From: dan <Dan Kennedy>
Date: Fri, 19 Feb 2021 14:13:40 +0000 (+0000)
Subject: Fix a crash that could occur in ALTER TABLE DROP COLUMN if the sqlite_schema table... 
X-Git-Tag: version-3.35.0~81^2
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=refs%2Fheads%2Falter-table-drop-column;p=thirdparty%2Fsqlite.git

Fix a crash that could occur in ALTER TABLE DROP COLUMN if the sqlite_schema table was corrupt.

FossilOrigin-Name: 126ee1ec4f3565c0cccca98885fa3665a641ea3df251511de16eed2a1c396124
---

diff --git a/manifest b/manifest
index fefd385742..ef19b71a40 100644
--- a/manifest
+++ b/manifest
@@ -1,5 +1,5 @@
-C Omit\san\sbranch\smade\sunreachable\sby\sthe\simproved\serror\smessage\sfrom\sdropping\nthe\slast\scolumn\sof\sa\stable.
-D 2021-02-19T09:46:52.358
+C Fix\sa\scrash\sthat\scould\soccur\sin\sALTER\sTABLE\sDROP\sCOLUMN\sif\sthe\ssqlite_schema\stable\swas\scorrupt.
+D 2021-02-19T14:13:40.890
 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
 F LICENSE.md df5091916dbb40e6e9686186587125e1b2ff51f022cc334e886c19a0e9982724
@@ -475,7 +475,7 @@ F spec.template 86a4a43b99ebb3e75e6b9a735d5fd293a24e90ca
 F sqlite.pc.in 42b7bf0d02e08b9e77734a47798d1a55a9e0716b
 F sqlite3.1 fc7ad8990fc8409983309bb80de8c811a7506786
 F sqlite3.pc.in 48fed132e7cb71ab676105d2a4dc77127d8c1f3a
-F src/alter.c 4dc2c97b49c555e624783caaa50ae27c23be9933c64e26e4a033366ab60c30f2
+F src/alter.c 1addd06a7aae343497ebede71ec355c2011f175075943007341693ebf7daa47d
 F src/analyze.c 01c6c6765cb4d40b473b71d85535093730770bb186f2f473abac25f07fcdee5c
 F src/attach.c e80162a47411f296bea550ed8fafd730481f4aa71e89ece23ba9c957eed15d4a
 F src/auth.c 08954fdc4cc2da5264ba5b75cfd90b67a6fc7d1710a02ccf917c38eadec77853
@@ -647,6 +647,7 @@ F test/alter4.test dfd6086faf461b27ca2d2999848dcd207edf23352fc1592d0005c0844f3f0
 F test/alterauth.test 63442ba61ceb0c1eeb63aac1f4f5cebfa509d352276059d27106ae256bafc959
 F test/alterauth2.test 794ac5cef251819fe364b4fe20f12f86e9c5d68070513c7fd26c17cb244c89af
 F test/altercol.test 1d6a6fe698b81e626baea4881f5717f9bc53d7d07f1cd23ee7ad1b931f117ddf
+F test/altercorrupt.test cb17a81f655a0d71bc1e48e44741a5e0905a3b3efbbe485b0b6c7648f2af3eed
 F test/alterdropcol.test baad37ff9b07078ea02dcc33dbfb82bde655f3eee5c453e218f69501c36f02ba
 F test/alterlegacy.test f38c6d06cda39e1f7b955bbce57f2e3ef5b7cb566d3d1234502093e228c15811
 F test/altermalloc.test 167a47de41b5c638f5f5c6efb59784002b196fff70f98d9b4ed3cd74a3fb80c9
@@ -1902,7 +1903,7 @@ F vsixtest/vsixtest.tcl 6a9a6ab600c25a91a7acc6293828957a386a8a93
 F vsixtest/vsixtest.vcxproj.data 2ed517e100c66dc455b492e1a33350c1b20fbcdc
 F vsixtest/vsixtest.vcxproj.filters 37e51ffedcdb064aad6ff33b6148725226cd608e
 F vsixtest/vsixtest_TemporaryKey.pfx e5b1b036facdb453873e7084e1cae9102ccc67a0
-P a22f87fb6c43dd6217691c8dd1cdcd7880068024fb779ca8a5def068d72c3e6b
-R 8fe145aa3933b8b7851e138e048197cd
-U drh
-Z 50b646c8c422b4be2f6044aaaf70a38b
+P c5719fc5aa04c50bb01533f1cedb73dc80c4bf5315ff6a7206c8a10504afca8b
+R a9f6b9c36a39e6908ea00fd7298f0619
+U dan
+Z 77e2ec90698c4f83ecd6e0d769d5b14d
diff --git a/manifest.uuid b/manifest.uuid
index 708f49a650..d35260df63 100644
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-c5719fc5aa04c50bb01533f1cedb73dc80c4bf5315ff6a7206c8a10504afca8b
\ No newline at end of file
+126ee1ec4f3565c0cccca98885fa3665a641ea3df251511de16eed2a1c396124
\ No newline at end of file
diff --git a/src/alter.c b/src/alter.c
index f93e0ecb7e..e2af2beb8b 100644
--- a/src/alter.c
+++ b/src/alter.c
@@ -1808,6 +1808,11 @@ static void dropColumnFunc(
   rc = renameParseSql(&sParse, zDb, db, zSql, iSchema==1);
   if( rc!=SQLITE_OK ) goto drop_column_done;
   pTab = sParse.pNewTable;
+  if( iCol>=pTab->nCol ){ 
+    /* This can happen if the sqlite_schema table is corrupt */
+    rc = SQLITE_CORRUPT_BKPT;
+    goto drop_column_done;
+  }
 
