6e 6f 2c 20 50   d, term, pgno, P
+|   3856: 52 49 4d 41 52 59 20 4b 45 59 28 73 65 67 69 64   RIMARY KEY(segid
+|   3872: 2c 20 74 65 72 6d 29 29 20 57 49 54 48 4f 55 54   , term)) WITHOUT
+|   3888: 20 52 4f 57 49 44 55 03 07 17 1b 1b 01 81 01 74    ROWIDU........t
+|   3904: 61 62 6c 65 74 31 5f 64 61 74 61 74 31 5f 64 61   ablet1_datat1_da
+|   3920: 74 61 03 43 52 45 41 54 45 20 54 41 42 4c 45 20   ta.CREATE TABLE 
+|   3936: 27 74 31 5f 64 61 74 61 27 28 69 64 20 49 4e 54   't1_data'(id INT
+|   3952: 45 47 45 52 20 50 52 49 4d 41 52 59 20 4b 45 59   EGER PRIMARY KEY
+|   3968: 2c 20 62 6c 6f 63 6b 20 42 4c 4f 42 29 38 02 06   , block BLOB)8..
+|   3984: 17 11 11 08 5f 74 61 62 6c 65 74 31 74 31 43 52   ...._tablet1t1CR
+|   4000: 45 41 54 45 20 56 49 52 54 55 41 4c 20 54 41 42   EATE VIRTUAL TAB
+|   4016: 4c 45 20 74 31 20 55 53 49 4e 47 20 66 74 73 35   LE t1 USING fts5
+|   4032: 28 61 2c 62 2c 63 29 00 00 00 00 00 00 00 00 00   (a,b,c).........
+| page 3 offset 8192
+|      0: 0d 00 00 00 03 0c 93 ff 0f e6 0f ef 0c 94 00 00   ................
+|   3216: 00 00 00 00 86 4a 84 80 80 80 80 01 04 00 8d 18   .....J..........
+|   3232: 00 00 03 2b 02 30 30 01 02 06 01 02 06 01 02 06   ...+.00.........
+|   3248: 1f 02 03 01 02 03 01 02 03 01 08 32 31 31 36 30   ...........21160
+|   3264: 36 30 39 01 02 07 01 02 07 01 02 07 01 01 33 f1   609...........3.
+|   3280: 02 05 01 02 05 01 02 05 01 01 35 01 02 03 01 02   ..........5.....
+|   3296: 04 01 02 04 02 07 30 30 30 30 30 30 30 1c 02 3d   ......0000000..=
+|   3312: 01 02 04 01 02 04 01 06 62 69 6e 61 72 79 03 06   ........binary..
+|   3328: 01 02 02 03 06 01 01 f2 03 06 4e 02 02 03 06 01   ..........N.....
+|   3344: 02 02 03 06 01 02 02 03 06 01 02 02 03 06 01 02   ................
+|   3360: 02 03 06 01 02 02 03 06 01 02 02 03 06 01 02 02   ................
+|   3376: 03 06 01 02 02 03 06 01 02 02 01 08 63 6f 6d 70   ............comp
+|   3392: 69 6c 65 72 01 02 02 01 02 02 01 02 02 01 06 64   iler...........d
+|   3408: 62 73 74 61 74 07 02 03 01 02 13 01 02 03 02 04   bstat...........
+|   3424: 65 62 75 67 04 02 02 01 02 02 01 02 02 01 07 65   ebug...........e
+|   3440: 6e 61 62 6c 65 07 02 02 01 02 02 01 02 02 01 02   nable...........
+|   3456: 02 01 02 02 01 02 02 01 02 02 01 02 02 01 02 02   ................
+|   3472: 01 02 02 01 02 01 f1 02 02 01 02 02 01 02 02 01   ................
+|   3488: 02 02 01 02 02 01 02 02 01 02 02 01 02 02 01 02   ................
+|   3504: 02 01 02 02 02 08 76 b4 65 6e 73 69 6f 6e 1f 02   ......v.ension..
+|   3520: 04 01 02 04 01 02 04 01 04 66 74 73 34 0a 02 03   .........fts4...
+|   3536: 01 02 03 01 02 03 04 01 25 0d 02 03 01 02 03 01   ........%.......
