Fix a problem in SQLITE_DIRECT_OVERFLOW_READ builds that could allow a concurrent...

FossilOrigin-Name: 49263c9136c81638833aa71c9d590e318ead2ca60c4d7207ebf8884174df9c8f

diff --git a/manifest b/manifest
index eb0fd0f59d73fe80b580115a0d4d54b2686795f7..00643460f0bd8079f8a26ccc452184ed9de405b5 100644 (file)
--- a/manifest
+++ b/manifest
@@ -1,5 +1,5 @@
-C Improve\sthe\slog\smessage\semitted\swhen\sa\sBEGIN\sCONCURRENT\stransaction\scannot\sbe\scommitted\sdue\sto\sconflicts\sso\sthat\sit\sidentifies\sthe\sconflicting\stable\sin\sa\sfew\smore\scases.
-D 2024-03-29T17:32:00.462
+C Fix\sa\sproblem\sin\sSQLITE_DIRECT_OVERFLOW_READ\sbuilds\sthat\scould\sallow\sa\sconcurrent\stransaction\sto\sbe\scommitted\seven\sif\sit\sread\sfrom\san\soverflow\spage\sthat\swas\smodified\sconcurrently,\sin\scases\swhere\sthe\soverflow\spage\swas\swritten\swithout\salso\swriting\sthe\sb-tree\spage\sto\swhich\sit\sis\slinked.
+D 2024-03-29T17:58:51.554
 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
 F LICENSE.md df5091916dbb40e6e9686186587125e1b2ff51f022cc334e886c19a0e9982724
@@ -694,7 +694,7 @@ F src/auth.c 19b7ccacae3dfba23fc6f1d0af68134fa216e9040e53b0681b4715445ea030b4
 F src/backup.c 5c97e8023aab1ce14a42387eb3ae00ba5a0644569e3476f38661fa6f824c3523
 F src/bitvec.c 501daeef838fa82a9fb53540d72f29e3d9172c8867f1e19f94f681e2e20b966e
 F src/btmutex.c 79a43670447eacc651519a429f6ece9fd638563cf95b469d6891185ddae2b522
-F src/btree.c 67683c7395cecc1c36397ce250e84822668d7affa88e590bdd52e7067843d790
+F src/btree.c ea6f38398e28cc4ae70a0d55e94d14e61ddaa05705e40796c542aaf6e8ae0b6f
 F src/btree.h bdeeb35614caa33526b603138f04c8d07a3f90a1300b5ade76848b755edf2027
 F src/btreeInt.h 8efd30e75e35a3c6a1c4dad7410d4ddfcd560f5f46401b208fa79eceef34525a
 F src/build.c c02fca1b600267120d1492f15a8301d48c59d37094c363eb5c12cca08d9133b8
@@ -742,8 +742,8 @@ F src/os_setup.h 6011ad7af5db4e05155f385eb3a9b4470688de6f65d6166b8956e58a3d87210
 F src/os_unix.c a31c14ba25e87757809853f58d1573ff8cb422e3543093582e523809d96738e0
 F src/os_win.c 6ff43bac175bd9ed79e7c0f96840b139f2f51d01689a638fd05128becf94908a
 F src/os_win.h 7b073010f1451abe501be30d12f6bc599824944a
-F src/pager.c 267f4ec1bc93559e7789c43cd3fa9ad0df8de6b609ec90dc74919d573e6bc7bb
-F src/pager.h af722ebe5d7c34ce7c94237323578385e3822fcf94fde3e7824b73a2efa0081f
+F src/pager.c 8618d789abb2e7d86e2e46800685126c72a9ee4ce1252ce0e93f47ecbaab697f
+F src/pager.h e2df6b92e0402bc8d516016f361da82758b7d7769ef1a18e2abeadece18103e0
 F src/parse.y 08247e876d6508e7bcf624d48f4993f4051899e1e73400fe7da9de34af755a90
 F src/pcache.c 040b165f30622a21b7a9a77c6f2e4877a32fb7f22d4c7f0d2a6fa6833a156a75
 F src/pcache.h 1497ce1b823cf00094bb0cf3bac37b345937e6f910890c626b16512316d3abf5
@@ -1006,7 +1006,7 @@ F test/concurrent.test fb624ddac9b008f347685911f90b6b5a022fd0a3f884c0ffef8056bc4
 F test/concurrent2.test de748c7dd749c77e2af2c4b914b9b09a28ac09608042ca498c0251dc6f46aa1a
 F test/concurrent3.test 82923fc2ea7321144b4448f98ea38aa316ddceef9020a392c5f6dea536506434
 F test/concurrent4.test e0b12cd467137e50259df3b4f837507e82aaa07c35941c88664dc8ed1d089c44
-F test/concurrent5.test f2064650d8a1558199fbca19ebd1f0fda5115109ab981b8fe3827ff56c76efa7
+F test/concurrent5.test aeb438ead1b9bb5204fa1066e8aed0bb27e5a08e4fa9b0ad42932f96eb0f97eb
 F test/concurrent6.test a7860e9ca13bb5fb76bcf41c5524fbfa9c37e6e258ecf84ffb5748a272488c67
 F test/concurrent7.test b96fa5c4cfdf8d5c0bc66b6934214500bad0260884a736f054ccc76e81aae85d
 F test/concurrent8.test b93937e74a8efb8b84f2fea7595b53418c5f29777bbe9cbdb5dc219b3dd72a7d
@@ -2200,8 +2200,8 @@ F vsixtest/vsixtest.tcl 6a9a6ab600c25a91a7acc6293828957a386a8a93
 F vsixtest/vsixtest.vcxproj.data 2ed517e100c66dc455b492e1a33350c1b20fbcdc
 F vsixtest/vsixtest.vcxproj.filters 37e51ffedcdb064aad6ff33b6148725226cd608e
 F vsixtest/vsixtest_TemporaryKey.pfx e5b1b036facdb453873e7084e1cae9102ccc67a0
-P 9b854e54b0d32542fd9b360319a784522c6a80190565094b74b2ab2c37efa14f
-R 3e711a26f5137f03bc94133c7ebecd04
+P 5d30e362cf72da3e17663dcb4299047ebe797ab6054fb14b2150ba82c2e698e1
+R ffb0ad0804e18372a484cadcc9d8fe60
 U dan
-Z 00fca70373aebb602684e384574f83d8
+Z 8f1f79457d009d7dc836ea34a5647b87
 # Remove this line to create a well-formed Fossil manifest.

