Fix an integer overflow problem with the dbstat virtual table that comes up

when trying to analyze a corrupt database.

FossilOrigin-Name: 1d64f4a8af81fe1235fffa54884d8f842a48ff6a33d6172f0cd65bf42fe8b2a1

diff --git a/manifest b/manifest
index aadd6f393dc22e01943ec967988b70aad1f2d48a..f578463541e6422814a2e172b3c7d5c986ab4216 100644 (file)
--- a/manifest
+++ b/manifest
@@ -1,5 +1,5 @@
-C Fix\sa\stypo\sin\sa\scomment.\s\sNo\schanges\sto\scode.
-D 2020-03-19T15:57:03.116
+C Fix\san\sinteger\soverflow\sproblem\swith\sthe\sdbstat\svirtual\stable\sthat\scomes\sup\nwhen\strying\sto\sanalyze\sa\scorrupt\sdatabase.
+D 2020-03-19T17:27:52.087
 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
 F LICENSE.md df5091916dbb40e6e9686186587125e1b2ff51f022cc334e886c19a0e9982724
@@ -481,7 +481,7 @@ F src/complete.c a3634ab1e687055cd002e11b8f43eb75c17da23e
 F src/ctime.c 6a77ec9e0eb87aea929e002c816298907e337094a7b556898ae2d1e6be209f90
 F src/date.c 6c408fdd2e9ddf6e8431aba76315a2d061bea2cec8fbb75e25d7c1ba08274712
 F src/dbpage.c 8a01e865bf8bc6d7b1844b4314443a6436c07c3efe1d488ed89e81719047833a
-F src/dbstat.c 0f55297469d4244ab7df395849e1af98eb5e95816af7c661e7d2d8402dea23da
+F src/dbstat.c 33fc9838b5b9fba07f9ab9e9aba956f0afeeb1af0037a98d984fdc2f698c64fd
 F src/delete.c 11000121c4281c0bce4e41db29addfaea0038eaa127ece02557c9207bc3e541d
 F src/expr.c ed718ee2206166c9c2fc4fe89eadb1f369318aeb8645e06033566b387970fb9a
 F src/fault.c 460f3e55994363812d9d60844b2a6de88826e007
@@ -1016,7 +1016,7 @@ F test/fuzz3.test 9c813e6613b837cb7a277b0383cd66bfa07042b4cf0317157c35852f30043c
 F test/fuzz4.test c229bcdb45518a89e1d208a21343e061503460ac69fae1539320a89f572eb634
 F test/fuzz_common.tcl b7197de6ed1ee8250a4f82d67876f4561b42ee8cbbfc6160dcb66331bad3f830
 F test/fuzz_malloc.test f348276e732e814802e39f042b1f6da6362a610af73a528d8f76898fde6b22f2
-F test/fuzzcheck.c cdd94f1710957b8b907019b25c6cf4f7b63815a08b19021e8b215bc2419bb7f9
+F test/fuzzcheck.c 1ead09510c7bb3475675e499feb721790544e57e00168d687124d9d94ea843ac
 F test/fuzzdata1.db d36e88741b4f23bcbaaf55b006290669d03c6c891cf13c7b3a53bc1b097b693f
 F test/fuzzdata2.db 128b3feeb78918d075c9b14b48610145a0dd4c8d6f1ca7c2870c7e425f5bf31f
 F test/fuzzdata3.db c6586d3e3cef0fbc18108f9bb649aa77bfc38aba
@@ -1860,7 +1860,7 @@ F vsixtest/vsixtest.tcl 6a9a6ab600c25a91a7acc6293828957a386a8a93
 F vsixtest/vsixtest.vcxproj.data 2ed517e100c66dc455b492e1a33350c1b20fbcdc
 F vsixtest/vsixtest.vcxproj.filters 37e51ffedcdb064aad6ff33b6148725226cd608e
 F vsixtest/vsixtest_TemporaryKey.pfx e5b1b036facdb453873e7084e1cae9102ccc67a0
-P 38e3dd389d142e520c71139ec84aa3c7722992af28a5f93a7f16e0ea176b74bb
-R 4071bc4187fb5602ca32977f98f52f75
+P 3a51919ac23ae7312d78905334dc97742b517a7476052a85aa07945d9c77697b
+R 11059e9f9145d47852beb0ef202844f6
 U drh
-Z d2aaf73a647da547ab47de7a5b33c862
+Z 6be6a8645f621862376d12081de1edc9

diff --git a/manifest.uuid b/manifest.uuid
index 88395c4956ee6407f593470e515440e856fe1a23..0081a71139942c4d6d23f54a572c68b6a42a9f07 100644 (file)
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-3a51919ac23ae7312d78905334dc97742b517a7476052a85aa07945d9c77697b
\ No newline at end of file
+1d64f4a8af81fe1235fffa54884d8f842a48ff6a33d6172f0cd65bf42fe8b2a1
\ No newline at end of file

diff --git a/src/dbstat.c b/src/dbstat.c
index 2fea48ce8c9fe37a61b73c26a262c4f73a54f650..2931024e185c7baef795c5b557ba9ffcf6f4c46f 100644 (file)
--- a/src/dbstat.c
+++ b/src/dbstat.c
@@ -452,7 +452,9 @@ static int statDecodePage(Btree *pBt, StatPage *p){
         if( nPayload>(u32)nLocal ){
           int j;
           int nOvfl = ((nPayload - nLocal) + nUsable-4 - 1) / (nUsable - 4);
-          if( iOff+nLocal>nUsable ) goto statPageIsCorrupt;
+          if( iOff+nLocal>nUsable || nPayload>0x7fffffff ){
+            goto statPageIsCorrupt;
+          }
           pCell->nLastOvfl = (nPayload-nLocal) - (nOvfl-1) * (nUsable-4);
           pCell->nOvfl = nOvfl;
           pCell->aOvfl = sqlite3_malloc64(sizeof(u32)*nOvfl);

diff --git a/test/fuzzcheck.c b/test/fuzzcheck.c
index 3785024368702e0f14eec96a0407579264ef60be..992b225d36ba7fed91fb789f9779fe5aa1c5b450 100644 (file)
--- a/test/fuzzcheck.c
+++ b/test/fuzzcheck.c
@@ -94,11 +94,9 @@
 # include <unistd.h>
 #endif
 
-#ifdef SQLITE_OSS_FUZZ
-# include <stddef.h>
-# if !defined(_MSC_VER)
-#  include <stdint.h>
-# endif
+#include <stddef.h>
+#if !defined(_MSC_VER)
+# include <stdint.h>
 #endif
 
 #if defined(_MSC_VER)