+|   3552: 02 03 01 03 67 63 63 01 02 03 01 02 03 01 02 03   ....gcc.........
+|   3568: 02 06 65 6f 70 6f 6c 79 0f f2 03 01 02 03 01 02   ..eopoly........
+|   3584: 03 01 05 6a 73 6f 6e 31 13 02 03 01 02 03 01 02   ...json1........
+|   3600: 03 01 04 6c 6f 61 64 1f 02 03 01 02 03 01 02 03   ...load.........
+|   3616: 00 03 6d 61 78 1c 02 0c 01 02 02 01 02 02 02 05   ..max...........
+|   3632: 65 6d 6f 72 79 1c 02 03 01 02 03 01 02 03 04 04   emory...........
+|   3648: 73 79 73 35 16 02 03 01 02 03 01 02 03 01 06 6e   sys5...........n
+|   3664: 6f 63 61 73 65 02 06 01 02 02 13 06 00 f2 02 03   ocase...........
+|   3680: 06 01 12 02 13 06 01 02 02 03 06 01 02 02 03 06   ................
+|   3696: 01 02 02 03 06 01 02 02 03 06 01 02 02 03 06 01   ................
+|   3712: 02 02 03 06 01 02 02 03 06 01 02 02 03 06 01 02   ................
+|   3728: 02 01 04 6f 6d 69 74 1f 02 02 01 02 02 01 02 02   ...omit.........
+|   3744: 01 05 72 74 72 65 65 19 02 03 01 02 03 01 02 03   ..rtree.........
+|   3760: 04 02 69 6d 01 06 01 02 02 03 06 01 02 02 03 06   ..im............
+|   3776: 01 02 02 03 06 01 02 02 03 06 01 02 02 03 06 01   ................
+|   3792: 02 02 03 06 01 02 02 03 06 01 02 02 8e 06 01 02   ................
+|   3808: 02 03 06 01 02 02 03 06 01 02 02 03 06 01 02 02   ................
+|   3824: 01 0a 74 68 72 65 61 64 73 61 66 65 22 02 02 01   ..threadsafe....
+|   3840: 02 02 01 02 02 01 04 76 74 61 62 07 02 04 01 02   .......vtab.....
+|   3856: 04 01 02 04 01 01 78 01 06 01 01 02 01 06 01 01   ......x.........
+|   3872: 02 01 06 01 01 02 01 06 01 01 02 01 06 01 01 02   ................
+|   3888: 01 06 01 11 02 01 06 01 01 02 01 06 01 01 02 01   ................
+|   3904: 06 01 01 02 01 06 01 01 02 01 06 01 01 02 01 06   ................
+|   3920: 01 01 02 01 06 01 01 01 01 06 01 01 02 01 06 01   ................
+|   3936: 01 02 01 06 01 01 02 01 06 01 01 02 01 06 01 01   ................
+|   3952: 02 01 06 01 01 01 f1 06 01 01 02 ad 06 01 01 02   ................
+|   3968: 01 06 01 01 02 01 06 01 01 02 01 06 01 01 02 01   ................
+|   3984: 06 01 01 01 01 06 01 01 02 01 06 01 01 02 01 06   ................
+|   4000: 01 01 02 01 06 01 01 02 01 06 01 01 02 01 06 01   ................
+|   4016: 01 02 01 06 01 01 02 01 06 01 01 02 01 06 01 01   ................
+|   4032: 02 01 06 01 01 02 01 06 01 01 02 04 15 13 0c 0c   ................
+|   4048: 12 44 13 11 0f 47 13 0e fc 0e 11 10 0f 0e 10 0f   .D...G..........
+|   4064: 44 0f 10 40 15 0f 07 01 03 00 14 24 5a 24 24 0f   D..@.......$Z$$.
+|   4080: 0a 03 00 24 00 00 00 00 01 01 01 00 01 01 01 01   ...$............
+| page 4 offset 12288
+|      0: 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
+|   4080: 00 00 00 00 00 00 00 00 00 00 05 04 09 0c 01 02   ................
+| page 5 offset 16384
+|      0: 0d 00 00 00 24 0c 0a 00 00 00 00 00 00 00 00 00   ....$...........
+|   3072: 00 00 00 00 00 00 00 00 00 00 18 24 05 00 25 0f   ...........$..%.
