Fix another corruption related buffer overread in the sqlite_dbdata module.

FossilOrigin-Name: 5cd728fb6b3a70f795306d4d6e12151a4de327f801733a8558139e3cd76fe66a

diff --git a/ext/misc/dbdata.c b/ext/misc/dbdata.c
index 4cbb96691f9aec2749e6dc4c1e1af9718df20cf1..d73f4f1a288b57af8f8cad21e0bc0b388f149a0c 100644 (file)
--- a/ext/misc/dbdata.c
+++ b/ext/misc/dbdata.c
@@ -278,6 +278,10 @@ static void dbdataResetCursor(DbdataCursor *pCsr){
   pCsr->iCell = 0;
   pCsr->iField = 0;
   pCsr->bOnePage = 0;
+  sqlite3_free(pCsr->aPage);
+  sqlite3_free(pCsr->pRec);
+  pCsr->pRec = 0;
+  pCsr->aPage = 0;
 }
 
 /*
@@ -459,6 +463,7 @@ static int dbdataNext(sqlite3_vtab_cursor *pCursor){
   while( 1 ){
     int rc;
     int iOff = (pCsr->iPgno==1 ? 100 : 0);
+    int bNextPage = 0;
 
     if( pCsr->aPage==0 ){
       while( 1 ){
@@ -495,7 +500,6 @@ static int dbdataNext(sqlite3_vtab_cursor *pCursor){
         int iHdr;
         int U, X;
         int nLocal;
-        int bNextPage = 0;
   
         switch( pCsr->aPage[iOff] ){
           case 0x02:
@@ -603,32 +607,37 @@ static int dbdataNext(sqlite3_vtab_cursor *pCursor){
             pCsr->iField = (bHasRowid ? -1 : 0);
           }
         }
-
-        if( bNextPage ){
-          sqlite3_free(pCsr->aPage);
-          pCsr->aPage = 0;
-          if( pCsr->bOnePage ) return SQLITE_OK;
-          pCsr->iPgno++;
-          continue;
-        }
       }else{
         pCsr->iField++;
         if( pCsr->iField>0 ){
           sqlite3_int64 iType;
-          pCsr->pHdrPtr += dbdataGetVarint(pCsr->pHdrPtr, &iType);
-          pCsr->pPtr += dbdataValueBytes(iType);
+          if( pCsr->pHdrPtr>&pCsr->pRec[pCsr->nRec] ){
+            bNextPage = 1;
+          }else{
+            pCsr->pHdrPtr += dbdataGetVarint(pCsr->pHdrPtr, &iType);
+            pCsr->pPtr += dbdataValueBytes(iType);
+          }
         }
       }
 
-      if( pCsr->iField<0 || pCsr->pHdrPtr<&pCsr->pRec[pCsr->nHdr] ){
-        return SQLITE_OK;
+      if( bNextPage ){
+        sqlite3_free(pCsr->aPage);
+        sqlite3_free(pCsr->pRec);
+        pCsr->aPage = 0;
+        pCsr->pRec = 0;
+        if( pCsr->bOnePage ) return SQLITE_OK;
+        pCsr->iPgno++;
+      }else{
+        if( pCsr->iField<0 || pCsr->pHdrPtr<&pCsr->pRec[pCsr->nHdr] ){
+          return SQLITE_OK;
+        }
+
+        /* Advance to the next cell. The next iteration of the loop will load
+        ** the record and so on. */
+        sqlite3_free(pCsr->pRec);
+        pCsr->pRec = 0;
+        pCsr->iCell++;
       }
-  
-      /* Advance to the next cell. The next iteration of the loop will load
-      ** the record and so on. */
-      sqlite3_free(pCsr->pRec);
-      pCsr->pRec = 0;
-      pCsr->iCell++;
     }
   }
 
