From: dan <Dan Kennedy>
Date: Wed, 30 Jun 2021 12:11:19 +0000 (+0000)
Subject: Fix an assert() in fts5 that might fail when dealing with corrupt records.
X-Git-Tag: version-3.37.0~372
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=c629e2178619068b14bb603428ba14a49439b91a;p=thirdparty%2Fsqlite.git

Fix an assert() in fts5 that might fail when dealing with corrupt records.

FossilOrigin-Name: 9e760e256089c0ebbf816a8de8b186f62e1ffcd6b8b0e76dab8387798cd4d0e1
---

diff --git a/ext/fts5/fts5_buffer.c b/ext/fts5/fts5_buffer.c
index a8f3bee334..886c58957f 100644
--- a/ext/fts5/fts5_buffer.c
+++ b/ext/fts5/fts5_buffer.c
@@ -176,7 +176,7 @@ int sqlite3Fts5PoslistNext64(
     return 1;  
   }else{
     i64 iOff = *piOff;
-    int iVal;
+    u32 iVal;
     fts5FastGetVarint32(a, i, iVal);
     assert( iVal>=0 );
     if( iVal<=1 ){
@@ -186,6 +186,7 @@ int sqlite3Fts5PoslistNext64(
       }
       fts5FastGetVarint32(a, i, iVal);
       iOff = ((i64)iVal) << 32;
+      assert( iOff>=0 );
       fts5FastGetVarint32(a, i, iVal);
       if( iVal<2 ){
         /* This is a corrupt record. So stop parsing it here. */
@@ -197,7 +198,7 @@ int sqlite3Fts5PoslistNext64(
       *piOff = (iOff & (i64)0x7FFFFFFF<<32)+((iOff + (iVal-2)) & 0x7FFFFFFF);
     }
     *pi = i;
-    assert( *piOff>=iOff );
+    assert_nc( *piOff>=iOff );
     return 0;
   }
 }
diff --git a/ext/fts5/test/fts5corrupt3.test b/ext/fts5/test/fts5corrupt3.test
index 5604bca76c..67adc64ff1 100644
--- a/ext/fts5/test/fts5corrupt3.test
+++ b/ext/fts5/test/fts5corrupt3.test
@@ -15135,6 +15135,24 @@ do_catchsql_test 77.1 {
   UPDATE t1 SET B =quote(zeroblob(200)) WHERE b MATCH 'threa*thrad*tlrad*the�d';
 } {1 {database disk image is malformed}}
 
+#-------------------------------------------------------------------------
+reset_db
+do_execsql_test 78.0 {
+  CREATE VIRTUAL TABLE t1 USING fts5(a,b,c);
+  DELETE FROM t1_data;
+  INSERT INTO t1_data VALUES(1,X'245a2424');
+  INSERT INTO t1_data VALUES(10,X'000000000101010001010101');
+  INSERT INTO t1_data VALUES(137438953473,X'0000032b0230300102060102060102061f0203010203010203010832303136303630390102070102070102070101340102050102050102050101350102040102040102040207303030303030301c0204010204010204010662696e6172790306010202030601020203060102020306010202030601020203060102020306010202030601020203060102020306010202030601020203060102020108636f6d70696c657201200102020201020201066462737ccccccccccccccccccccccccccccccccccccccccccccbccccccccccccccccccccccccccccccccccccccccccccccca2cccccccccc461740702030102030102030204656275670402020102020102020106656e61626c6507020201020201020201020201020201020201020201020201020201020201020201020201020201020201020201020201020201020523d6763632d352e342e30203230313630363039584e4f4341534526010500430f17434f4d50494c45523d6763632d352e342e3020323031363036303958525452494d0d000000240ee00004a810000fe80fe00fd80fd00fc80fc00fb80fb00fa80fa00f980f900f880f800f780f700f680f60945736502060102020306010202030601020203060102020306010202030601020203060102020306010202030601020203060102020306010202030601020201046f6d59741f0202010202010202010572747265651945030102030102030402696d010601020203060102020306010202030601120203060102020306010202030601020203060102020306010202030601020203060102020306010202010a7468726561647361666522020201020201020201047674616207020401020401020401407801060cb102010601010201060101020106010102010601010201060101020106010102010601010201060e0102010601010201060101020106010102010601010201060101020106010102010601010201060101020106010102010601010201060101021106010102010601010201060101020106010102010601010201060101020106010102010601010201060101020106010102010601011201060101020106010102010601010201060101020106010102041513020c124413110f47130f0c0e11100f0e100f440f1040150f');
+}
+
+do_execsql_test 78.1 {
+  CREATE VIRTUAL TABLE t3 USING fts5vocab('t1','col');
+}
+
+do_execsql_test 78.2 {
+  SELECT count(rowid) FROM t3 WHERE term>='nsocse';
+} 2
+
 sqlite3_fts5_may_be_corrupt 0
 finish_test
 