+|   3088: 19 54 48 52 45 41 44 53 41 46 45 3d 30 58 42 49   .THREADSAFE=0XBI
+|   3104: 4e 41 52 59 18 23 05 00 25 0f 19 54 48 52 45 41   NARY.#..%..THREA
+|   3120: 44 53 41 46 45 3d 30 58 4e 4f 43 41 53 45 17 8f   DSAFE=0XNOCASE..
+|   3136: 05 00 25 0f 17 54 48 52 45 41 44 43 41 46 45 3d   ..%..THREADCAFE=
+|   3152: 30 58 52 54 52 49 4d 1f 21 05 00 33 0f 19 4f 4d   0XRTRIM.!..3..OM
+|   3168: 49 54 20 4b 4f 41 44 21 45 58 54 45 4e 53 49 4f   IT KOAD!EXTENSIO
+|   3184: 4e 58 42 49 4e 41 52 59 1f 20 05 00 33 0f 19 4f   NXBINARY. ..3..O
+|   3200: 4d 49 54 20 4c 4f 41 44 20 45 58 54 45 4e 53 49   MIT LOAD EXTENSI
+|   3216: 4f 4e 58 4e 4f 43 41 53 45 1e 1f 05 00 33 0f 17   ONXNOCASE....3..
+|   3232: 4f 4d 59 54 20 4c 4f 41 44 20 45 58 54 45 4e 53   OMYT LOAD EXTENS
+|   3248: 49 4f 4e 58 52 54 56 a9 4d 1f 1e 05 00 33 0f 19   IONXRTV.M....3..
+|   3264: 4d 41 58 20 4d 45 4d 4f 52 59 3d 35 30 30 30 30   MAX MEMORY=50000
+|   3280: 30 30 30 57 42 49 4e 31 52 59 1f 1d 05 00 33 0f   000WBIN1RY....3.
+|   3296: 19 4d 41 58 20 4d 45 4d 4f 52 59 3d 35 30 30 30   .MAX MEMORY=5000
+|   3312: 30 30 30 30 58 4e 4f 43 41 53 45 1e 1c 05 00 32   0000XNOCASE....2
+|   3328: 0f 17 4e 41 58 20 4d 45 4d 4f 52 59 2d 35 30 30   ..NAX MEMORY-500
+|   3344: 30 30 30 30 30 58 52 54 52 49 4d 18 1b 05 00 25   00000XRTRIM....%
+|   3360: 0f 19 45 4e 41 42 4c 45 20 52 54 52 45 45 58 42   ..ENABLE RTREEXB
+|   3376: 49 4e 41 52 59 18 1a 05 00 25 0f 19 45 4e 41 42   INARY....%..ENAB
+|   3392: 4c 45 20 52 54 52 45 45 59 4e 4f 43 41 53 45 17   LE RTREEYNOCASE.
+|   3408: 19 66 00 25 0f 17 45 4e 41 42 4c 45 20 52 54 52   .f.%..ENABLE RTR
+|   3424: 45 45 58 52 54 52 49 4d 1a 18 05 00 29 0f 19 45   EEXRTRIM....)..E
+|   3440: 4e 41 42 4c 45 20 4d 45 4d 53 59 53 35 58 42 49   NABLE MEMSYS5XBI
+|   3456: 4e 41 52 59 1a 17 05 00 29 0f 19 45 4e 41 42 4c   NARY....)..ENABL
+|   3472: 45 20 4d 45 4d 53 59 53 35 58 4e 4f 43 41 53 45   E MEMSYS5XNOCASE
+|   3488: 19 16 05 00 29 0f 17 45 4e 41 42 4c 45 20 4d 45   ....)..ENABLE ME
+|   3504: 4d 53 59 53 35 58 52 54 52 49 4d 18 15 05 10 25   MSYS5XRTRIM....%
+|   3520: 0f 19 45 4e 40 42 4c 45 20 4a 53 4f 4e 31 58 42   ..EN@BLE JSON1XB
+|   3536: 49 4e 41 52 59 18 14 05 00 25 0f 19 45 4e 41 42   INARY....%..ENAB
+|   3552: 4c 45 20 4a 53 4f 4e 32 58 4e 4f 43 41 53 45 17   LE JSON2XNOCASE.
