All bytes of a page are initialized, even bytes that follow a 2-byte cell

on a malformed page.

FossilOrigin-Name: 7373a004ed0e2781cda503c73e9a94f24350ef79

diff --git a/manifest b/manifest
index 0cd62a654290af734d70aeecc861d835bb8c94a8..39feeb04603c1e4ee97ee49ff47c3860bdfd0cdb 100644 (file)
--- a/manifest
+++ b/manifest
@@ -1,5 +1,5 @@
-C A\sdifferent\sapproach\sto\spreventing\sbuffer\soverreads\swhen\scomparing\sa\svector\nof\svalues\swith\sa\scorrupt\sindex\srecord\sthat\sspans\sat\sleast\sone\soverflow\spage.
-D 2015-05-27T15:42:53.434
+C All\sbytes\sof\sa\spage\sare\sinitialized,\seven\sbytes\sthat\sfollow\sa\s2-byte\scell\non\sa\smalformed\spage.
+D 2015-05-27T18:13:35.676
 F Makefile.arm-wince-mingw32ce-gcc d6df77f1f48d690bd73162294bbba7f59507c72f
 F Makefile.in afc69c576d95c25380e973496434be5f85204fa7
 F Makefile.linux-gcc 91d710bdc4998cb015f39edf3cb314ec4f4d7e23
@@ -192,7 +192,7 @@ F src/auth.c b56c78ebe40a2110fd361379f7e8162d23f92240
 F src/backup.c ff743689c4d6c5cb55ad42ed9d174b2b3e71f1e3
 F src/bitvec.c 5eb7958c3bf65210211cbcfc44eff86d0ded7c9d
 F src/btmutex.c 45a968cc85afed9b5e6cf55bf1f42f8d18107f79
-F src/btree.c de509eeae5e8dbf365dbc37d1cf14dc6c12937c8
+F src/btree.c 84b1f0f4688c8da2c426a158502a77617ce5f286
 F src/btree.h 969adc948e89e449220ff0ff724c94bb2a52e9f1
 F src/btreeInt.h 973a22a6fd61350b454ad614832b1f0a5e25a1e4
 F src/build.c 85a169a0a22f8b80caf513eaf2944d39b979f571
@@ -1279,8 +1279,7 @@ F tool/vdbe_profile.tcl 67746953071a9f8f2f668b73fe899074e2c6d8c1
 F tool/warnings-clang.sh f6aa929dc20ef1f856af04a730772f59283631d4
 F tool/warnings.sh 0abfd78ceb09b7f7c27c688c8e3fe93268a13b32
 F tool/win/sqlite.vsix deb315d026cc8400325c5863eef847784a219a2f
-P 19e2cebc12aaa4e72d3bad74af73575a0457e5d4 7e9e1b6123bc455dd7d1c894b6154ccd27acec18
-R d744c38ef8fa2ca29d4e58d42264be16
-T +closed 7e9e1b6123bc455dd7d1c894b6154ccd27acec18
+P 95eaa49f4ee071c7a0f690a695f1f2d1ebca68a8
+R bb66ca065683b551ad898269100a4272
 U drh
-Z 5a3a1f535bbc53578663f80d8c6e8f69
+Z 3323dea07601fb482f9ef3d7ec44a46d

diff --git a/manifest.uuid b/manifest.uuid
index 641355972c257494294498d738530eee725aecbe..827201b0da584c211cfe05662504d4f5dd8300c1 100644 (file)
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-95eaa49f4ee071c7a0f690a695f1f2d1ebca68a8
\ No newline at end of file
+7373a004ed0e2781cda503c73e9a94f24350ef79
\ No newline at end of file

diff --git a/src/btree.c b/src/btree.c
index e13c16be1943bbd10106593d1ad4c66040f31726..852672f4de173ac359a3d812d582cf6953684642 100644 (file)
--- a/src/btree.c
+++ b/src/btree.c
@@ -6897,13 +6897,13 @@ static int balance_nonroot(
         memcpy(apCell[nCell], &pOld->aData[8], 4);
       }else{
         assert( leafCorrection==4 );
-        if( szCell[nCell]<4 ){
+        while( szCell[nCell]<4 ){
           /* Do not allow any cells smaller than 4 bytes. If a smaller cell
           ** does exist, pad it with 0x00 bytes. */
           assert( szCell[nCell]==3 || CORRUPT_DB );
           assert( apCell[nCell]==&aSpace1[iSpace1-3] || CORRUPT_DB );
           aSpace1[iSpace1++] = 0x00;
-          szCell[nCell] = 4;
+          szCell[nCell]++;
         }
       }
       nCell++;