diff --git a/manifest.uuid b/manifest.uuid
index 787967575ded0b32f1cf0860ec45129b90b61bd8..f8bdb5b7291d6580986a11eaf127be42e8f24f40 100644 (file)
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-5d30e362cf72da3e17663dcb4299047ebe797ab6054fb14b2150ba82c2e698e1
\ No newline at end of file
+49263c9136c81638833aa71c9d590e318ead2ca60c4d7207ebf8884174df9c8f
\ No newline at end of file

diff --git a/src/btree.c b/src/btree.c
index b28787ffcd81a0362fd9dc2201161806baa133d7..57d3bd998a7a56f14b28ef410bee4ee05c816e06 100644 (file)
--- a/src/btree.c
+++ b/src/btree.c
@@ -5671,6 +5671,8 @@ static int accessPayload(
           u8 *aWrite = &pBuf[-4];
           assert( aWrite>=pBufStart );                         /* due to (6) */
           memcpy(aSave, aWrite, 4);
+          rc = sqlite3PagerUsePage(pBt->pPager, nextPage);
+          if( rc!=SQLITE_OK ) break;
           rc = sqlite3OsRead(fd, aWrite, a+4, (i64)pBt->pageSize*(nextPage-1));
           nextPage = get4byte(aWrite);
           memcpy(aWrite, aSave, 4);

diff --git a/src/pager.c b/src/pager.c
index f56b848970d2211d29236976ce9d42a3b922ea25..ee0cec0a29fdfb14d91c934b3a977017736808e3 100644 (file)
--- a/src/pager.c
+++ b/src/pager.c
@@ -5521,6 +5521,23 @@ static void pagerUnlockIfUnused(Pager *pPager){
   }
 }
 
+#ifndef SQLITE_OMIT_CONCURRENT
+/*
+** If this pager is currently in a concurrent transaction (pAllRead!=0),
+** then set the bit in the pAllRead vector to indicate that the transaction
+** read from page pgno. Return SQLITE_OK if successful, or an SQLite error
+** code (i.e. SQLITE_NOMEM) if an error occurs.
+*/
+int sqlite3PagerUsePage(Pager *pPager, Pgno pgno){
+  int rc = SQLITE_OK;
+  if( pPager->pAllRead && pgno<=pPager->dbOrigSize ){
+    PAGERTRACE(("USING page %d\n", pgno));
+    rc = sqlite3BitvecSet(pPager->pAllRead, pgno);
+  }
+  return rc;
+}
+#endif
+
 /*
 ** The page getter methods each try to acquire a reference to a
 ** page with page number pgno. If the requested reference is
@@ -5594,17 +5611,13 @@ static int getPageNormal(
   assert( assert_pager_state(pPager) );
   assert( pPager->hasHeldSharedLock==1 );
 
