Fix to payload size overflow detection in the cellSizePtr() change of

the previous check-in.

FossilOrigin-Name: 7609744014c6a84a8379794a0351a2e9626ec86b

diff --git a/manifest b/manifest
index d9984e2d8c909b7123242b3d1e21555d612bea81..625787bf086cff96876613484b838e4165acbcba 100644 (file)
--- a/manifest
+++ b/manifest
@@ -1,5 +1,5 @@
-C Size\sreduction\sand\ssubstantial\sperformance\sincrease\sfor\scellSizePtr().
-D 2014-09-22T19:51:35.432
+C Fix\sto\spayload\ssize\soverflow\sdetection\sin\sthe\scellSizePtr()\schange\sof\nthe\sprevious\scheck-in.
+D 2014-09-22T20:38:10.316
 F Makefile.arm-wince-mingw32ce-gcc d6df77f1f48d690bd73162294bbba7f59507c72f
 F Makefile.in cf57f673d77606ab0f2d9627ca52a9ba1464146a
 F Makefile.linux-gcc 91d710bdc4998cb015f39edf3cb314ec4f4d7e23
@@ -172,7 +172,7 @@ F src/auth.c d8abcde53426275dab6243b441256fcd8ccbebb2
 F src/backup.c a31809c65623cc41849b94d368917f8bb66e6a7e
 F src/bitvec.c 19a4ba637bd85f8f63fc8c9bae5ade9fb05ec1cb
 F src/btmutex.c 49ca66250c7dfa844a4d4cb8272b87420d27d3a5
-F src/btree.c 86cc6efed093b80360489acac4d2daf064a1ad58
+F src/btree.c c2645014c525c0b4a8327971c331f55b8747b443
 F src/btree.h a79aa6a71e7f1055f01052b7f821bd1c2dce95c8
 F src/btreeInt.h e0ecb5dba292722039a7540beb3fc448103273cc
 F src/build.c 8dbca25988045fbf2a33c9631c42706fa6449e60
@@ -1199,7 +1199,7 @@ F tool/vdbe_profile.tcl 67746953071a9f8f2f668b73fe899074e2c6d8c1
 F tool/warnings-clang.sh f6aa929dc20ef1f856af04a730772f59283631d4
 F tool/warnings.sh 0abfd78ceb09b7f7c27c688c8e3fe93268a13b32
 F tool/win/sqlite.vsix deb315d026cc8400325c5863eef847784a219a2f
-P 41de1643bfc9ae25e20790d707e2789b665baa2b
-R 20814d8e71474a3ca52334b7cc5e7228
+P bc8bbf3207288d160287519c3b7123997996b440
+R 5a3408a8ae29b6451a1037ab47048e78
 U drh
-Z 93d80b8ba28615b25f3f6e1541988990
+Z 93e96edbb124ae02212644cc0f189540

diff --git a/manifest.uuid b/manifest.uuid
index 63137ebd347b33ab31cdb171171de6fa8d4a7e81..b44f538e96c28fa12f0ac804077af5e72b145d1f 100644 (file)
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-bc8bbf3207288d160287519c3b7123997996b440
\ No newline at end of file
+7609744014c6a84a8379794a0351a2e9626ec86b
\ No newline at end of file

diff --git a/src/btree.c b/src/btree.c
index 46eb5be3030c22c9810707cc515b3e4bc40eeaa2..1856ecb1a5da4f911a2ba77db44d4298c64b7c5b 100644 (file)
--- a/src/btree.c
+++ b/src/btree.c
@@ -1076,7 +1076,7 @@ static u16 cellSizePtr(MemPage *pPage, u8 *pCell){
       nSize &= 0x7f;
       do{
         nSize = (nSize<<7) | (*++pIter & 0x7f);
-      }while( *(pIter)>=0x80 && pIter<&pCell[6] );
+      }while( *(pIter)>=0x80 && pIter<pEnd );
     }
     pIter++;
   }else{