Use caution to avoid integer overflow when doing real to integer affinity

operations.  Ticket #3922. (CVS 6776)

FossilOrigin-Name: 392559465d499f491907ef7f42d37a1a6c699511

diff --git a/manifest b/manifest
index 13db7eb43b36957f961ca4b9c850a2f527b30581..e22c17ad6f440a3416f7bfadd4328355d631f19d 100644 (file)
--- a/manifest
+++ b/manifest
@@ -1,5 +1,5 @@
-C Fix\sa\spotential\ssegfault\sfollowing\sdatabase\scorruption.\s\sProblem\s\r\nmade\svisible\sby\scheck-in\s(6772).\s(CVS\s6775)
-D 2009-06-17T13:57:16
+C Use\scaution\sto\savoid\sinteger\soverflow\swhen\sdoing\sreal\sto\sinteger\saffinity\noperations.\s\sTicket\s#3922.\s(CVS\s6776)
+D 2009-06-17T16:20:04
 F Makefile.arm-wince-mingw32ce-gcc fcd5e9cd67fe88836360bb4f9ef4cb7f8e2fb5a0
 F Makefile.in 8b8fb7823264331210cddf103831816c286ba446
 F Makefile.linux-gcc d53183f4aa6a9192d249731c90dbdffbd2c68654
@@ -201,15 +201,15 @@ F src/tokenize.c 3743be86c3e73081b5b162adc00e2492a94a3a99
 F src/trigger.c c07c5157c58fcdb704f65d5f5e4775276e45bb8b
 F src/update.c 6ae6c26adff8dc34532d578f66e6cfde04b5d177
 F src/utf.c 9541d28f40441812c0b40f00334372a0542c00ff
-F src/util.c 44e9f8b4c1a37cbc739e8c5c4d1eae8308a37da5
+F src/util.c a7e981e032c3c9c0887d50d7e658a33cb355b43d
 F src/vacuum.c 0e14f371ea3326c6b8cfba257286d798cd20db59
-F src/vdbe.c ba87db547187693cab47a1b78e7e14b02cae3686
+F src/vdbe.c a7b9ad4a1924fae36976391d3945b590066d8a9b
 F src/vdbe.h 35a648bc3279a120da24f34d9a25213ec15daf8a
 F src/vdbeInt.h 3727128255a93d116e454f67d4559700f7ae4d6f
 F src/vdbeapi.c 619992b16821b989050e8a12e259d795d30731a9
 F src/vdbeaux.c 14e1c6065172530a14648292371ccd3c1ea0d490
 F src/vdbeblob.c c25d7e7bc6d5917feeb17270bd275fa771f26e5c
-F src/vdbemem.c 05183d46094aa99b8f8350e5761b9369dbef35a8
+F src/vdbemem.c ba39c0afa609595c7c23dfc2ac929d9414faa59f
 F src/vtab.c 98fbffc5efe68d8107511dec0a650efc7daa9446
 F src/walker.c 1edca756275f158b80f20eb6f104c8d3fcc96a04
 F src/where.c cf0d091748c2fa6f7df96e5b08d2db26fd2eb437
@@ -654,6 +654,7 @@ F test/tkt3871.test 43ecbc8d90dc83908e2a454aef345acc9d160c6f
 F test/tkt3879.test 2ad5bef2c87e9991ce941e054c31abe26ef7fb90
 F test/tkt3911.test 74cd324f3ba653040cc6d94cc4857b290d12d633
 F test/tkt3918.test e6cdf6bfcfe9ba939d86a4238a9dc55d6eec5d42
+F test/tkt3922.test 0b43815bff3b6ab889bf84a17668ee13ab046bfd
 F test/tokenize.test ce430a7aed48fc98301611429595883fdfcab5d7
 F test/trace.test 19ffbc09885c3321d56358a5738feae8587fb377
 F test/trans.test d887cb07630dc39879a322d958ad8b006137485c
@@ -735,7 +736,7 @@ F tool/speedtest2.tcl ee2149167303ba8e95af97873c575c3e0fab58ff
 F tool/speedtest8.c 2902c46588c40b55661e471d7a86e4dd71a18224
 F tool/speedtest8inst1.c 293327bc76823f473684d589a8160bde1f52c14e
 F tool/vdbe-compress.tcl 672f81d693a03f80f5ae60bfefacd8a349e76746
-P 59ec937ce226bbf6c48c5e0466d3bab48873c9ea
-R 91b49222de2dd4961eeb67b115d749fb
+P 69eb0ff817cff6266c53b79047bcff5e5d54b618
+R 6181c593f1e99db7e423de696034df8f
 U drh
-Z 204c520d5c26a9b912018a390ab782e4
+Z 94cf86f58e243781b10d1003bc255540

diff --git a/manifest.uuid b/manifest.uuid
index 00a117fc12a2564587a734871c1bd0405a373bc8..066932a1078242389079d66ba245a6669c8052d4 100644 (file)
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-69eb0ff817cff6266c53b79047bcff5e5d54b618
\ No newline at end of file
+392559465d499f491907ef7f42d37a1a6c699511
\ No newline at end of file

diff --git a/src/util.c b/src/util.c
index 2de8d36cf7922fe08d423dc721e67a0f48b405e1..39c0488237aa2634292fbb302c262bbef3c8f3f1 100644 (file)
--- a/src/util.c
+++ b/src/util.c
@@ -14,7 +14,7 @@
 ** This file contains functions for allocating memory, comparing
 ** strings, and stuff like that.
 **
-** $Id: util.c,v 1.259 2009/06/10 11:07:01 drh Exp $
+** $Id: util.c,v 1.260 2009/06/17 16:20:04 drh Exp $
 */
 #include "sqliteInt.h"
 #include <stdarg.h>
@@ -392,7 +392,7 @@ int sqlite3AtoF(const char *z, double *pResult){
 */
 static int compare2pow63(const char *zNum){
   int c;
-  c = memcmp(zNum,"922337203685477580",18);
+  c = memcmp(zNum,"922337203685477580",18)*10;
   if( c==0 ){
     c = zNum[18] - '8';
   }

