When saving the position of a cursor at the b-tree layer, allocate a few extra

bytes at the end of the buffer used to save the key. Otherwise, if the key is
corrupt, the code that restores the cursor position may overread the buffer by a
little.

FossilOrigin-Name: 160b1e31c0f27257c06c2987af9ec3a64abfacb2150325b72e8ccd3d217b5baa

diff --git a/manifest b/manifest
index 3f879cecf625dbaa0dec9da10439fd3b6ac06a51..3e1bf9a2fea6a9e074a8f45ebd432a9a25ae1738 100644 (file)
--- a/manifest
+++ b/manifest
@@ -1,5 +1,5 @@
-C Fix\sa\sproblem\swith\sbytecode\sgeneration\swhen\sa\squery\sinvolves\stwo\sor\smore\nindexes\son\sexpressions\sconnected\sby\sOR.\nTicket\s[d96eba87698a428c1ddd0790ea04]
-D 2018-12-14T11:16:52.652
+C When\ssaving\sthe\sposition\sof\sa\scursor\sat\sthe\sb-tree\slayer,\sallocate\sa\sfew\sextra\nbytes\sat\sthe\send\sof\sthe\sbuffer\sused\sto\ssave\sthe\skey.\sOtherwise,\sif\sthe\skey\sis\ncorrupt,\sthe\scode\sthat\srestores\sthe\scursor\sposition\smay\soverread\sthe\sbuffer\sby\sa\nlittle.
+D 2018-12-14T13:18:35.216
 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
 F Makefile.in d8b254f8bb81bab43c340d70d17dc3babab40fcc8a348c8255881f780a45fee6
@@ -448,7 +448,7 @@ F src/auth.c 0fac71038875693a937e506bceb492c5f136dd7b1249fbd4ae70b4e8da14f9df
 F src/backup.c 78d3cecfbe28230a3a9a1793e2ead609f469be43e8f486ca996006be551857ab
 F src/bitvec.c 17ea48eff8ba979f1f5b04cc484c7bb2be632f33
 F src/btmutex.c 8acc2f464ee76324bf13310df5692a262b801808984c1b79defb2503bbafadb6
-F src/btree.c 14b4b17b75af36e0431df2676205296bc234a634cf18798ad81f768b455b9e93
+F src/btree.c 89e9abe6a3f7461c8c5d44314b261e1dd29a31557d1dd91c72378bc0976fc1f6
 F src/btree.h febb2e817be499570b7a2e32a9bbb4b607a9234f6b84bb9ae84916d4806e96f2
 F src/btreeInt.h 620ab4c7235f43572cf3ac2ac8723cbdf68073be4d29da24897c7b77dda5fd96
 F src/build.c ef9d7dc73e40dd9d10c28848343e21e8bc1baaab92cfb75eda893fff4fbf6b55
@@ -773,7 +773,7 @@ F test/dataversion1.test 6e5e86ac681f0782e766ebcb56c019ae001522d114e0e111e5ebf68
 F test/date.test 9b73bbeb1b82d9c1f44dec5cf563bf7da58d2373
 F test/date2.test 74c234bece1b016e94dd4ef9c8cc7a199a8806c0e2291cab7ba64bace6350b10
 F test/dbfuzz.c 73047c920d6210e5912c87cdffd9a1c281d4252e
-F test/dbfuzz001.test 28f24ed01e9322f4c7aeba4c228f57e9e8ab6a96b474465e872425205a31b1b2
+F test/dbfuzz001.test 96b52856ffce5442e404847de33487db5ce49aa27778497a42328d5acf6859d7
 F test/dbfuzz2-seed1.db e6225c6f3d7b63f9c5b6867146a5f329d997ab105bee64644dc2b3a2f2aebaee
 F test/dbfuzz2.c b8ed9b32a1f287505e55970e55203bedcb9170f137ecefa2254033c9faccdfba
 F test/dbpage.test 650234ba683b9d82b899c6c51439819787e7609f17a0cc40e0080a7b6443bc38
@@ -1787,8 +1787,7 @@ F vsixtest/vsixtest.tcl 6a9a6ab600c25a91a7acc6293828957a386a8a93
 F vsixtest/vsixtest.vcxproj.data 2ed517e100c66dc455b492e1a33350c1b20fbcdc
 F vsixtest/vsixtest.vcxproj.filters 37e51ffedcdb064aad6ff33b6148725226cd608e
 F vsixtest/vsixtest_TemporaryKey.pfx e5b1b036facdb453873e7084e1cae9102ccc67a0
-P cc42dd15100db28a9796254f69a4e367ea5eae29f546be055017cf3e12aa66ba 89a25abfcd069aebdf817890e5c27f46de3000fb858ae01029e4528f9d677567
-R 6e4a89239ac2714d2f3e8e3c0f340ed6
-T +closed 89a25abfcd069aebdf817890e5c27f46de3000fb858ae01029e4528f9d677567
-U drh
-Z 4c06ed13d4147ae87910536f3d08fc7f
+P 7e4ed8b5c2047b69bbb037497111e56e465a4d9f8afca3b337f9ac744471dc4a
+R ba1eb44fdcbd375391cb2e9633b3bcc5
+U dan
+Z 7755266d0736215443f101017f7858b1

