From: drh Date: Wed, 19 Dec 2018 01:57:20 +0000 (+0000) Subject: Add extra defenses against strategically corrupt databases to fts3/4. X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=c1f6859e4acdc820a704eb65b4eb52f0cf952648;p=thirdparty%2Fsqlite.git Add extra defenses against strategically corrupt databases to fts3/4. FossilOrigin-Name: 882ef4e39b5a2aae3786caef492c77af67693b5123ce9c40d99c10c55dc02f98 --- diff --git a/ext/fts3/fts3.c b/ext/fts3/fts3.c index 748faefec5..383a2401b4 100644 --- a/ext/fts3/fts3.c +++ b/ext/fts3/fts3.c @@ -1784,7 +1784,7 @@ static int fts3ScanInteriorNode( const char *zCsr = zNode; /* Cursor to iterate through node */ const char *zEnd = &zCsr[nNode];/* End of interior node buffer */ char *zBuffer = 0; /* Buffer to load terms into */ - int nAlloc = 0; /* Size of allocated buffer */ + i64 nAlloc = 0; /* Size of allocated buffer */ int isFirstTerm = 1; /* True when processing first term on page */ sqlite3_int64 iChild; /* Block id of child node to descend to */ @@ -1821,14 +1821,14 @@ static int fts3ScanInteriorNode( isFirstTerm = 0; zCsr += fts3GetVarint32(zCsr, &nSuffix); - if( nPrefix<0 || nSuffix<0 || &zCsr[nSuffix]>zEnd ){ + if( nPrefix<0 || nSuffix<0 || nPrefix>zCsr-zNode || nSuffix>zEnd-zCsr ){ rc = FTS_CORRUPT_VTAB; goto finish_scan; } - if( nPrefix+nSuffix>nAlloc ){ + if( (i64)nPrefix+nSuffix>nAlloc ){ char *zNew; - nAlloc = (nPrefix+nSuffix) * 2; - zNew = (char *)sqlite3_realloc(zBuffer, nAlloc); + nAlloc = ((i64)nPrefix+nSuffix) * 2; + zNew = (char *)sqlite3_realloc64(zBuffer, nAlloc); if( !zNew ){ rc = SQLITE_NOMEM; goto finish_scan; diff --git a/ext/fts3/fts3_write.c b/ext/fts3/fts3_write.c index d5a408222e..78fbe2903c 100644 --- a/ext/fts3/fts3_write.c +++ b/ext/fts3/fts3_write.c @@ -1372,15 +1372,19 @@ static int fts3SegReaderNext( ** safe (no risk of overread) even if the node data is corrupted. */ pNext += fts3GetVarint32(pNext, &nPrefix); pNext += fts3GetVarint32(pNext, &nSuffix); - if( nPrefix<0 || nSuffix<=0 - || &pNext[nSuffix]>&pReader->aNode[pReader->nNode] + if( nSuffix<=0 + || (&pReader->aNode[pReader->nNode] - pNext)pReader->nTermAlloc ){ return FTS_CORRUPT_VTAB; } - if( nPrefix+nSuffix>pReader->nTermAlloc ){ - int nNew = (nPrefix+nSuffix)*2; - char *zNew = sqlite3_realloc(pReader->zTerm, nNew); + /* Both nPrefix and nSuffix were read by fts3GetVarint32() and so are + ** between 0 and 0x7FFFFFFF. But the sum of the two may cause integer + ** overflow - hence the (i64) casts. */ + if( (i64)nPrefix+nSuffix>(i64)pReader->nTermAlloc ){ + i64 nNew = ((i64)nPrefix+nSuffix)*2; + char *zNew = sqlite3_realloc64(pReader->zTerm, nNew); if( !zNew ){ return SQLITE_NOMEM; } @@ -1402,7 +1406,7 @@ static int fts3SegReaderNext( ** b-tree node. And that the final