diff --git a/manifest b/manifest
index 13c4294a73..4d893f359c 100644
--- a/manifest
+++ b/manifest
@@ -1,5 +1,5 @@
-C Do\snot\senforce\sthe\sSQLITE_LIMIT_FUNCTION_ARG\slimit\sfor\sinternally\sgenerated\nSQL.\s\sThis\sprevents\sproblems\swith\sstatements\slike\sALTER\sTABLE\sif\sthe\nfunction\sargument\slimit\sis\sset\stoo\slow.\n[forum:/forumpost/17735aa21f3ddab2|Forum\spost\s17735aa21f3ddab2].
-D 2021-06-30T11:53:21.401
+C Fix\san\sassert()\sin\sfts5\sthat\smight\sfail\swhen\sdealing\swith\scorrupt\srecords.
+D 2021-06-30T12:11:19.208
 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
 F LICENSE.md df5091916dbb40e6e9686186587125e1b2ff51f022cc334e886c19a0e9982724
@@ -115,7 +115,7 @@ F ext/fts5/extract_api_docs.tcl a36e54ec777172ddd3f9a88daf593b00848368e0
 F ext/fts5/fts5.h c132a9323f22a972c4c93a8d5a3d901113a6e612faf30ca8e695788438c5ca2a
 F ext/fts5/fts5Int.h 26c74dd5776f798436fbf604a0bf0e8de263b35b5060b05c15f9085845d9fda2
 F ext/fts5/fts5_aux.c f558e1fb9f0f86a4f7489e258c162e1f947de5ff2709087fbb465fddb7092f98
-F ext/fts5/fts5_buffer.c 605f509f88c73e9ab41323cb6cf74932f936acf3f7d9c87bd0d3c599b4c90281
+F ext/fts5/fts5_buffer.c 89a51b37c4aa1c02c1ec24c18c55196c0693b29a752fedfd036938df59a1347f
 F ext/fts5/fts5_config.c 8336d0ff6db0933f63cfec8ae0ab76e68393259cbccc0b46e1f79f7fa1842ff3
 F ext/fts5/fts5_expr.c 9462249a3bb82d0e49b163500f9d2197c2e4cd95bf440a9bbfc3906b22ea1e1b
 F ext/fts5/fts5_hash.c 1aa93c9b5f461afba66701ee226297dc78402b3bdde81e90a10de5fe3df14959
@@ -160,7 +160,7 @@ F ext/fts5/test/fts5connect.test 08030168fc96fc278fa81f28654fb7e90566f33aff269c0
 F ext/fts5/test/fts5content.test 213506436fb2c87567b8e31f6d43ab30aab99354cec74ed679f22aad0cdbf283
 F ext/fts5/test/fts5corrupt.test 77ae6f41a7eba10620efb921cf7dbe218b0ef232b04519deb43581cb17a57ebe
 F ext/fts5/test/fts5corrupt2.test 7453752ba12ce91690c469a6449d412561cc604b1dec994e16ab132952e7805f
-F ext/fts5/test/fts5corrupt3.test 79467b7c69a9c45ee3260507c4648d6449323aaa3c1e05b360c9479f1aa7dcce
+F ext/fts5/test/fts5corrupt3.test 270cc68ff73fb5d7923619f23ef0655bf0409e83bab5790824bec20f0ee3e82e
 F ext/fts5/test/fts5corrupt4.test f4c08e2182a48d8b70975fd869ee5391855c06d8a0ff87b6a2529e7c5a88a1d3
 F ext/fts5/test/fts5delete.test 619295b20dbc1d840b403ee07c878f52378849c3c02e44f2ee143b3e978a0aa7
 F ext/fts5/test/fts5detail.test 31b240dbf6d44ac3507e2f8b65f29fdc12465ffd531212378c7ce1066766f54e
@@ -1919,7 +1919,7 @@ F vsixtest/vsixtest.tcl 6a9a6ab600c25a91a7acc6293828957a386a8a93
 F vsixtest/vsixtest.vcxproj.data 2ed517e100c66dc455b492e1a33350c1b20fbcdc
 F vsixtest/vsixtest.vcxproj.filters 37e51ffedcdb064aad6ff33b6148725226cd608e
 F vsixtest/vsixtest_TemporaryKey.pfx e5b1b036facdb453873e7084e1cae9102ccc67a0
-P 4b2c59acce6ff1bb6c9c04c45c80945ae23a26588718cc20635d60f7497adabb
-R 89bc87e746b6516fa7d6d328ad72bca6
-U drh
-Z 155cf10bfa58b42375927d36c55cd29c
+P 763fdec5b3151eeab001c50e78f654cd9b4b4c10e81e50a663046a70e64d5339
+R 729c303f68b9dba88db1c84e664b83e4
+U dan
+Z 07f3ac8a0af0bb00b72dcdaea40211f4
diff --git a/manifest.uuid b/manifest.uuid
index d791ecf6db..baf1899300 100644
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-763fdec5b3151eeab001c50e78f654cd9b4b4c10e81e50a663046a70e64d5339
\ No newline at end of file
+9e760e256089c0ebbf816a8de8b186f62e1ffcd6b8b0e76dab8387798cd4d0e1
\ No newline at end of file