Cast a string size variable to 64-bit to avoid any possibility of

integer overflow.

FossilOrigin-Name: a5940294b2ac8d157d7fa72f65ee70b713f7feb8a0a98d7f47e71acd1b6942b1

diff --git a/manifest b/manifest
index d7cab31c963da1a146053943812e8310bca6259f..92c99c9248ec68e86eafe2d9780dca6cd2b43c29 100644 (file)
--- a/manifest
+++ b/manifest
@@ -1,5 +1,5 @@
-C Limit\sthe\ssize\sof\sthe\sexponent\sinput\sin\sthe\ssecond\sargument\sto\sthe\nieee754()\sSQL\sfunction,\sto\savoid\sinteger\soverflow.\nTicket\s[22dea1cfdb9151e4].
-D 2021-03-02T16:27:04.746
+C Cast\sa\sstring\ssize\svariable\sto\s64-bit\sto\savoid\sany\spossibility\sof\ninteger\soverflow.
+D 2021-03-02T21:07:41.429
 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
 F LICENSE.md df5091916dbb40e6e9686186587125e1b2ff51f022cc334e886c19a0e9982724
@@ -538,7 +538,7 @@ F src/pcache1.c 388304fd2d91c39591080b5e0f3c62cfba87db20370e7e0554062bfb29740e9f
 F src/pragma.c 6daaaecc26a4b09481d21722525b079ce756751a43a79cc1d8f122d686806193
 F src/pragma.h 8dc78ab7e9ec6ce3ded8332810a2066f1ef6267e2e03cd7356ee00276125c6cf
 F src/prepare.c f634a9e799a6b1c136d8ee12479cffa22862bfb807d307b1db406aa0cdb042a5
-F src/printf.c 10e61ec79dd9d41fdc77afee4e0df04fbb427f309c043118fe0b26a7d7db488a
+F src/printf.c 2b03a80d7c11bb422115dca175a18bf430e9c9dbaa0eee63b758f0c022f8f34f
 F src/random.c 80f5d666f23feb3e6665a6ce04c7197212a88384
 F src/resolve.c 14fa255fdd2bd789bd792584c54a51c8b7a9d7856e8016197dbcd3ba5795f9b0
 F src/rowset.c ba9515a922af32abe1f7d39406b9d35730ed65efab9443dc5702693b60854c92
@@ -1908,7 +1908,7 @@ F vsixtest/vsixtest.tcl 6a9a6ab600c25a91a7acc6293828957a386a8a93
 F vsixtest/vsixtest.vcxproj.data 2ed517e100c66dc455b492e1a33350c1b20fbcdc
 F vsixtest/vsixtest.vcxproj.filters 37e51ffedcdb064aad6ff33b6148725226cd608e
 F vsixtest/vsixtest_TemporaryKey.pfx e5b1b036facdb453873e7084e1cae9102ccc67a0
-P 7c6aa6f38403931df7940c7acfeba4e2f8099a419222fcab2a3c959ccae90e40
-R 4b7008b2d896fb2345868e9330fd6fad
+P 99aab32da14cc76beb5c1823a70bdeab144459398d61c42a858be4d6868d361e
+R e29356ef3c8971c7f2ece96d7e581c9d
 U drh
-Z 8d007010cf38126393218aad44f4b7ca
+Z cc62deac5b0c740612d90bc9deff87dd

diff --git a/manifest.uuid b/manifest.uuid
index cd003681d9ff9e703cdc4fb661d8ea4f67e647c2..6930961c73a23b22cda44d981764cd50811e9692 100644 (file)
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-99aab32da14cc76beb5c1823a70bdeab144459398d61c42a858be4d6868d361e
\ No newline at end of file
+a5940294b2ac8d157d7fa72f65ee70b713f7feb8a0a98d7f47e71acd1b6942b1
\ No newline at end of file

diff --git a/src/printf.c b/src/printf.c
index 476d13e789aa21a54041698cf064be4199742cba..9aab863ed2b1608f5b5b0156b5ce055900e83c7d 100644 (file)
--- a/src/printf.c
+++ b/src/printf.c
@@ -921,7 +921,7 @@ static int sqlite3StrAccumEnlarge(StrAccum *p, int N){
   }else{
     char *zOld = isMalloced(p) ? p->zText : 0;
     i64 szNew = p->nChar;
-    szNew += N + 1;
+    szNew += (sqlite3_int64)N + 1;
     if( szNew+p->nChar<=p->mxAlloc ){
       /* Force exponential buffer size growth as long as it does not overflow,
       ** to avoid having to call this routine too often */