byte of the doclist is 0x00. If either ** of these statements is untrue, then the data structure is corrupt. */ - if( &pReader->aDoclist[pReader->nDoclist]>&pReader->aNode[pReader->nNode] + if( (&pReader->aNode[pReader->nNode] - pReader->aDoclist)nDoclist || (pReader->nPopulate==0 && pReader->aDoclist[pReader->nDoclist-1]) ){ return FTS_CORRUPT_VTAB; @@ -3725,6 +3729,9 @@ static int nodeReaderNext(NodeReader *p){ } p->iOff += fts3GetVarint32(&p->aNode[p->iOff], &nSuffix); + if( nPrefix>p->iOff || nSuffix>p->nNode-p->iOff ){ + return SQLITE_CORRUPT_VTAB; + } blobGrowBuffer(&p->term, nPrefix+nSuffix, &rc); if( rc==SQLITE_OK ){ memcpy(&p->term.a[nPrefix], &p->aNode[p->iOff], nSuffix); @@ -3732,6 +3739,9 @@ static int nodeReaderNext(NodeReader *p){ p->iOff += nSuffix; if( p->iChild==0 ){ p->iOff += fts3GetVarint32(&p->aNode[p->iOff], &p->nDoclist); + if( (p->nNode-p->iOff)nDoclist ){ + return SQLITE_CORRUPT_VTAB; + } p->aDoclist = &p->aNode[p->iOff]; p->iOff += p->nDoclist; } @@ -3739,7 +3749,6 @@ static int nodeReaderNext(NodeReader *p){ } assert( p->iOff<=p->nNode ); - return rc; } diff --git a/manifest b/manifest index ce0ed76cbd..30c9be30c1 100644 --- a/manifest +++ b/manifest @@ -1,5 +1,5 @@ -C Version\s3.9.3 -D 2016-03-31T21:36:06.382 +C Add\sextra\sdefenses\sagainst\sstrategically\scorrupt\sdatabases\sto\sfts3/4. +D 2018-12-19T01:57:20.527 F Makefile.arm-wince-mingw32ce-gcc d6df77f1f48d690bd73162294bbba7f59507c72f F Makefile.in f0088ff0d2ac949fce6de7c00f13a99ac5bdb663 F Makefile.linux-gcc 91d710bdc4998cb015f39edf3cb314ec4f4d7e23 @@ -78,7 +78,7 @@ F ext/fts3/README.content fdc666a70d5257a64fee209f97cf89e0e6e32b51 F ext/fts3/README.syntax a19711dc5458c20734b8e485e75fb1981ec2427a F ext/fts3/README.tokenizers e0a8b81383ea60d0334d274fadf305ea14a8c314 F ext/fts3/README.txt 8c18f41574404623b76917b9da66fcb0ab38328d -F ext/fts3/fts3.c e028eb13432f108d2e22cded019fc980700e4e00 +F ext/fts3/fts3.c ba4d2e512a36c20e884d6107a38dc38410e0015950fc7c3fd1e811c3d88a67fa F ext/fts3/fts3.h 3a10a0af180d502cecc50df77b1b22df142817fe F ext/fts3/fts3Int.h c84125c666ee54cef6efce6ff64abb0d0e2f4535 F ext/fts3/fts3_aux.c 9edc3655fcb287f0467d0a4b886a01c6185fe9f1 @@ -96,7 +96,7 @@ F ext/fts3/fts3_tokenizer.h 64c6ef6c5272c51ebe60fc607a896e84288fcbc3 F ext/fts3/fts3_tokenizer1.c 5c98225a53705e5ee34824087478cf477bdb7004 F ext/fts3/fts3_unicode.c a93f5edc0aff44ef8b06d7cb55b52026541ca145 F ext/fts3/fts3_unicode2.c c3d01968d497bd7001e7dc774ba75b372738c057 -F ext/fts3/fts3_write.c f442223e4a1914dc1fc12b65af7e4f2c255fa47c +F ext/fts3/fts3_write.c cdead226658c3e67c12b334407dfb952de0c3c811f2980c57211fea902e45aaa F ext/fts3/fts3speed.tcl b54caf6a18d38174f1a6e84219950d85e98bb1e9 F ext/fts3/mkfts3amal.tcl 252ecb7fe6467854f2aa237bf2c390b74e71f100 F