Earlier detection of corruption in sqlite3BtreeDelete().

dbsqlfuzz a4c48c291d6e40157a1b749a05eaa7c7faf5a625.

FossilOrigin-Name: 728633c0bd665ed94e4969180a83ef102c54371e339bc06ea6cb006eaefdb267

diff --git a/manifest b/manifest
index b9228274a67865f97d578c6d8304e84125f7995c..227174aa99a19d6860d2870282441ae963bef4ce 100644 (file)
--- a/manifest
+++ b/manifest
@@ -1,5 +1,5 @@
-C Omit\sthe\sthe\scount-of-view\soptimization\sif\sthere\sis\sa\sHAVING\sclause.
-D 2023-03-31T23:59:31.364
+C Earlier\sdetection\sof\scorruption\sin\ssqlite3BtreeDelete().\ndbsqlfuzz\sa4c48c291d6e40157a1b749a05eaa7c7faf5a625.
+D 2023-04-02T18:49:45.072
 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
 F LICENSE.md df5091916dbb40e6e9686186587125e1b2ff51f022cc334e886c19a0e9982724
@@ -560,7 +560,7 @@ F src/auth.c f4fa91b6a90bbc8e0d0f738aa284551739c9543a367071f55574681e0f24f8cf
 F src/backup.c a2891172438e385fdbe97c11c9745676bec54f518d4447090af97189fd8e52d7
 F src/bitvec.c 7c849aac407230278445cb069bebc5f89bf2ddd87c5ed9459b070a9175707b3d
 F src/btmutex.c 6ffb0a22c19e2f9110be0964d0731d2ef1c67b5f7fabfbaeb7b9dabc4b7740ca
-F src/btree.c 0621c72ab215588f649d6f4466c6212d5b3ee3283eb4aa00d89e202cd5951bea
+F src/btree.c 946f6a8ae18d72647a150c5fc9fc7dc7d4f7e68864141cd0b6323a56cd91ad03
 F src/btree.h aa354b9bad4120af71e214666b35132712b8f2ec11869cb2315c52c81fad45cc
 F src/btreeInt.h 06bb2c1a07172d5a1cd27a2a5d617b93b1e976c5873709c31964786f86365a6e
 F src/build.c 8357d6ca9a8c9afc297c431df28bc2af407b47f3ef2311875276c944b30c4d54
@@ -884,7 +884,7 @@ F test/corruptE.test 4143791f2dfb443aec5b7fabfa5821e6063eccc3b49b06f212c2f014715
 F test/corruptF.test be9fde98e4c93648f1ba52b74e5318edc8f59fe4
 F test/corruptG.test adf79b669cbfd19e28c8191a610d083ae53a6d51
 F test/corruptH.test 79801d97ec5c2f9f3c87739aa1ec2eb786f96454
-F test/corruptI.test a17bbf54fdde78d43cf3cc34b0057719fd4a173a3d824285b67dc5257c064c7b
+F test/corruptI.test 9d8cbf6214e492abe9e822e759b9751ae336cec0a6fe3ff3b37bfbd8ff9c22ca
 F test/corruptJ.test 4d5ccc4bf959464229a836d60142831ef76a5aa4
 F test/corruptK.test 5b4212fe346699831c5ad559a62c54e11c0611bdde1ea8423a091f9c01aa32af
 F test/corruptL.test b42978028afc5eefc8b51d8d7cd6a9344ba7362d7ed4511ee2070f56e06d5a1c
@@ -2046,9 +2046,9 @@ F vsixtest/vsixtest.tcl 6a9a6ab600c25a91a7acc6293828957a386a8a93
 F vsixtest/vsixtest.vcxproj.data 2ed517e100c66dc455b492e1a33350c1b20fbcdc
 F vsixtest/vsixtest.vcxproj.filters 37e51ffedcdb064aad6ff33b6148725226cd608e
 F vsixtest/vsixtest_TemporaryKey.pfx e5b1b036facdb453873e7084e1cae9102ccc67a0
-P cf8dd8cd0857f402afa43feb1b71a88f7429df89448e2321cad3777484d0c438
-Q +babe2b5e59647ac9db4601e67c25190aac14eb76d5fcb9fa5b3692b955fefd61
-R e4e5f9de111b60d6f54e23df5306e8b0
+P a8faea2842f412dfa2588b65868acb523c9eae1b5ad15c631a1ab193eaa615a7
+Q +978dc71c388b37740da38c310674315c7d7fe814d1daa16a146b4df71385d1e1
+R 1246ed5bff2b62d28852f0379cd6a67d
 U drh
-Z 1ef1a75db6c24559cab23610a3264f82
+Z 0805557b24b03b082d8837880f959253
 # Remove this line to create a well-formed Fossil manifest.

diff --git a/manifest.uuid b/manifest.uuid
index 43bfefae917a6cbd9e6869e07b30262bad3442d1..90fc78d223dca3108b5ad25e36976db6a2581911 100644 (file)
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-a8faea2842f412dfa2588b65868acb523c9eae1b5ad15c631a1ab193eaa615a7
\ No newline at end of file
+728633c0bd665ed94e4969180a83ef102c54371e339bc06ea6cb006eaefdb267
\ No newline at end of file

diff --git a/src/btree.c b/src/btree.c
index 3de1a0a500473fbe4041ba6fd8c7a1764c378edb..4e2bd780178e5a351f0c8de9fc85a708a26e5db3 100644 (file)
--- a/src/btree.c
+++ b/src/btree.c
@@ -7302,7 +7302,7 @@ static int rebuildPage(
 
   assert( i<iEnd );
   j = get2byte(&aData[hdr+5]);
-  if( j>(u32)usableSize ){ j = 0; }
+  if( NEVER(j>(u32)usableSize) ){ j = 0; }
   memcpy(&pTmp[j], &aData[j], usableSize - j);
 
   for(k=0; pCArray->ixNx[k]<=i && ALWAYS(k<NB*2); k++){}
@@ -9486,6 +9486,9 @@ int sqlite3BtreeDelete(BtCursor *pCur, u8 flags){
   if( pPage->nFree<0 && btreeComputeFreeSpace(pPage) ){
     return SQLITE_CORRUPT_BKPT;
   }
+  if( pCell<&pPage->aCellIdx[pPage->nCell] ){
+    return SQLITE_CORRUPT_BKPT;
+  }
 
   /* If the BTREE_SAVEPOSITION bit is on, then the cursor position must
   ** be preserved following this delete operation. If the current delete

diff --git a/test/corruptI.test b/test/corruptI.test
index 12ce4465402175b672a98eb217f61ee0a245ce71..65ef3762586aab1da2da0b33788ee19c439503c4 100644 (file)
--- a/test/corruptI.test
+++ b/test/corruptI.test
@@ -123,18 +123,13 @@ do_execsql_test 4.0 {
 set root [db one {SELECT rootpage FROM sqlite_master}]
 set offset [expr ($root-1) * 65536]
 
-ifcapable oversize_cell_check {
-  set res {1 {database disk image is malformed}}
-} else {
-  set res {0 {}}
-}
 do_test 4.1 {
   db close
   hexio_write test.db [expr $offset + 8 + 2] 0000
   hexio_write test.db [expr $offset + 5] 0000
   sqlite3 db test.db
   catchsql { DELETE FROM t1 WHERE a=0 }
-} $res
+} {1 {database disk image is malformed}}
 
 
 #-------------------------------------------------------------------------