Provide the SQLITE_MAX_ALLOCATION_SIZE compile-time option for limiting the

maximum memory allocation size.

FossilOrigin-Name: 584de6a996c78b8e41bdfcd05a8e2a3844664c6b4efedb5883c8b8af388462b5

diff --git a/manifest b/manifest
index b53f299331d74267d21a6fab18c88e9009251d92..824eb56c81ad0a7763f76f0938bef9dbbbc4e4ad 100644 (file)
--- a/manifest
+++ b/manifest
@@ -1,5 +1,5 @@
-C Make\sthe\slegacy\sFTS3\scode\smore\srobust\sagainst\sinteger\soverflow\sduring\nmemory\sallocation.
-D 2022-09-27T01:53:05.111
+C Provide\sthe\sSQLITE_MAX_ALLOCATION_SIZE\scompile-time\soption\sfor\slimiting\sthe\nmaximum\smemory\sallocation\ssize.
+D 2022-09-27T16:35:06.221
 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
 F LICENSE.md df5091916dbb40e6e9686186587125e1b2ff51f022cc334e886c19a0e9982724
@@ -553,7 +553,7 @@ F src/json.c 7749b98c62f691697c7ee536b570c744c0583cab4a89200fdd0fc2aa8cc8cbd6
 F src/legacy.c d7874bc885906868cd51e6c2156698f2754f02d9eee1bae2d687323c3ca8e5aa
 F src/loadext.c 853385cc7a604157e137585097949252d5d0c731768e16b044608e5c95c3614b
 F src/main.c 8983b4a316d7e09946dd731913aa41712f02e2b55cb5c6c92126ccfe2473244a
-F src/malloc.c b7a3430cbe91d3e8e04fc10c2041b3a19794e63556ad2441a13d8dadd9b2bafc
+F src/malloc.c dfddca1e163496c0a10250cedeafaf56dff47673e0f15888fb0925340a8e3f90
 F src/mem0.c 6a55ebe57c46ca1a7d98da93aaa07f99f1059645
 F src/mem1.c c12a42539b1ba105e3707d0e628ad70e611040d8f5e38cf942cee30c867083de
 F src/mem2.c c8bfc9446fd0798bddd495eb5d9dbafa7d4b7287d8c22d50a83ac9daa26d8a75
@@ -2000,8 +2000,8 @@ F vsixtest/vsixtest.tcl 6a9a6ab600c25a91a7acc6293828957a386a8a93
 F vsixtest/vsixtest.vcxproj.data 2ed517e100c66dc455b492e1a33350c1b20fbcdc
 F vsixtest/vsixtest.vcxproj.filters 37e51ffedcdb064aad6ff33b6148725226cd608e
 F vsixtest/vsixtest_TemporaryKey.pfx e5b1b036facdb453873e7084e1cae9102ccc67a0
-P 3283bbd12a60f472ed03cb7c6209a605a3bf9f3d9083371e17840b56e8b3f559
-R c2acf92513b61a352b2e5251cc26bbac
+P 5517bc50988b5339c2fd071b29de1b5ca03037b0b635c3b112cf7108fab54d5f
+R d334d68f4ee6840cbb06511749063d29
 U drh
-Z 2202294fef097d3d8cb84dad0498d44c
+Z 739e270ad16b7bf5c87cbcd809fe00c5
 # Remove this line to create a well-formed Fossil manifest.

diff --git a/manifest.uuid b/manifest.uuid
index 69c91054db76c3979434859de9d3908f18826e19..a06b3b3074a4fac78020ff56885e69ca9a76c852 100644 (file)
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-5517bc50988b5339c2fd071b29de1b5ca03037b0b635c3b112cf7108fab54d5f
\ No newline at end of file
+584de6a996c78b8e41bdfcd05a8e2a3844664c6b4efedb5883c8b8af388462b5
\ No newline at end of file

diff --git a/src/malloc.c b/src/malloc.c
index 3fcedf8a372e876e050030aed6510a959b585bd6..af83743fc00cec7fdb33142d65c1e0165cace867 100644 (file)
--- a/src/malloc.c
+++ b/src/malloc.c
@@ -270,18 +270,34 @@ static void mallocWithAlarm(int n, void **pp){
   *pp = p;
 }
 
+/*
+** Maximum size of any single memory allocation.
+**
+** This is not a limit on the total amount of memory used.  This is
+** a limit on the size parameter to sqlite3_malloc() and sqlite3_realloc().
+**
+** The upper bound is slightly less than 2GiB:  0x7ffffeff == 2,147,483,391
+** This provides a 256-byte safety margin for defense against 32-bit 
+** signed integer overflow bugs when computing memory allocation sizes.
+** Parnoid applications might want to reduce the maximum allocation size
+** further for an even larger safety margin.  0x3fffffff or 0x0fffffff
+** or even smaller would be reasonable upper bounds on the size of a memory
+** allocations for most applications.
+*/
+#ifndef SQLITE_MAX_ALLOCATION_SIZE
+# define SQLITE_MAX_ALLOCATION_SIZE  2147483391
+#endif
+#if SQLITE_MAX_ALLOCATION_SIZE>2147483391
+# error Maximum size for SQLITE_MAX_ALLOCATION_SIZE is 2147483391
+#endif
+
 /*
 ** Allocate memory.  This routine is like sqlite3_malloc() except that it
 ** assumes the memory subsystem has already been initialized.
 */
 void *sqlite3Malloc(u64 n){
   void *p;
-  if( n==0 || n>=0x7fffff00 ){
-    /* A memory allocation of a number of bytes which is near the maximum
-    ** signed integer value might cause an integer overflow inside of the
-    ** xMalloc().  Hence we limit the maximum size to 0x7fffff00, giving
-    ** 255 bytes of overhead.  SQLite itself will never use anything near
-    ** this amount.  The only way to reach the limit is with sqlite3_malloc() */
+  if( n==0 || n>SQLITE_MAX_ALLOCATION_SIZE ){
     p = 0;
   }else if( sqlite3GlobalConfig.bMemstat ){
     sqlite3_mutex_enter(mem0.mutex);