   pCol = renameTokenFind(&sParse, 0, (void*)pTab->aCol[iCol].zName);
   if( iCol<pTab->nCol-1 ){
@@ -1828,6 +1833,9 @@ drop_column_done:
 #ifndef SQLITE_OMIT_AUTHORIZATION
   db->xAuth = xAuth;
 #endif
+  if( rc!=SQLITE_OK ){
+    sqlite3_result_error_code(context, rc);
+  }
 }
 
 /*
diff --git a/test/altercorrupt.test b/test/altercorrupt.test
new file mode 100644
index 0000000000..84a67e281c
--- /dev/null
+++ b/test/altercorrupt.test
@@ -0,0 +1,100 @@
+# 2019-01-11
+#
+# The author disclaims copyright to this source code.  In place of
+# a legal notice, here is a blessing:
+#
+#    May you do good and not evil.
+#    May you find forgiveness for yourself and forgive others.
+#    May you share freely, never taking more than you give.
+#
+#***********************************************************************
+#
+
+set testdir [file dirname $argv0]
+source $testdir/tester.tcl
+set testprefix altercorrupt
+
+database_may_be_corrupt
+
+#--------------------------------------------------------------------------
+reset_db
+do_test 1.0 {
+  sqlite3 db {}
+  db deserialize [decode_hexdb {
+.open --hexdb
+| size 24576 pagesize 4096 filename crash-685346d89b5e5f.db
+| page 1 offset 0
+|      0: 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00   SQLite format 3.
+|     16: 10 00 01 01 00 40 20 20 00 00 00 00 00 00 00 06   .....@  ........
+|     32: 00 00 63 00 00 05 f0 00 00 00 00 04 10 00 00 04   ..c.............
+|     48: 00 00 00 00 00 00 0f f0 00 00 00 01 00 00 00 00   ................
+|     64: 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
+|     96: 00 00 00 00 0d 0f f8 00 05 0e cf 00 0f 79 0f d3   .............y..
+|    112: 0f 2e 0e f3 0e cf 00 00 00 00 00 00 00 00 00 00   ................
+|   3776: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 22   ................
+|   3792: 05 06 17 11 11 01 31 74 61 62 6c 65 74 34 74 34   ......1tablet4t4
+|   3808: 06 43 52 45 41 54 45 20 54 41 42 4c 45 20 74 34   .CREATE TABLE t4
+|   3824: 28 7a 29 39 04 06 17 11 11 01 5f 74 61 62 6c 65   (z)9......_table
+|   3840: 74 33 74 33 05 43 52 45 41 54 45 20 54 41 42 4c   t3t3.CREATE TABL
+|   3856: 45 20 74 33 28 78 20 49 4e 54 45 47 45 52 20 50   E t3(x INTEGER P
+|   3872: 52 49 4d 41 52 59 20 4b 45 59 2c 20 79 29 49 03   RIMARY KEY, y)I.
+|   3888: 06 17 11 11 01 7f 74 61 62 6c 65 74 32 74 32 04   ......tablet2t2.
+|   3904: 43 52 45 41 54 45 20 54 41 42 4c 45 20 74 32 28   CREATE TABLE t2(
+|   3920: 61 2c 62 2c 63 20 50 52 49 4d 41 52 59 20 4b 45   a,b,c PRIMARY KE
+|   3936: 59 2c 20 64 2c 20 65 2c 20 66 29 20 57 49 54 48   Y, d, e, f) WITH
+|   3952: 4f 55 54 20 52 4f 57 49 44 58 03 07 17 11 11 01   OUT ROWIDX......
+|   3968: 81 1b 74 61 62 6c 65 74 31 74 31 02 43 52 45 41   ..tablet1t1.CREA
+|   3984: 54 45 20 54 41 42 4c 45 20 74 31 28 61 2c 62 2c   TE TABLE t1(a,b,
+|   4000: 63 20 41 53 20 28 2d 62 29 20 56 49 52 54 55 41   c AS (-b) VIRTUA
+|   4016: 4c 2c 64 20 43 48 45 43 4b 28 64 3e 35 29 2c 65   L,d CHECK(d>5),e