ext/fts3/tool/fts3view.c 8e53d0190a7b3443764bbd32ad47be2bd852026d @@ -696,6 +696,7 @@ F test/fts3comp1.test a0f5b16a2df44dd0b15751787130af2183167c0c F test/fts3conf.test ff90127b2462c788348c0dd7f6f8c573ef9cb5d9 F test/fts3corrupt.test 2710b77983cc7789295ddbffea52c1d3b7506dbb F test/fts3corrupt2.test 6d96efae2f8a6af3eeaf283aba437e6d0e5447ba +F test/fts3corrupt4.test 8ae933f5f63fad2a78fe268e8674aa260bb85b1f0ad1229ee5ed648922c51adb F test/fts3cov.test e0fb00d8b715ddae4a94c305992dfc3ef70353d7 F test/fts3d.test d3e9c8fb75135ada06bf3bab4f9666224965d708 F test/fts3defer.test 0be4440b73a2e651fc1e472066686d6ada4b9963 @@ -1390,10 +1391,8 @@ F tool/vdbe_profile.tcl 67746953071a9f8f2f668b73fe899074e2c6d8c1 F tool/warnings-clang.sh f6aa929dc20ef1f856af04a730772f59283631d4 F tool/warnings.sh 48bd54594752d5be3337f12c72f28d2080cb630b F tool/win/sqlite.vsix deb315d026cc8400325c5863eef847784a219a2f -P f1e6bb952e691d504713f3f923f8019585dbd4aa -R 1376316444f9f381f01a42743b3aeb55 -T +bgcolor * #d0c0ff -T +sym-release * -T +sym-version-3.9.3 * +P dfbfd34b3ff4d6da6f2db56e4664d7058f10c098 +Q +4bb21d8205b3c72b94442018a0544ecc55e3320ef2593f0e3350142b7f2a7663 +R 22e0b536e8f483d58bcb1a29460375cf U drh -Z db5be79d5450e93b9b91fdd4984d69ee +Z 4c2d78cc158ff3dc7aa21579c2a29a43 diff --git a/manifest.uuid b/manifest.uuid index 86c9f89f61..305937a525 100644 --- a/manifest.uuid +++ b/manifest.uuid @@ -1 +1 @@ -dfbfd34b3ff4d6da6f2db56e4664d7058f10c098 \ No newline at end of file +882ef4e39b5a2aae3786caef492c77af67693b5123ce9c40d99c10c55dc02f98 \ No newline at end of file diff --git a/test/fts3corrupt4.test b/test/fts3corrupt4.test new file mode 100644 index 0000000000..2188a171c5 --- /dev/null +++ b/test/fts3corrupt4.test @@ -0,0 +1,145 @@ +# 2006 September 9 +# +# The author disclaims copyright to this source code. In place of +# a legal notice, here is a blessing: +# +# May you do good and not evil. +# May you find forgiveness for yourself and forgive others. +# May you share freely, never taking more than you give. +# +#************************************************************************* +# This file implements regression tests for SQLite library. The +# focus of this script is testing the FTS3 module. +# +# $Id: fts3aa.test,v 1.1 2007/08/20 17:38:42 shess Exp $ +# + +set testdir [file dirname $argv0] +source $testdir/tester.tcl +set testprefix fts3corrupt4 + +# If SQLITE_ENABLE_FTS3 is defined, omit this file. +ifcapable !fts3 { + finish_test + return +} + +do_execsql_test 1.0 { + BEGIN; + CREATE VIRTUAL TABLE ft USING fts3; + INSERT INTO ft VALUES('aback'); + INSERT INTO ft VALUES('abaft'); + INSERT INTO ft VALUES('abandon'); + COMMIT; +} + +proc blob {a} { binary decode hex $a } +db func blob blob + +do_execsql_test 1.1 { + SELECT