From: drh <>
Date: Tue, 17 Mar 2026 18:55:24 +0000 (+0000)
Subject: Improved error handling in OP_IFindKey and in vdbeIsMatchingIndexKey().
X-Git-Tag: major-release~74^2~11
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=f4e6483cda92fb3485aa1c8c00de72c8cd5d3635;p=thirdparty%2Fsqlite.git

Improved error handling in OP_IFindKey and in vdbeIsMatchingIndexKey().

FossilOrigin-Name: f7389cdb129d3386b7dfb8acacf84816cf10864c6800a9bd9a61c6364b850a31
---

diff --git a/manifest b/manifest
index 0294481c90..e57570c3c9 100644
--- a/manifest
+++ b/manifest
@@ -1,5 +1,5 @@
-C When\sintegrity-check\sfinds\sa\smissing\sindex\sentry,\ssearch\sa\ssmall\srange\s(currently\s10)\sof\sentries\saround\sthe\smissing\skey\sfor\san\sentry\sthat\smatches\sall\snon-virtual\sand\snon-expression\sfields.
-D 2026-03-17T17:05:45.395
+C Improved\serror\shandling\sin\sOP_IFindKey\sand\sin\svdbeIsMatchingIndexKey().
+D 2026-03-17T18:55:24.081
 F .fossil-settings/binary-glob 61195414528fb3ea9693577e1980230d78a1f8b0a54c78cf1b9b24d0a409ed6a x
 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
@@ -799,11 +799,11 @@ F src/upsert.c 215328c3f91623c520ec8672c44323553f12caeb4f01b1090ebdca99fdf7b4f1
 F src/utf.c 7267c3fb9e2467020507601af3354c2446c61f444387e094c779dccd5ca62165
 F src/util.c 0dbd633bdc509a1c967e4b49b1555820494d936131017634d7dec96c0b8343ce
 F src/vacuum.c d3d35d8ae893d419ade5fa196d761a83bddcbb62137a1a157ae751ef38b26e82
-F src/vdbe.c 3feabce53a3cdac0ba0915ecc4018907bb094bfc8623304f215ad76c1ce2dcdb
+F src/vdbe.c e0921e7046ef9f3c472b583ff8ee9a5db593d9be3570f22d44f69cb95a717dfa
 F src/vdbe.h 70e862ac8a11b590f8c1eaac17a0078429d42bc4ea3f757a9af0f451dd966a71
 F src/vdbeInt.h 9909bdaaa2ef3d47b05d93b3e22a4211903305f1ba0afb902c7448258c6418e2
 F src/vdbeapi.c 6cdcbe5c7afa754c998e73d2d5d2805556268362914b952811bdfb9c78a37cf1
-F src/vdbeaux.c bc86f76fb2c3888b10f1157c3a5fa1a1ca5427981c621d4494757697f04308fa
+F src/vdbeaux.c 5b586e4b08c0ff2df2aa3b011afcb2382478444306940077105a10f8f816aa79
 F src/vdbeblob.c b3f0640db9642fbdc88bd6ebcc83d6009514cafc98f062f675f2c8d505d82692
 F src/vdbemem.c 317ec5e870ddb16951b606c9fe8be22baef22ecbe46f58fdefc259662238afb7
 F src/vdbesort.c b69220f4ea9ffea5fdef34d968c60305444eea909252a81933b54c296d9cca70
@@ -2194,8 +2194,8 @@ F tool/warnings-clang.sh bbf6a1e685e534c92ec2bfba5b1745f34fb6f0bc2a362850723a9ee
 F tool/warnings.sh d924598cf2f55a4ecbc2aeb055c10bd5f48114793e7ba25f9585435da29e7e98
 F tool/win/sqlite.vsix deb315d026cc8400325c5863eef847784a219a2f
 F tool/winmain.c 00c8fb88e365c9017db14c73d3c78af62194d9644feaf60e220ab0f411f3604c
-P eb6403f02c113f58030c0b4143d91b6327ee21dcb324d3f235c2bf6bf3d6577c
-R 12804263c5e1f22ccb67d371c61b22bd
-U dan
-Z 2465f05d9225397370c730d2cd3ac6f7
+P 978cedcbd33165dadc7dffc118bde359eff6751ec9842230880cb827d9f7845f
+R 531962050de8b772498e3016aa53cb5c
+U drh
+Z 4452c0c9088d2f943b3f97617ed9fb76
 # Remove this line to create a well-formed Fossil manifest.
diff --git a/manifest.uuid b/manifest.uuid
index d3c15bbd38..40aec4c7fa 100644
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-978cedcbd33165dadc7dffc118bde359eff6751ec9842230880cb827d9f7845f
+f7389cdb129d3386b7dfb8acacf84816cf10864c6800a9bd9a61c6364b850a31
diff --git a/src/vdbe.c b/src/vdbe.c
index 3815426889..9617ef8f5a 100644
--- a/src/vdbe.c
+++ b/src/vdbe.c
@@ -7325,6 +7325,7 @@ case OP_IFindKey: {     /* jump, in3 */
   r.pKeyInfo = pC->pKeyInfo;
 
   rc = sqlite3VdbeFindIndexKey(pC->uc.pCursor, pOp->p4.pIdx, 0, &r, &res);
+  if( rc ) goto abort_due_to_error;
   if( res==0 ){
     pC->nullRow = 0;
     goto jump_to_p2;
diff --git a/src/vdbeaux.c b/src/vdbeaux.c
index 4d0b3f29c8..db7f2c75d4 100644
--- a/src/vdbeaux.c
+++ b/src/vdbeaux.c
@@ -5419,6 +5419,9 @@ static int vdbeIsMatchingIndexKey(
   mem.enc = p->pKeyInfo->enc;
   mem.db = p->pKeyInfo->db;
   nRec = sqlite3BtreePayloadSize(pCur);
+  if( nRec<=0 || nRec>0x7fffffff ){
+    return SQLITE_CORRUPT_BKPT;
+  }
   aRec = sqlite3MallocZero(nRec);
   if( aRec==0 ){
     rc = SQLITE_NOMEM_BKPT;