+|   3568: 13 05 00 25 0f 17 45 4d 41 42 4c 45 20 4a 53 4f   ...%..EMABLE JSO
+|   3584: 4e 31 58 52 54 52 49 4d 1a 12 05 00 29 0f 19 45   N1XRTRIM....)..E
+|   3600: 4e 41 42 4c 45 20 47 45 4f 50 4f 4c 59 58 42 49   NABLE GEOPOLYXBI
+|   3616: 4e 41 52 59 1a 11 05 00 29 0f 19 45 4f 81 42 4c   NARY....)..EO.BL
+|   3632: 45 20 47 45 4f 50 4f 4c 59 58 4e 4f 43 51 53 45   E GEOPOLYXNOCQSE
+|   3648: 19 10 05 00 29 0f 17 45 4e 41 42 4c 45 20 47 45   ....)..ENABLE GE
+|   3664: 4f 50 4f 4c 59 58 52 54 52 49 4d 17 0f 05 00 23   OPOLYXRTRIM....#
+|   3680: 0f 1a 45 4e 41 42 4c 45 20 46 54 53 35 58 42 49   ..ENABLE FTS5XBI
+|   3696: 4e 41 52 59 17 0e 05 00 23 0f 19 45 4e 41 42 4c   NARY....#..ENABL
+|   3712: 45 20 46 54 53 35 48 4e 4f 43 41 53 45 16 1d 05   E FTS5HNOCASE...
+|   3728: 00 23 0f a4 45 4e 41 42 4c 45 20 46 54 53 35 58   .#..ENABLE FTS5X
+|   3744: 52 54 52 49 4d 17 0c 05 00 23 0f 19 45 4e 41 42   RTRIM....#..ENAB
+|   3760: 4c 45 20 46 55 53 34 58 42 49 4e 41 52 59 17 0b   LE FUS4XBINARY..
+|   3776: 05 00 23 0f 19 45 4e 41 42 4c 45 20 46 54 53 34   ..#..ENABLE FTS4
+|   3792: 57 4e 4f 43 41 53 45 16 0a 05 00 23 0f 17 45 4e   WNOCASE....#..EN
+|   3808: 41 42 4c 45 20 46 54 53 34 05 52 54 52 49 4d 1e   ABLE FTS4.RTRIM.
+|   3824: 09 05 00 31 0f 19 45 4e 41 42 4c 45 20 44 42 53   ...1..ENABLE DBS
+|   3840: 54 41 54 20 56 54 41 42 58 42 49 4e 41 52 59 1e   TAT VTABXBINARY.
+|   3856: 08 05 00 31 0f 19 45 4e 41 42 4c 45 20 44 42 53   ...1..ENABLE DBS
+|   3872: 54 41 54 20 56 54 41 42 58 4e 4f 43 41 53 45 1d   TAT VTABXNOCASE.
+|   3888: 07 05 00 31 0f 17 45 4e 41 42 4c 45 20 44 42 53   ...1..ENABLE DBS
+|   3904: 54 41 54 20 56 54 41 42 58 52 54 52 49 4d 11 06   TAT VTABXRTRIM..
+|   3920: 05 00 17 0f 19 44 45 42 55 47 58 42 8a 4e 41 52   .....DEBUGXB.NAR
+|   3936: 59 11 05 05 00 17 0f 19 44 45 42 55 47 58 4e 4f   Y.......DEBUGXNO
+|   3952: 43 41 53 45 10 04 05 00 17 0f 17 44 45 42 55 47   CASE.......DEBUG
+|   3968: 58 52 54 52 49 4d 27 03 05 00 43 0f 19 43 4f 4d   XRTRIM'...C..COM
+|   3984: 50 49 4c 45 52 3d 67 63 63 2d 35 2e 34 2e 30 20   PILER=gcc-5.4.0 
+|   4000: 32 30 31 36 30 36 30 39 58 42 49 4e 41 52 59 27   20160609XBINARY'
+|   4016: 02 05 00 43 0f 19 43 4f 4d 50 49 4c 45 52 3f 87   ...C..COMPILER?.