+|   4032: 20 55 4e 49 51 55 45 2c 20 66 20 41 53 20 28 2b    UNIQUE, f AS (+
+|   4048: 62 29 29 23 02 06 17 37 11 01 00 69 6e 64 65 78   b))#...7...index
+|   4064: 73 71 6c 69 74 65 5f 61 75 74 6f 69 6e 64 65 78   sqlite_autoindex
+|   4080: 5f 74 31 5f 31 74 31 03 00 00 00 08 00 00 00 00   _t1_1t1.........
+| page 2 offset 4096
+|      0: 0d 00 00 00 0a 0f 93 00 0f f6 0f eb 0f e0 0f d5   ................
+|     16: 0f ca 0f 8f 0f b4 0f a9 0f 9e 0f 93 00 00 00 00   ................
+|   3984: 00 00 00 09 0a 05 01 01 01 01 0a 64 6e 14 09 09   ...........dn...
+|   4000: 05 01 01 01 01 09 5a 6d 12 09 08 05 01 01 01 01   ......Zm........
+|   4016: 08 50 6c 10 09 07 05 01 01 01 01 07 46 6b 0e 09   .Pl.........Fk..
+|   4032: 06 05 01 01 01 01 06 3c 6a 0c 09 05 05 01 01 01   .......<j.......
+|   4048: 01 05 32 69 0a 09 04 05 01 01 01 01 04 28 68 08   ..2i.........(h.
+|   4064: 09 03 05 01 01 01 01 03 1e 67 06 09 02 05 01 01   .........g......
+|   4080: 01 01 02 14 66 04 08 01 05 09 01 01 01 0a 65 02   ....f.........e.
+| page 3 offset 8192
+|      0: 0a 00 00 00 0a 0f c5 00 0f fb 0f f5 0f ef 0f e9   ................
+|     16: 0f e3 0f dd 0f d7 0f d1 0f cb 0f c5 00 00 00 00   ................
+|   4032: 00 00 00 00 00 05 03 01 01 14 0a 05 03 01 01 12   ................
+|   4048: 09 05 03 01 01 10 08 05 03 01 01 0e 07 05 03 01   ................
+|   4064: 01 0c 06 05 03 01 01 0a 05 05 03 01 01 08 04 05   ................
+|   4080: 03 01 01 06 03 05 03 01 01 04 02 04 03 01 09 02   ................
+| page 4 offset 12288
+|      0: 0a 00 00 00 0a 0f 75 00 0f 75 0f 83 0f 91 0f 9f   ......u..u......
+|     16: 0f ad 0f bb 0f 00 00 00 00 00 00 00 00 00 00 00   ................
+|   3952: 00 00 00 00 00 0d 07 01 01 01 01 01 01 9c 0a 64   ...............d
+|   3968: 6e 14 64 0d 07 02 01 01 01 01 01 a6 09 5a 6d 12   n.d..........Zm.
+|   3984: 5a 0d 07 01 01 01 01 01 01 b0 08 50 6c 10 50 0d   Z..........Pl.P.
+|   4000: 07 01 01 01 01 01 01 ba 07 46 6b 0e 46 0d 07 01   .........Fk.F...
+|   4016: 01 01 01 01 01 c4 06 3c 6a 0c 3c 0d 07 01 01 01   .......<j.<.....
+|   4032: 01 01 01 ce 05 32 69 0a 32 0d 07 01 01 01 01 01   .....2i.2.......
+|   4048: 01 d8 04 28 68 08 28 0d 07 01 01 01 01 01 01 e2   ...(h.(.........
+|   4064: 03 1e 67 06 1e 0d 07 01 01 01 01 01 01 ec 02 14   ..g.............
+|   4080: 66 04 14 0c 07 01 09 01 01 01 01 f6 0a 65 02 0a   f............e..
+| page 5 offset 16384
+|      0: 0d 00 00 00 03 0f e9 00 0f e9 0f fb 0f f6 00 00   ................
+|     16: 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
+|   4064: 00 00 00 00 00 00 00 00 00 03 ff ff ff ff ff ff   ................
+|   4080: ff ff 9c 03 00 00 03 64 03 00 00 03 01 03 00 00   .......d........
+| page 6 offset 20480
+|      0: 0d 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00   ................
+| end crash-685346d89b5e5f.db
+}]} {}
+
+do_execsql_test 1.1 {
+  ALTER TABLE t2 DROP COLUMN e;
+}
+do_catchsql_test 1.2 {
+  ALTER TABLE t1 DROP COLUMN f;
+} {1 {database disk image is malformed}}
+
+finish_test