diff --git a/manifest.uuid b/manifest.uuid
index b4892511f2fec4279b619310b5f1a6a77e38fd18..14967ae5e68673f04566a3cd6245e5a1a606de8c 100644 (file)
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-7e4ed8b5c2047b69bbb037497111e56e465a4d9f8afca3b337f9ac744471dc4a
\ No newline at end of file
+160b1e31c0f27257c06c2987af9ec3a64abfacb2150325b72e8ccd3d217b5baa
\ No newline at end of file

diff --git a/src/btree.c b/src/btree.c
index 52b816fbe3f3805ed8c4a0b512dab697bba0b9c8..55518bd8a20786b207676a4f63fe646a65e544b1 100644 (file)
--- a/src/btree.c
+++ b/src/btree.c
@@ -660,10 +660,15 @@ static int saveCursorKey(BtCursor *pCur){
     /* Only the rowid is required for a table btree */
     pCur->nKey = sqlite3BtreeIntegerKey(pCur);
   }else{
-    /* For an index btree, save the complete key content */
+    /* For an index btree, save the complete key content. It is possible
+    ** that the current key is corrupt. In that case, it is possible that
+    ** the sqlite3VdbeRecordUnpack() function may overread the buffer by
+    ** up to the size of 1 varint plus 1 8-byte value when the cursor 
+    ** position is restored. Hence the 17 bytes of padding allocated 
+    ** below. */
     void *pKey;
     pCur->nKey = sqlite3BtreePayloadSize(pCur);
-    pKey = sqlite3Malloc( pCur->nKey );
+    pKey = sqlite3Malloc( pCur->nKey + 9 + 8 );
     if( pKey ){
       rc = sqlite3BtreePayload(pCur, 0, (int)pCur->nKey, pKey);
       if( rc==SQLITE_OK ){

diff --git a/test/dbfuzz001.test b/test/dbfuzz001.test
index 75117f729189c691a9c1b2ea155e02eedbb0407c..0c19b0618028008ebe8c35245b789fd0d70e8dd7 100644 (file)
--- a/test/dbfuzz001.test
+++ b/test/dbfuzz001.test
@@ -269,4 +269,87 @@ do_test dbfuzz001-200 {
   catchsql {INSERT INTO t3 SELECT * FROM t2;}
 } {1 {database disk image is malformed}}
 