quote(root) FROM ft_segdir; +} {X'0005616261636B03010200030266740302020003046E646F6E03030200'} + +do_execsql_test 1.2 { + UPDATE ft_segdir SET root = blob( + '0005616261636B03010200 FFFFFFFF0702 66740302020003046E646F6E03030200' + ); +} + +do_catchsql_test 1.3 { + SELECT * FROM ft WHERE ft MATCH 'abandon'; +} {1 {database disk image is malformed}} + +#------------------------------------------------------------------------- +reset_db +do_execsql_test 2.0.0 { + CREATE VIRTUAL TABLE ft USING fts3; + INSERT INTO ft(ft) VALUES('nodesize=32'); +} +do_test 2.0.1 { + for {set i 0} {$i < 12} {incr i} { + execsql { + BEGIN; + INSERT INTO ft VALUES('abc' || $i); + INSERT INTO ft VALUES('abc' || $i || 'x' ); + INSERT INTO ft VALUES('abc' || $i || 'xx' ); + COMMIT + } + } + execsql { + SELECT count(*) FROM ft_segdir; + SELECT count(*) FROM ft_segments; + } +} {12 0} + +do_execsql_test 2.1 { + INSERT INTO ft(ft) VALUES('merge=1,4'); + SELECT count(*) FROM ft_segdir; + SELECT count(*) FROM ft_segments; +} {12 3} + +do_execsql_test 2.2 { + SELECT quote(block) FROM ft_segments WHERE blockid=2 +} {X'0005616263317803050200'} + +db func blob blob +do_execsql_test 2.3.1 { + UPDATE ft_segments SET block = + blob('00056162633130031F0200 FFFFFFFF07FF55 66740302020003046E646F6E03030200') + WHERE blockid=2; +} {} +do_catchsql_test 2.3.2 { + INSERT INTO ft(ft) VALUES('merge=1,4'); +} {1 {database disk image is malformed}} + +do_execsql_test 2.4.1 { + UPDATE ft_segments SET block = + blob('00056162633130031F0200 02FFFFFFFF07 66740302020003046E646F6E03030200') + WHERE blockid=2; +} {} +do_catchsql_test 2.4.2 { + INSERT INTO ft(ft) VALUES('merge=1,4'); +} {1 {database disk image is malformed}} + +do_execsql_test 2.5.1 { + UPDATE ft_segments SET block = + blob('00056162633130031F0200 0202 6674 FFFFFF070302020003046E646F6E030200') + WHERE blockid=2; +} {} +do_catchsql_test 2.5.2 { + INSERT INTO ft(ft) VALUES('merge=1,4'); +} {1 {database disk image is malformed}} + +#------------------------------------------------------------------------- +reset_db +do_execsql_test 3.0.0 { + CREATE VIRTUAL TABLE ft USING fts3; + INSERT INTO ft(ft) VALUES('nodesize=32'); +} +do_test 3.0.1 { + execsql BEGIN + for {set i 0} {$i < 20} {incr i} { + execsql { INSERT INTO ft VALUES('abc' || $i) } + } + execsql { + COMMIT; + SELECT count(*) FROM ft_segdir; + SELECT count(*) FROM ft_segments; + } +} {1 5} + +do_execsql_test 3.1 { + SELECT quote(root) FROM ft_segdir +} {X'0101056162633132040136030132030136'} + +db func blob blob +do_execsql_test 3.2 { + UPDATE ft_segdir + SET root = blob('0101056162633132FFFFFFFF070236030132030136'); +} + +do_catchsql_test 3.1 { + SELECT * FROM ft WHERE ft MATCH 'abc20' +} {1 {database disk image is malformed}} + +finish_test