@@ -737,9 +746,12 @@ static int dbdataColumn(
           iOff += 8;
         }else{
           iOff += 12 + pCsr->iCell*2;
+          if( iOff>pCsr->nPage ) return SQLITE_OK;
           iOff = get_uint16(&pCsr->aPage[iOff]);
         }
-        sqlite3_result_int64(ctx, get_uint32(&pCsr->aPage[iOff]));
+        if( iOff<=pCsr->nPage ){
+          sqlite3_result_int64(ctx, get_uint32(&pCsr->aPage[iOff]));
+        }
         break;
       }
     }

diff --git a/manifest b/manifest
index 83937eb82ee351aee396b2f5e71d82d17cd52ddc..bde30235f22a0a6fca0c848dfbc0cd9855058296 100644 (file)
--- a/manifest
+++ b/manifest
@@ -1,5 +1,5 @@
-C Fix\sfurther\sbuffer\soverreads\striggered\sby\spassing\scorrupt\srecords\sto\sthe\ssqlite_dbdata\smodule.
-D 2019-05-09T15:07:46.363
+C Fix\sanother\scorruption\srelated\sbuffer\soverread\sin\sthe\ssqlite_dbdata\smodule.
+D 2019-05-09T15:51:27.509
 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
 F LICENSE.md df5091916dbb40e6e9686186587125e1b2ff51f022cc334e886c19a0e9982724
@@ -284,7 +284,7 @@ F ext/misc/closure.c dbfd8543b2a017ae6b1a5843986b22ddf99ff126ec9634a2f4047cd14c8
 F ext/misc/completion.c cec672d40604075bb341a7f11ac48393efdcd90a979269b8fe7977ea62d0547f
 F ext/misc/compress.c dd4f8a6d0baccff3c694757db5b430f3bbd821d8686d1fc24df55cf9f035b189
 F ext/misc/csv.c 7f047aeb68f5802e7ce6639292095d622a488bb43526ed04810e0649faa71ceb
-F ext/misc/dbdata.c db2674c3a5913a784a75a11d1e7905b14f6b81de1879d6e5fde4f0887f08decf
+F ext/misc/dbdata.c e2b007604b58a6f2d10b247c4b381cab1d20a530165bc49474b11e48fe680877
 F ext/misc/dbdump.c baf6e37447c9d6968417b1cd34cbedb0b0ab3f91b5329501d8a8d5be3287c336
 F ext/misc/eval.c 4b4757592d00fd32e44c7a067e6a0e4839c81a4d57abc4131ee7806d1be3104e
 F ext/misc/explain.c d5c12962d79913ef774b297006872af1fccda388f61a11d37758f9179a09551f
@@ -1825,7 +1825,7 @@ F vsixtest/vsixtest.tcl 6a9a6ab600c25a91a7acc6293828957a386a8a93
 F vsixtest/vsixtest.vcxproj.data 2ed517e100c66dc455b492e1a33350c1b20fbcdc
 F vsixtest/vsixtest.vcxproj.filters 37e51ffedcdb064aad6ff33b6148725226cd608e
 F vsixtest/vsixtest_TemporaryKey.pfx e5b1b036facdb453873e7084e1cae9102ccc67a0
-P e736da9c18fad138c5502d354c3553373cba15358b69e44b257f60def59422e2
-R 32f00eab291c2d8cfb2d8bb909898960
+P dbc6a9f7f67256dea96d3245e7bec145ba65d64adf322e18f1f3ac9556b4e0b6
+R 125e456f1f71a5717f889e188e54ba04
 U dan
-Z f672687cf39d09ecc13e261b2e491ea1
+Z c2cff423821faf29bb80557b4a1985e5

diff --git a/manifest.uuid b/manifest.uuid
index 85b050179e1c3b72b159cfda996967502fac2386..18f9e77132bfa0bd4e6e1bb6e24897f5d797a149 100644 (file)
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-dbc6a9f7f67256dea96d3245e7bec145ba65d64adf322e18f1f3ac9556b4e0b6
\ No newline at end of file
+5cd728fb6b3a70f795306d4d6e12151a4de327f801733a8558139e3cd76fe66a
\ No newline at end of file