+|   4032: 63 63 2d 35 2e 34 2e 30 20 32 30 31 36 30 36 30   cc-5.4.0 2016060
+|   4048: 39 58 4e 4f 43 41 53 45 26 01 05 00 43 0f 17 43   9XNOCASE&...C..C
+|   4064: 45 0d 60 59 4c 45 52 3d 67 63 63 2d 35 2e 34 2d   E.`YLER=gcc-5.4-
+|   4080: 30 20 32 30 31 36 30 36 30 39 00 00 00 00 00 00   0 20160609......
+| page 6 offset 20480
+|   3808: 06 24 03 00 12 02 01 01 06 23 03 00 12 02 01 01   .$.......#......
+|   3824: 06 22 03 01 12 02 01 01 06 21 03 00 12 03 01 01   .........!......
+|   3840: 06 20 03 00 12 03 01 01 06 1f 03 00 12 03 02 01   . ..............
+|   3856: 06 1e 03 00 12 03 01 01 06 1d 03 00 12 03 01 01   ................
+|   3872: 06 1c 03 00 12 03 01 01 06 1b 03 00 12 02 01 01   ................
+|   3888: 06 1a 03 00 12 02 01 01 06 19 03 00 12 02 01 01   ................
+|   3904: 06 18 03 00 12 02 01 01 06 17 03 00 12 02 01 01   ................
+|   3920: 06 16 03 00 12 02 01 01 06 15 03 00 12 02 01 01   ................
+|   3936: 06 14 03 00 12 02 01 01 06 13 03 00 12 02 01 01   ................
+|   3952: 06 12 03 00 12 02 01 01 06 11 03 00 12 02 01 01   ................
+|   3968: 06 00 03 00 12 02 01 01 06 0f 03 00 12 02 01 01   ................
+|   3984: 06 0e 03 00 12 02 01 01 06 0d 03 00 12 02 01 01   ................
+|   4000: 06 0c 03 00 12 02 01 01 06 0b 03 00 12 02 01 01   ................
+|   4016: 06 0a 03 00 12 02 01 01 06 09 03 00 12 03 01 01   ................
+|   4032: 06 08 03 00 12 03 01 01 06 07 03 00 12 03 01 01   ................
+|   4048: 06 06 03 00 12 01 01 01 06 05 03 00 12 01 01 01   ................
+|   4064: 06 04 03 00 12 01 01 01 06 03 03 00 12 06 01 01   ................
+|   4080: 06 02 03 00 12 06 01 01 06 01 03 00 12 06 01 01   ................
+| page 7 offset 24576
+|      0: 0a 00 00 00 01 0f f4 00 0f f4 00 00 00 00 00 00   ................
+|   4080: 00 00 00 00 0b 03 1b 01 76 65 72 73 69 6f 6e 04   ........version.
+| end crash-3aef66940ace0c.db
+}]} {}
+
+do_catchsql_test 65.1 {
+  SELECT ( MATCH (t1,591)) FROM t1 WHERE t1 MATCH 'e*eŸ'
+} {1 {database disk image is malformed}}
+
+
 
 sqlite3_fts5_may_be_corrupt 0
 finish_test

diff --git a/manifest b/manifest
index af8d21924290fa2b7b2d42b52aebfb33c63204ed..1294681dced75e1e96130e642d33d897adf7d689 100644 (file)
--- a/manifest
+++ b/manifest
@@ -1,5 +1,5 @@
-C Improve\sLemon\sso\sthat\sit\senlarges\ssome\sof\sits\stables\sslightly\sin\sorder\sto\navoid\shaving\sto\sindex\srange\schecks\son\stable\slookups\sfor\sa\sperformance\nincrease.
-D 2019-08-29T00:27:12.377
+C Fix\sa\spotential\sbuffer\soverrun\sin\sfts5\scaused\sby\scorrupted\sdatabase\srecords.
