Improved defenses against deliberately corrupted sqlite_stat1 tables.

FossilOrigin-Name: ee34db31a0776ec05cbea9f3fec15a58b1a4d5f21c7f3455563862da48ec47cb

diff --git a/manifest b/manifest
index b94553f9fdd1ffcb0ae2c8bc1c8881023e0af670..ae9d495f69a2a7e3cf21d1011032a298c5d045b1 100644 (file)
--- a/manifest
+++ b/manifest
@@ -1,5 +1,5 @@
-C Fix\sa\sharmless\scompiler\swarning.
-D 2024-01-01T15:35:59.808
+C Improved\sdefenses\sagainst\sdeliberately\scorrupted\ssqlite_stat1\stables.
+D 2024-01-01T15:49:31.962
 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
 F LICENSE.md df5091916dbb40e6e9686186587125e1b2ff51f022cc334e886c19a0e9982724
@@ -670,7 +670,7 @@ F sqlite3.1 acdff36db796e2d00225b911d3047d580cd136547298435426ce9d40347973cc
 F sqlite3.pc.in 48fed132e7cb71ab676105d2a4dc77127d8c1f3a
 F sqlite_cfg.h.in baf2e409c63d4e7a765e17769b6ff17c5a82bbd9cbf1e284fd2e4cefaff3fcf2
 F src/alter.c 30c2333b8bb3af71e4eb9adeadee8aa20edb15917ed44b8422e5cd15f3dfcddc
-F src/analyze.c fa1ac0aa765381ae3b4793858e538ed9b3ff89df53f1a78d7995ba783af9c202
+F src/analyze.c 04e0ebceaa0e67ee77cd1d83ff0fec53525d14da00c06cbb82c5110f37a7cb25
 F src/attach.c cc9d00d30da916ff656038211410ccf04ed784b7564639b9b61d1839ed69fd39
 F src/auth.c 19b7ccacae3dfba23fc6f1d0af68134fa216e9040e53b0681b4715445ea030b4
 F src/backup.c 5c97e8023aab1ce14a42387eb3ae00ba5a0644569e3476f38661fa6f824c3523
@@ -2156,8 +2156,8 @@ F vsixtest/vsixtest.tcl 6a9a6ab600c25a91a7acc6293828957a386a8a93
 F vsixtest/vsixtest.vcxproj.data 2ed517e100c66dc455b492e1a33350c1b20fbcdc
 F vsixtest/vsixtest.vcxproj.filters 37e51ffedcdb064aad6ff33b6148725226cd608e
 F vsixtest/vsixtest_TemporaryKey.pfx e5b1b036facdb453873e7084e1cae9102ccc67a0
-P 4a8fc17365ccd989cc8050179ac586ca246698c71a64d7209786fb5569ba583a
-R 6b3835dc51ce319d597f266875a00290
+P b5aa1aea38cb5399161d368f382f508c703996f8c751e02d825926c46d14481b
+R 2cb372d3c0e9e80799a0ea014f7551ba
 U drh
-Z 9fd7dd87860f96b3d0600dd0889b9d52
+Z b8364f6a8f06e71b05160aa32904415c
 # Remove this line to create a well-formed Fossil manifest.

diff --git a/manifest.uuid b/manifest.uuid
index c90783cf11a8482c717f853c51ae516a6a93ffad..ff93b69c996bfcd7d25d2a61b3619e903a2af1ce 100644 (file)
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-b5aa1aea38cb5399161d368f382f508c703996f8c751e02d825926c46d14481b
\ No newline at end of file
+ee34db31a0776ec05cbea9f3fec15a58b1a4d5f21c7f3455563862da48ec47cb
\ No newline at end of file

diff --git a/src/analyze.c b/src/analyze.c
index ad8723fb83ae339c01704e0b475762630a47068f..0d71a20df7e5d8084e52f644f009b3ced84b4760 100644 (file)
--- a/src/analyze.c
+++ b/src/analyze.c
@@ -1612,7 +1612,7 @@ static void decodeIntArray(
         int jj = 1;
         int kk = 4;
         LogEst mx = aLog[0];
-        while( sqlite3Isdigit(z[kk]) ){
+        for(jj=1; sqlite3Isdigit(z[kk]) && jj<nOut; jj++){
           u64 vx = z[kk++] - '0';
           LogEst scale;
           while( sqlite3Isdigit(z[kk]) ){ vx = vx*10 + z[kk++]-'0'; }
@@ -1623,9 +1623,7 @@ static void decodeIntArray(
             if( adjusted>mx ) adjusted = mx;
             aLog[jj] = adjusted;
           }
-          if( jj==pIndex->nKeyCol ) break;
           if( z[kk]==',' ) kk++;
-          jj++;
         }
       }
 #ifdef SQLITE_ENABLE_COSTMULT
@@ -1707,6 +1705,7 @@ static int analysisLoader(void *pData, int argc, char **argv, char **NotUsed){
     }
   }else{
     Index fakeIdx;
+    memset(&fakeIdx, 0, sizeof(fakeIdx));
     fakeIdx.szIdxRow = pTable->szTabRow;
 #ifdef SQLITE_ENABLE_COSTMULT
     fakeIdx.pTable = pTable;