Return an SQLITE_CORRUPT error if the content size field of a table record

extends off the end of a page.

FossilOrigin-Name: b48c4e402125fb8d2208d358f6e9bbc351f3a49d

diff --git a/manifest b/manifest
index d7c9c5a9010b31d6827601afd62a02c5db39dd4c..356b49fd434f9680007a6fac7cb84a06e068b657 100644 (file)
--- a/manifest
+++ b/manifest
@@ -1,5 +1,5 @@
-C Uses\sshifts\srather\sthan\sdivision\sfor\sarithmetic\son\sthe\scell\sindices,\ssince\nthose\sindices\sare\salways\snon-negative.
-D 2013-11-25T17:38:26.358
+C Return\san\sSQLITE_CORRUPT\serror\sif\sthe\scontent\ssize\sfield\sof\sa\stable\srecord\nextends\soff\sthe\send\sof\sa\spage.
+D 2013-11-25T20:14:13.468
 F Makefile.arm-wince-mingw32ce-gcc d6df77f1f48d690bd73162294bbba7f59507c72f
 F Makefile.in e1a9b4258bbde53f5636f4e238c65b7e11459e2b
 F Makefile.linux-gcc 91d710bdc4998cb015f39edf3cb314ec4f4d7e23
@@ -166,7 +166,7 @@ F src/auth.c 523da7fb4979469955d822ff9298352d6b31de34
 F src/backup.c 1809a7caa2504233bdddd12f5018422421789537
 F src/bitvec.c 19a4ba637bd85f8f63fc8c9bae5ade9fb05ec1cb
 F src/btmutex.c 976f45a12e37293e32cae0281b15a21d48a8aaa7
-F src/btree.c f98e6ceada5953859d13848cb3139d248e0ad2e6
+F src/btree.c c308e64d89de5ea87e5538f7380af4477892e067
 F src/btree.h a61ddebc78c66795a2b93181321a116746302cc9
 F src/btreeInt.h f038e818bfadf75afbd09819ed93c26a333d39e0
 F src/build.c 07054d45319953e54a89d726e589a423e9c1c590
@@ -1142,7 +1142,7 @@ F tool/vdbe-compress.tcl f12c884766bd14277f4fcedcae07078011717381
 F tool/warnings-clang.sh f6aa929dc20ef1f856af04a730772f59283631d4
 F tool/warnings.sh d1a6de74685f360ab718efda6265994b99bbea01
 F tool/win/sqlite.vsix 030f3eeaf2cb811a3692ab9c14d021a75ce41fff
-P 55e5bfa231dd52a7cf9ec982967da4963867b9e5
-R 03a0908b80603703a94d0f74a79b1f34
+P 5bf2a3feeb2c83671bf3edeb20a549239e6873bf
+R 5bcbc7e134df92bc8848f497a4ca3642
 U drh
-Z 8e81fe7c02afd074478ec63871f47a2f
+Z d267e18bd1e4ed89c545a37f1e6bffd5

diff --git a/manifest.uuid b/manifest.uuid
index 96f416d29cacdf1a29191a6b0d2833c8ceac9188..6967dda00dae6eae251b42dd58215de3ff0f1722 100644 (file)
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-5bf2a3feeb2c83671bf3edeb20a549239e6873bf
\ No newline at end of file
+b48c4e402125fb8d2208d358f6e9bbc351f3a49d
\ No newline at end of file

diff --git a/src/btree.c b/src/btree.c
index abe104242f261a3d830a018d98985762dac59521..eff211333cd49df27f255e7dcd439693211cb465 100644 (file)
--- a/src/btree.c
+++ b/src/btree.c
@@ -4219,7 +4219,7 @@ static const unsigned char *fetchPayload(
   assert( cursorHoldsMutex(pCur) );
   pPage = pCur->apPage[pCur->iPage];
   assert( pCur->aiIdx[pCur->iPage]<pPage->nCell );
-  if( pCur->info.nSize==0 ){
+  if( NEVER(pCur->info.nSize==0) ){
     btreeParseCell(pCur->apPage[pCur->iPage], pCur->aiIdx[pCur->iPage],
                    &pCur->info);
   }
@@ -4670,7 +4670,9 @@ int sqlite3BtreeMovetoUnpacked(
         i64 nCellKey;
         pCell = findCell(pPage, idx) + pPage->childPtrSize;
         if( pPage->hasData ){
-          while( 0x80 <= *(pCell++) && pCell<pPage->aDataEnd ){}
+          while( 0x80 <= *(pCell++) ){
+            if( pCell>=pPage->aDataEnd ) return SQLITE_CORRUPT_BKPT;
+          }
         }
         getVarint(pCell, (u64*)&nCellKey);
         if( nCellKey<intKey ){