From: drh <drh@noemail.net>
Date: Sat, 30 Mar 2019 18:39:13 +0000 (+0000)
Subject: The defragmentPage() routine detects corruption in the first-free-slot fields
X-Git-Tag: version-3.28.0~70
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=119e1ffc5eb7783dbee1553f0239c3fea587a11d;p=thirdparty%2Fsqlite.git

The defragmentPage() routine detects corruption in the first-free-slot fields
at offset 1 in the header and throws an error, rather than asserting.

FossilOrigin-Name: fb125bd338ab32b33d02fe61b76497b6d4a2a160056d6e759e15c94903e61a41
---

diff --git a/manifest b/manifest
index 5219d533a6..0c711258ab 100644
--- a/manifest
+++ b/manifest
@@ -1,5 +1,5 @@
-C Add\sthe\sblobio.c\sextension\smodule\simplementing\sreadblob()\sand\swriteblob().\nExperimental.
-D 2019-03-30T17:30:50.464
+C The\sdefragmentPage()\sroutine\sdetects\scorruption\sin\sthe\sfirst-free-slot\sfields\nat\soffset\s1\sin\sthe\sheader\sand\sthrows\san\serror,\srather\sthan\sasserting.
+D 2019-03-30T18:39:13.356
 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
 F LICENSE.md df5091916dbb40e6e9686186587125e1b2ff51f022cc334e886c19a0e9982724
@@ -458,7 +458,7 @@ F src/auth.c 0fac71038875693a937e506bceb492c5f136dd7b1249fbd4ae70b4e8da14f9df
 F src/backup.c 78d3cecfbe28230a3a9a1793e2ead609f469be43e8f486ca996006be551857ab
 F src/bitvec.c 17ea48eff8ba979f1f5b04cc484c7bb2be632f33
 F src/btmutex.c 8acc2f464ee76324bf13310df5692a262b801808984c1b79defb2503bbafadb6
-F src/btree.c bf2e05e26c26df4acc67ef09a7d43052b4a3759f81f77619bc2a9339c6a14c4c
+F src/btree.c 0de9fec35c7541df04a0a2be428f77479ffdfce2be8c518f111db0eef596920f
 F src/btree.h c11446f07ec0e9dc85af8041cb0855c52f5359c8b2a43e47e02a685282504d89
 F src/btreeInt.h 6111c15868b90669f79081039d19e7ea8674013f907710baa3c814dc3f8bfd3f
 F src/build.c 241006a97dee8a3e762a724aa549ca79171826a5b0b1d8e7ee41ffcd92bc5328
@@ -1814,7 +1814,7 @@ F vsixtest/vsixtest.tcl 6a9a6ab600c25a91a7acc6293828957a386a8a93
 F vsixtest/vsixtest.vcxproj.data 2ed517e100c66dc455b492e1a33350c1b20fbcdc
 F vsixtest/vsixtest.vcxproj.filters 37e51ffedcdb064aad6ff33b6148725226cd608e
 F vsixtest/vsixtest_TemporaryKey.pfx e5b1b036facdb453873e7084e1cae9102ccc67a0
-P 5b8c44cd39c529e8adbc51f67088409e963515b988868856120a59e6c7160210
-R 34637151831985d0fc29dd4ea445150f
+P e3fde56da46e9592143b8beeee5eba4d74b8ef67edb7bf73a85edd2e0f7a8d21
+R 7b49fc4d391f5baeb14b1d290f1abc7a
 U drh
-Z 97f8c049c6327eff8377c297f32c8976
+Z 45ce5d49f461e2922f903114cad3460d
diff --git a/manifest.uuid b/manifest.uuid
index fe43a957fd..0d252cbddd 100644
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-e3fde56da46e9592143b8beeee5eba4d74b8ef67edb7bf73a85edd2e0f7a8d21
\ No newline at end of file
+fb125bd338ab32b33d02fe61b76497b6d4a2a160056d6e759e15c94903e61a41
\ No newline at end of file
diff --git a/src/btree.c b/src/btree.c
index 651580b623..76482a2eac 100644
--- a/src/btree.c
+++ b/src/btree.c
@@ -1432,11 +1432,7 @@ static int defragmentPage(MemPage *pPage, int nMaxFrag){
   ** reconstruct the entire page.  */
   if( (int)data[hdr+7]<=nMaxFrag ){
     int iFree = get2byte(&data[hdr+1]);
-
-    /* If the initial freeblock offset were out of bounds, that would have
-    ** been detected by btreeComputeFreeSpace() when it was computing the
-    ** number of free bytes on the page. */
-    assert( iFree<=usableSize-4 );
+    if( iFree>usableSize-4 ) return SQLITE_CORRUPT_PAGE(pPage);
     if( iFree ){
       int iFree2 = get2byte(&data[iFree]);
       if( iFree2>usableSize-4 ) return SQLITE_CORRUPT_PAGE(pPage);