diff --git a/src/vdbe.c b/src/vdbe.c
index 6a9d0720694ffb4481c9ca7a78ef000cd5e5ca38..feb84b0f43d405153be3a3923778d231635aa3c0 100644 (file)
--- a/src/vdbe.c
+++ b/src/vdbe.c
@@ -43,7 +43,7 @@
 ** in this file for details.  If in doubt, do not deviate from existing
 ** commenting and indentation practices when changing or adding code.
 **
-** $Id: vdbe.c,v 1.851 2009/06/15 20:45:35 drh Exp $
+** $Id: vdbe.c,v 1.852 2009/06/17 16:20:04 drh Exp $
 */
 #include "sqliteInt.h"
 #include "vdbeInt.h"
@@ -189,7 +189,7 @@ static VdbeCursor *allocateCursor(
   int iCur,             /* Index of the new VdbeCursor */
   int nField,           /* Number of fields in the table or index */
   int iDb,              /* When database the cursor belongs to, or -1 */
-  int isBtreeCursor     /* */
+  int isBtreeCursor     /* True for B-Tree vs. pseudo-table or vtab */
 ){
   /* Find the memory cell that will be used to store the blob of memory
   ** required for this VdbeCursor structure. It is convenient to use a 

diff --git a/src/vdbemem.c b/src/vdbemem.c
index 6d53c74aec8f9fa568327fd7c7ebf1c2af1cfe9c..80516ccef6cc67738f5750488f5fd99fae6237db 100644 (file)
--- a/src/vdbemem.c
+++ b/src/vdbemem.c
@@ -15,7 +15,7 @@
 ** only within the VDBE.  Interface routines refer to a Mem using the
 ** name sqlite_value
 **
-** $Id: vdbemem.c,v 1.147 2009/05/28 11:05:57 danielk1977 Exp $
+** $Id: vdbemem.c,v 1.148 2009/06/17 16:20:04 drh Exp $
 */
 #include "sqliteInt.h"
 #include "vdbeInt.h"
@@ -411,7 +411,18 @@ void sqlite3VdbeIntegerAffinity(Mem *pMem){
   assert( EIGHT_BYTE_ALIGNMENT(pMem) );
 
   pMem->u.i = doubleToInt64(pMem->r);
-  if( pMem->r==(double)pMem->u.i ){
+
+  /* Only mark the value as an integer if
+  **
+  **    (1) the round-trip conversion real->int->real is a no-op, and
+  **    (2) The integer is neither the largest nor the smallest
+  **        possible integer (ticket #3922)
+  **
+  ** The second term in the following conditional enforces the second
+  ** condition under the assumption that additional overflow causes
+  ** values to wrap around.
+  */
+  if( pMem->r==(double)pMem->u.i && (pMem->u.i-1) < (pMem->u.i+1) ){
     pMem->flags |= MEM_Int;
   }
 }

diff --git a/test/tkt3922.test b/test/tkt3922.test
new file mode 100644 (file)
index 0000000..ecf7fa1
--- /dev/null
+++ b/test/tkt3922.test
@@ -0,0 +1,60 @@
+# 2009 June 17
+#
+# The author disclaims copyright to this source code.  In place of
+# a legal notice, here is a blessing:
+#
+#    May you do good and not evil.
+#    May you find forgiveness for yourself and forgive others.
+#    May you share freely, never taking more than you give.
+#
+#***********************************************************************
+#
+# $Id: tkt3922.test,v 1.1 2009/06/17 16:20:04 drh Exp $
+
+set testdir [file dirname $argv0]
+source $testdir/tester.tcl
+
+do_test tkt3922.1 {
+  execsql {
+    CREATE TABLE t1(a NUMBER);
+    INSERT INTO t1 VALUES('-9223372036854775808');
+    SELECT a, typeof(a) FROM t1;
+  }
+} {-9223372036854775808 integer}
+do_test tkt3922.2 {
+  execsql {
+    DELETE FROM t1;
+    INSERT INTO t1 VALUES('-9223372036854775809');
+    SELECT a, typeof(a) FROM t1;
+  }
+} {-9.22337203685478e+18 real}
+do_test tkt3922.3 {
+  execsql {
+    DELETE FROM t1;
+    INSERT INTO t1 VALUES('-9223372036854776832');
+    SELECT a, typeof(a) FROM t1;
+  }
+} {-9.22337203685478e+18 real}
+do_test tkt3922.4 {
+  execsql {
+    DELETE FROM t1;
+    INSERT INTO t1 VALUES('-9223372036854776833');
+    SELECT a, typeof(a) FROM t1;
+  }
+} {-9.22337203685478e+18 real}
+do_test tkt3922.5 {
+  execsql {
+    DELETE FROM t1;
+    INSERT INTO t1 VALUES('9223372036854775807');
+    SELECT a, typeof(a) FROM t1;
+  }
+} {9223372036854775807 integer}
+do_test tkt3922.6 {
+  execsql {
+    DELETE FROM t1;
+    INSERT INTO t1 VALUES('9223372036854775808');
+    SELECT a, typeof(a) FROM t1;
+  }
+} {9.22337203685478e+18 real}
+
+finish_test