+
+do_test dbfuzz001-110 {
+  sqlite3 db {}
+  db deserialize [decode_hexdb {
+| size 3584 pagesize 512 filename x/c02.db
+| page 1 offset 0
+|      0: 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00   SQLite format 3.
+|     16: 02 00 01 01 00 40 20 20 00 00 00 0c 00 00 00 07   .....@  ........
+|     32: 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 04   ................
+|     48: 00 00 00 00 00 00 00 04 00 00 00 01 00 00 00 00   ................
+|     80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c   ................
+|     96: 00 2e 2c 50 0d 00 00 00 06 01 06 00 01 da 01 b0   ..,P............
+|    112: 01 56 01 86 01 2a 01 06 00 00 00 00 00 00 00 00   .V...*..........
+|    256: 00 00 00 00 00 00 22 07 06 17 11 11 01 31 74 61   ......"......1ta
+|    272: 62 6c 65 74 34 74 34 07 43 52 45 41 54 45 20 54   blet4t4.CREATE T
+|    288: 41 42 4c 45 20 74 34 28 78 29 2a 06 06 17 13 11   ABLE t4(x)*.....
+|    304: 01 3f 69 6e 64 65 78 74 33 78 74 33 05 43 52 45   .?indext3xt3.CRE
+|    320: 41 54 45 20 49 4e 44 45 58 20 74 33 78 20 4f 4e   ATE INDEX t3x ON
+|    336: 20 74 33 28 78 29 2e 04 06 17 15 11 01 45 69 6e    t3(x).......Ein
+|    352: 64 65 78 74 32 63 64 74 32 05 43 52 45 41 54 45   dext2cdt2.CREATE
+|    368: 20 49 4e 44 45 58 20 74 32 63 64 20 4f 4e 20 74    INDEX t2cd ON t
+|    384: 32 28 63 2c 64 29 28 05 06 17 11 11 01 3d 74 61   2(c,d)(......=ta
+|    400: 62 6c 65 74 33 74 33 07 43 52 45 41 54 45 20 54   blet3t3.CREATE T
+|    416: 41 42 4c 45 20 74 33 28 63 2c 78 2c 65 2c 66 29   ABLE t3(c,x,e,f)
+|    432: 28 02 06 17 11 11 01 3d 74 61 74 65 6c 03 62 74   (......=tatel.bt
+|    448: 32 32 43 52 45 41 54 45 20 54 41 42 4c 45 20 74   22CREATE TABLE t
+|    464: 32 28 63 2c 64 2c 65 2c 66 29 24 01 06 17 11 11   2(c,d,e,f)$.....
+|    480: 01 35 74 61 62 6c 65 74 31 74 31 02 43 52 45 41   .5tablet1t1.CREA
+|    496: 54 45 20 54 41 42 4c 45 20 74 31 28 61 2c 62 29   TE TABLE t1(a,b)
+| page 2 offset 512
+|      0: 0d 00 00 00 04 01 cf 00 01 fa 01 f3 01 de 01 cf   ................
+|    160: 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00   .. .............
+|    448: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0d   ................
+|    464: 04 03 17 17 73 65 76 65 6e 65 69 67 68 74 13 03   ....seveneight..
+|    480: 03 07 07 40 14 00 00 00 00 00 00 40 18 00 00 00   ...@.......@....
+|    496: 00 00 00 05 02 03 01 01 03 04 04 01 03 09 01 02   ................
+| page 3 offset 1024
+|      0: 0d 00 00 00 08 01 54 00 01 f7 01 ec 01 c5 01 aa   ......T.........
+|     16: 01 a1 01 96 01 6f 01 54 00 00 00 00 00 00 00 00   .....o.T........
+|    112: 00 00 dd 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
+|    336: 00 00 00 00 19 08 05 17 17 17 17 65 69 67 68 74   ...........eight
+|    352: 65 69 67 68 74 73 65 76 65 6e 73 65 76 65 6e 25   eightsevenseven%
+|    368: 07 05 07 07 07 07 40 18 00 00 00 00 00 00 40 18   ......@.......@.
+|    384: 00 00 00 00 00 00 40 14 00 00 00 00 00 00 40 14   ......@.......@.
+|    400: 00 00 00 00 00 00 09 06 05 01 01 01 01 04 04 03   ................
+|    416: 03 07 05 05 01 01 09 09 02 02 19 04 05 17 17 17   ................
+|    432: 17 73 65 76 65 6e 65 69 67 68 74 65 69 67 68 74   .seveneighteight
+|    448: 73 65 76 65 6e 25 03 05 07 07 07 07 40 14 00 00   seven%......@...
+|    464: 00 00 00 00 40 18 00 00 00 00 00 00 40 18 00 00   ....@.......@...
+|    480: 00 00 00 00 40 14 00 00 00 00 00 00 09 02 05 01   ....@...........
+|    496: 01 01 01 03 04 04 03 07 01 05 09 01 01 09 02 02   ................
+| page 4 offset 1536
+|      0: 0d 00 00 00 00 02 00 00 00 00 00 00 00 00 00 00   ................
+|    192: 00 00 00 00 00 00 7f 00 00 00 00 00 00 00 00 00   ................
+|    208: 00 e5 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
+| page 5 offset 2048
+|      0: 0a 00 00 00 08 01 96 00 01 fa 01 c4 01 f2 01 bc   ................
+|     16: 01 dc 01 a6 01 96 01 cc 00 00 00 00 00 00 00 00   ................
+|    240: 00 00 00 00 00 00 00 00 00 00 00 00 00 0e 00 00   ................
+|    400: 00 00 00 00 00 00 0f 04 17 07 01 65 69 67 68 74   ...........eight
+|    416: 65 69 67 68 74 08 15 04 07 07 01 40 18 00 00 00   eight......@....
+|    432: 00 00 00 40 18 00 00 00 00 00 00 07 07 04 01 01   ...@............
+|    448: 01 04 04 06 07 04 01 01 01 02 02 05 0f 04 17 17   ................
+|    464: 01 73 65 76 65 6e 65 69 67 68 74 04 15 04 07 07   .seveneight.....
+|    480: 01 40 14 00 00 00 00 00 00 40 18 00 00 00 00 00   .@.......@......
+|    496: 00 03 07 04 01 01 01 03 04 02 05 04 09 01 09 02   ................
+| page 6 offset 2560
+|      0: 0a 00 00 00 00 02 00 00 00 00 00 00 00 00 00 00   ................
+|    464: 00 00 00 00 00 00 00 00 00 00 7f 00 00 00 00 00   ................
+| page 7 offset 3072
+|      0: 0d 00 00 00 08 01 c2 00 01 fb 01 f6 01 f1 01 ec   ................
+|     16: 01 e0 01 d4 01 cb 01 c2 00 00 00 00 00 00 00 00   ................
+|    448: 00 00 07 08 02 17 65 69 67 68 74 07 07 02 17 65   ......eight....e
+|    464: 69 67 68 74 0a 06 02 07 40 18 00 00 00 00 00 00   ight....@.......
+|    480: 0a 05 02 07 40 18 00 00 00 00 00 00 03 04 02 01   ....@...........
+|    496: 04 03 03 02 01 04 03 02 02 01 02 03 01 02 01 02   ................
+| end x/c02.db
+  }]
+  execsql {
+    DELETE FROM t3 WHERE x IN (SELECT x FROM t4);
+  }
+} {}
+
 finish_test