From: dan <Dan Kennedy>
Date: Sat, 10 Apr 2021 20:27:06 +0000 (+0000)
Subject: Avoid an uninitialized-memory valgrind error by tightening up corruption
X-Git-Tag: version-3.36.0~221
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=7f65b7af4286dc98e534526f2b2f121d84c87880;p=thirdparty%2Fsqlite.git

Avoid an uninitialized-memory valgrind error by tightening up corruption
detection in internal routine defragmentPage().

FossilOrigin-Name: 8096f7aee497f852b1404e13cdc8bafb54fcf6c540cd58addbc01eb2e27011b3
---

diff --git a/manifest b/manifest
index 311e666df8..cef8d55e51 100644
--- a/manifest
+++ b/manifest
@@ -1,5 +1,5 @@
-C Add\sNEVER()\sto\sa\sbranch\sthat\sbecame\sunreachable\swith\s\ncheck-in\s[58f36af2271517ab].
-D 2021-04-10T20:21:28.690
+C Avoid\san\suninitialized-memory\svalgrind\serror\sby\stightening\sup\scorruption\ndetection\sin\sinternal\sroutine\sdefragmentPage().
+D 2021-04-10T20:27:06.824
 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
 F LICENSE.md df5091916dbb40e6e9686186587125e1b2ff51f022cc334e886c19a0e9982724
@@ -483,7 +483,7 @@ F src/auth.c 08954fdc4cc2da5264ba5b75cfd90b67a6fc7d1710a02ccf917c38eadec77853
 F src/backup.c 3014889fa06e20e6adfa0d07b60097eec1f6e5b06671625f476a714d2356513d
 F src/bitvec.c 17ea48eff8ba979f1f5b04cc484c7bb2be632f33
 F src/btmutex.c 8acc2f464ee76324bf13310df5692a262b801808984c1b79defb2503bbafadb6
-F src/btree.c 247c9874a9f670a8138e7e53ef25310cdc807b45eecf57f9ef0dc31357a789be
+F src/btree.c 15cfe91aa3b3b91d3dc20faaa7c64b627ca9794b22be8b184054cb6b947505fc
 F src/btree.h 096cc53baa58be22b02c896d1cf933c38cfc6d65f9253c1367ece8cc88a24de5
 F src/btreeInt.h 7bc15a24a02662409ebcd6aeaa1065522d14b7fda71573a2b0568b458f514ae0
 F src/build.c 3a63a0dd142e238247fba0c20d6321ef1a8917de7814657ad279a02d2ff6da78
@@ -1912,7 +1912,7 @@ F vsixtest/vsixtest.tcl 6a9a6ab600c25a91a7acc6293828957a386a8a93
 F vsixtest/vsixtest.vcxproj.data 2ed517e100c66dc455b492e1a33350c1b20fbcdc
 F vsixtest/vsixtest.vcxproj.filters 37e51ffedcdb064aad6ff33b6148725226cd608e
 F vsixtest/vsixtest_TemporaryKey.pfx e5b1b036facdb453873e7084e1cae9102ccc67a0
-P 780412f2ca7576ce90861b2bd499f953504125b200e9aeae685def4a943f9d2b
-R 2c2537e0d5fdc23230401c16f4536a4d
-U drh
-Z d56a50ed8fb3b4a9111d6668c3b3a16b
+P e07ce463967521ab53463b21f80c8f90c337c15c250f69c3fccc1305f54f32df
+R f3598e3b12790e9208f3d6558500e3fc
+U dan
+Z b89110cdb23de9346119b55fe11df48d
diff --git a/manifest.uuid b/manifest.uuid
index 16e7091a01..5552b0e6c0 100644
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-e07ce463967521ab53463b21f80c8f90c337c15c250f69c3fccc1305f54f32df
\ No newline at end of file
+8096f7aee497f852b1404e13cdc8bafb54fcf6c540cd58addbc01eb2e27011b3
\ No newline at end of file
diff --git a/src/btree.c b/src/btree.c
index 00b180c257..7f841145f3 100644
--- a/src/btree.c
+++ b/src/btree.c
@@ -1448,6 +1448,7 @@ static int defragmentPage(MemPage *pPage, int nMaxFrag){
   unsigned char *src;        /* Source of content */
   int iCellFirst;            /* First allowable cell index */
   int iCellLast;             /* Last possible cell index */
+  int iCellStart;            /* First cell offset in input */
 
   assert( sqlite3PagerIswriteable(pPage->pDbPage) );
   assert( pPage->pBt!=0 );
@@ -1508,6 +1509,7 @@ static int defragmentPage(MemPage *pPage, int nMaxFrag){
 
   cbrk = usableSize;
   iCellLast = usableSize - 4;
+  iCellStart = get2byte(&data[hdr+5]);
   for(i=0; i<nCell; i++){
     u8 *pAddr;     /* The i-th cell pointer */
     pAddr = &data[cellOffset + i*2];
@@ -1517,25 +1519,23 @@ static int defragmentPage(MemPage *pPage, int nMaxFrag){
     /* These conditions have already been verified in btreeInitPage()
     ** if PRAGMA cell_size_check=ON.
     */
-    if( pc<iCellFirst || pc>iCellLast ){
+    if( pc<iCellStart || pc>iCellLast ){
       return SQLITE_CORRUPT_PAGE(pPage);
     }
-    assert( pc>=iCellFirst && pc<=iCellLast );
+    assert( pc>=iCellStart && pc<=iCellLast );
     size = pPage->xCellSize(pPage, &src[pc]);
     cbrk -= size;
-    if( cbrk<iCellFirst || pc+size>usableSize ){
+    if( cbrk<iCellStart || pc+size>usableSize ){
       return SQLITE_CORRUPT_PAGE(pPage);
     }
-    assert( cbrk+size<=usableSize && cbrk>=iCellFirst );
+    assert( cbrk+size<=usableSize && cbrk>=iCellStart );
     testcase( cbrk+size==usableSize );
     testcase( pc+size==usableSize );
     put2byte(pAddr, cbrk);
     if( temp==0 ){
-      int x;
       if( cbrk==pc ) continue;
       temp = sqlite3PagerTempSpace(pPage->pBt->pPager);
-      x = get2byte(&data[hdr+5]);
-      memcpy(&temp[x], &data[x], (cbrk+size) - x);
+      memcpy(&temp[iCellStart], &data[iCellStart], (cbrk+size) - iCellStart);
       src = temp;
     }
     memcpy(&data[cbrk], &src[pc], size);