-#ifndef SQLITE_OMIT_CONCURRENT
   /* If this is an CONCURRENT transaction and the page being read was
   ** present in the database file when the transaction was opened,
   ** mark it as read in the pAllRead vector.  */
-  pPg = 0;
-  if( pPager->pAllRead && pgno<=pPager->dbOrigSize ){
-    PAGERTRACE(("USING page %d\n", pgno));
-    rc = sqlite3BitvecSet(pPager->pAllRead, pgno);
-    if( rc!=SQLITE_OK ) goto pager_acquire_err;
+  if( sqlite3PagerUsePage(pPager, pgno)!=SQLITE_OK ){
+    pPg = 0;
+    goto pager_acquire_err;
   }
-#endif
 
   if( pgno==0 ) return SQLITE_CORRUPT_BKPT;
   pBase = sqlite3PcacheFetch(pPager->pPCache, pgno, 3);

diff --git a/src/pager.h b/src/pager.h
index 75d4ef2bc072238f60312745cd93b7522ea5379c..2cbe4545ae0885145df74b72c00d442e52e01b2b 100644 (file)
--- a/src/pager.h
+++ b/src/pager.h
@@ -227,6 +227,7 @@ void sqlite3PagerTruncateImage(Pager*,Pgno);
 void sqlite3PagerRekey(DbPage*, Pgno, u16);
 
 #ifndef SQLITE_OMIT_CONCURRENT
+int sqlite3PagerUsePage(Pager*, Pgno);
 void sqlite3PagerEndConcurrent(Pager*);
 int sqlite3PagerBeginConcurrent(Pager*);
 void sqlite3PagerDropExclusiveLock(Pager*);
@@ -235,6 +236,7 @@ void sqlite3PagerSetDbsize(Pager *pPager, Pgno);
 int sqlite3PagerIsWal(Pager*);
 #else
 # define sqlite3PagerEndConcurrent(x)
+# define sqlite3PagerUsePage(x, y) SQLITE_OK
 #endif
 
 #if defined(SQLITE_DEBUG) || !defined(SQLITE_OMIT_CONCURRENT)

diff --git a/test/concurrent5.test b/test/concurrent5.test
index a7ecf9ddd0532f038a844a08df50e62f0910511f..4afd06bcaf861f339f018a67cdf8eb9eada7509b 100644 (file)
--- a/test/concurrent5.test
+++ b/test/concurrent5.test
@@ -161,8 +161,6 @@ sqlite3 db2 test.db
 set big1 [string repeat ab 10000]
 set big2 "[string repeat ab  9999]xy"
 
-catchsql { ROLLBACK }
-
 do_execsql_test 1.6.0 {
   CREATE TABLE x1(x, y);
   INSERT INTO x1 VALUES(1, $big1);
@@ -209,7 +207,36 @@ do_test_conflict_msg 1.6.1.5 {
 }
 catchsql ROLLBACK
 
+#--------------------------------------------------------------------------
+reset_db
+sqlite3 db2 test.db
+
+set big1 [string repeat ab 10000]
+set big2 "[string repeat ab  9999]xy"
+
+do_execsql_test 1.7.0 {
+  CREATE TABLE ww(a);
+  CREATE TABLE y1(x, y);
+  INSERT INTO y1 VALUES(1, $big1);
+  PRAGMA journal_mode = wal;
+} {wal}
 
+do_execsql_test -db db2 1.7.1 {
+  BEGIN;
+    UPDATE y1 SET y=$big2;
+    SELECT * FROM ww;
+}
+
+do_execsql_test 1.7.2 {
+  BEGIN CONCURRENT;
+    INSERT INTO ww SELECT y FROM y1;
+}
+
+do_execsql_test -db db2 1.7.3 COMMIT
+
+do_catchsql_test 1.7.4 {
+  COMMIT;
+} {1 {database is locked}}
 
 db close
 db2 close