+D 2019-08-29T14:25:44.718
 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
 F LICENSE.md df5091916dbb40e6e9686186587125e1b2ff51f022cc334e886c19a0e9982724
@@ -116,7 +116,7 @@ F ext/fts5/fts5_buffer.c 5a5fe0159752c0fb0a5a93c722e9db2662822709490769d482b76a6
 F ext/fts5/fts5_config.c d7523cba5e66da077233c023aecbc3e6a37978ff75a18131c5ab5b1229d5bac7
 F ext/fts5/fts5_expr.c 840c88d55e78083a5e61a35968df877712ae28791b347eced1e98e3b337d2d3c
 F ext/fts5/fts5_hash.c 1cc0095646f5f3b46721aa112fb4f9bf29ae175cb5338f89dcec66ed97acfe75
-F ext/fts5/fts5_index.c ada7661078752941e1d83bd42fe5aedef3350a1ccb9076c98153090ccd1d2f0d
+F ext/fts5/fts5_index.c b062bdb836e195656aac8d6684e943585cff4bf7d7c593c80cb67c3b6cfef7ee
 F ext/fts5/fts5_main.c b2c42f1cef9673ecdd498b22c38483a4380bcf1701d1e61b021a2945f18e42e1
 F ext/fts5/fts5_storage.c 801b4e3cd33786a60a07b6b01f86d0fbdf7e68325054e08d17176293a8081e99
 F ext/fts5/fts5_tcl.c 39bcbae507f594aad778172fa914cad0f585bf92fd3b078c686e249282db0d95
@@ -157,7 +157,7 @@ F ext/fts5/test/fts5connect.test 08030168fc96fc278fa81f28654fb7e90566f33aff269c0
 F ext/fts5/test/fts5content.test 9517cc527a8e8a33949652d5c7b5e251f8c3d5ae3f23f01d4320e30f29a0336b
 F ext/fts5/test/fts5corrupt.test 77ae6f41a7eba10620efb921cf7dbe218b0ef232b04519deb43581cb17a57ebe
 F ext/fts5/test/fts5corrupt2.test 7453752ba12ce91690c469a6449d412561cc604b1dec994e16ab132952e7805f
-F ext/fts5/test/fts5corrupt3.test 1e0a557a2c33d26a516d8ae57685a77001e9887a7457abcea6be1c4ac77332e8
+F ext/fts5/test/fts5corrupt3.test f326d70e08acffcbd8a551edd72b5723db7d3a902d288d958014c81a111cae21
 F ext/fts5/test/fts5corrupt4.test ea805c4d7c68b5f185b9db5d2060a7ae5875339738dd48203c92162f41e7ca91
 F ext/fts5/test/fts5delete.test cbf87e3b8867c4d5cfcaed975c7475fd3f99d072bce2075fcedf43d1f82af775
 F ext/fts5/test/fts5detail.test 31b240dbf6d44ac3507e2f8b65f29fdc12465ffd531212378c7ce1066766f54e
@@ -1837,8 +1837,7 @@ F vsixtest/vsixtest.tcl 6a9a6ab600c25a91a7acc6293828957a386a8a93
 F vsixtest/vsixtest.vcxproj.data 2ed517e100c66dc455b492e1a33350c1b20fbcdc
 F vsixtest/vsixtest.vcxproj.filters 37e51ffedcdb064aad6ff33b6148725226cd608e
 F vsixtest/vsixtest_TemporaryKey.pfx e5b1b036facdb453873e7084e1cae9102ccc67a0
-P 94085fb3e756bc984237b74b6e29c68462ad860870c64dcb5124feaeec387660 e059178b47109caee2c2211b2db6e594c014af636677118a64e10edf01ac017d
-R eed84f5af5dd0a6ce743afeb00c4b4e4
-T +closed e059178b47109caee2c2211b2db6e594c014af636677118a64e10edf01ac017d
-U drh
-Z adf3ddab2b496435d84f7dc30e6d3ae7
+P 4be6a23a188bd1fea445283d6dcc2f5c3470c28852dc4895d63117ad0c773fcf
+R 12af26efe518d88efce12e7278408573
+U dan
+Z dfc696063c3b6a7085f401f76e6517be

diff --git a/manifest.uuid b/manifest.uuid
index cd30b15e13d83ac580ca04841a787a3bb3d7f650..06e243d03c6f395313e7023cf84284df58228bb3 100644 (file)
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-4be6a23a188bd1fea445283d6dcc2f5c3470c28852dc4895d63117ad0c773fcf
\ No newline at end of file
+c465d0eb478e42045e08efe8b6fa64d4bd4d747cdf743beae4608562b014169e
\ No newline at end of file