From: dan <dan@noemail.net>
Date: Mon, 25 May 2015 18:47:26 +0000 (+0000)
Subject: Fix a couple of btree asserts that would fail when encountering 32-bit rollover in... 
X-Git-Tag: version-3.8.11~223
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=0f8076dd696db045e95781ddf964a4783f86ee8a;p=thirdparty%2Fsqlite.git

Fix a couple of btree asserts that would fail when encountering 32-bit rollover in cell payload size fields (cell payloads this large always indicate corruption).

FossilOrigin-Name: 8fa0937a2f3476dd280259e252d6f422c33d38ee
---

diff --git a/manifest b/manifest
index f15e3642d6..a97e1a70aa 100644
--- a/manifest
+++ b/manifest
@@ -1,5 +1,5 @@
-C Fix\sa\scase\swhere\sdatabase\scorruption\smay\scause\sSQLite\sto\swrite\spast\sthe\send\sof\sa\sbuffer.
-D 2015-05-25T17:07:29.779
+C Fix\sa\scouple\sof\sbtree\sasserts\sthat\swould\sfail\swhen\sencountering\s32-bit\srollover\sin\scell\spayload\ssize\sfields\s(cell\spayloads\sthis\slarge\salways\sindicate\scorruption).
+D 2015-05-25T18:47:26.960
 F Makefile.arm-wince-mingw32ce-gcc d6df77f1f48d690bd73162294bbba7f59507c72f
 F Makefile.in 0a6ae26396ec696221021780dffbb894ff3cead7
 F Makefile.linux-gcc 91d710bdc4998cb015f39edf3cb314ec4f4d7e23
@@ -192,7 +192,7 @@ F src/auth.c b56c78ebe40a2110fd361379f7e8162d23f92240
 F src/backup.c ff743689c4d6c5cb55ad42ed9d174b2b3e71f1e3
 F src/bitvec.c 5eb7958c3bf65210211cbcfc44eff86d0ded7c9d
 F src/btmutex.c 45a968cc85afed9b5e6cf55bf1f42f8d18107f79
-F src/btree.c 030535334184d12260df4bfcefed672f4d83dcf8
+F src/btree.c 91a435b34d35e715ce7acea0b4844030b955f32c
 F src/btree.h 969adc948e89e449220ff0ff724c94bb2a52e9f1
 F src/btreeInt.h 973a22a6fd61350b454ad614832b1f0a5e25a1e4
 F src/build.c d5d9090788118178190c5724c19f93953b8c7a4e
@@ -452,7 +452,7 @@ F test/corruptE.test 193b4ca4e927e77c1d5f4f56203ddc998432a7ee
 F test/corruptF.test be9fde98e4c93648f1ba52b74e5318edc8f59fe4
 F test/corruptG.test 1ab3bf97ee7bdba70e0ff3ba2320657df55d1804
 F test/corruptH.test 5dd4fa98c6c1ed33b178f9e8a48c4fdd3cfc9067
-F test/corruptI.test bd6986db57424a4d61bfc9f67e9dc1c2ae4f2cfb
+F test/corruptI.test bcb2aa4e7d881a6b64f6bb90630906820e13f8e4
 F test/corruptJ.test 9e29e7a81ee3b6ac50f77ea7a9e2f3fa03f32d91
 F test/cost.test 19d314526616ce4473eb4e4e450fcb94499ce318
 F test/count.test cb2e0f934c6eb33670044520748d2ecccd46259c
@@ -1278,7 +1278,7 @@ F tool/vdbe_profile.tcl 67746953071a9f8f2f668b73fe899074e2c6d8c1
 F tool/warnings-clang.sh f6aa929dc20ef1f856af04a730772f59283631d4
 F tool/warnings.sh 0abfd78ceb09b7f7c27c688c8e3fe93268a13b32
 F tool/win/sqlite.vsix deb315d026cc8400325c5863eef847784a219a2f
-P 00a473c56188cd60a74559effb114140e3fe8a8d
-R dc376bcfcb68a6e7c538fd875c1e9af7
+P 97806a78142b15f89878e25ee70dc5b0524d6793
+R 0d20a2d5be2933ea91911d50d1989d04
 U dan
-Z 5eaace98730adbf7603d90b10f2ffa48
+Z a82c82ed9d895f4cf06b3ec1a9c1aaf1
diff --git a/manifest.uuid b/manifest.uuid
index c6cb20ab53..89e18e7891 100644
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-97806a78142b15f89878e25ee70dc5b0524d6793
\ No newline at end of file
+8fa0937a2f3476dd280259e252d6f422c33d38ee
\ No newline at end of file
diff --git a/src/btree.c b/src/btree.c
index c9703fc8e1..3f1082e394 100644
--- a/src/btree.c
+++ b/src/btree.c
@@ -5750,7 +5750,9 @@ static int clearCell(
   assert( pBt->usableSize > 4 );
   ovflPageSize = pBt->usableSize - 4;
   nOvfl = (info.nPayload - info.nLocal + ovflPageSize - 1)/ovflPageSize;
-  assert( ovflPgno==0 || nOvfl>0 );
+  assert( nOvfl>0 || 
+    (CORRUPT_DB && (info.nPayload + ovflPageSize)<ovflPageSize)
+  );
   while( nOvfl-- ){
     Pgno iNext = 0;
     MemPage *pOvfl = 0;
@@ -6005,7 +6007,7 @@ static void dropCell(MemPage *pPage, int idx, int sz, int *pRC){
   if( *pRC ) return;
 
   assert( idx>=0 && idx<pPage->nCell );
-  assert( sz==cellSize(pPage, idx) );
+  assert( CORRUPT_DB || sz==cellSize(pPage, idx) );
   assert( sqlite3PagerIswriteable(pPage->pDbPage) );
   assert( sqlite3_mutex_held(pPage->pBt->mutex) );
   data = pPage->aData;
diff --git a/test/corruptI.test b/test/corruptI.test
index f6de3c2456..2230205da8 100644
--- a/test/corruptI.test
+++ b/test/corruptI.test
@@ -184,4 +184,25 @@ do_test 5.3 {
 } {1 {database disk image is malformed}}
 
 
+#-------------------------------------------------------------------------
+# Set the payload size of a cell to just less than 2^32 bytes (not
+# possible in an uncorrupted db). Then try to delete the cell. At one
+# point this led to an integer overflow that caused an assert() to fail.
+#
+reset_db
+do_execsql_test 6.0 {
+  PRAGMA page_size = 512;
+  CREATE TABLE t1(x);
+  INSERT INTO t1 VALUES(zeroblob(300));
+  INSERT INTO t1 VALUES(zeroblob(600));
+} {}
+do_test 6.1 {
+  db close
+  hexio_write test.db 616 EAFFFFFF0202
+  sqlite3 db test.db
+  breakpoint
+  execsql { DELETE FROM t1 WHERE rowid=2 }
+} {}
+
+
 finish_test