Fix a segfault that can occur when attempting to insert into

a corrupt database file.  Need a test case. (CVS 6212)

FossilOrigin-Name: 68957cf0c4bae0c6cf450b4de1d6bc1bc64b232c

diff --git a/manifest b/manifest
index 2cbe89af300c6bc798f06b0caca94be4e760d9de..3448334f12703c7e57fadb9f7e4fa1a5547661be 100644 (file)
--- a/manifest
+++ b/manifest
@@ -1,5 +1,5 @@
-C regenerate\sautotools\s(CVS\s6211)
-D 2009-01-28T04:46:29
+C Fix\sa\ssegfault\sthat\scan\soccur\swhen\sattempting\sto\sinsert\sinto\na\scorrupt\sdatabase\sfile.\s\sNeed\sa\stest\scase.\s(CVS\s6212)
+D 2009-01-28T20:21:17
 F Makefile.arm-wince-mingw32ce-gcc fcd5e9cd67fe88836360bb4f9ef4cb7f8e2fb5a0
 F Makefile.in 3871d308188cefcb7c5ab20da4c7b6aad023bc52
 F Makefile.linux-gcc d53183f4aa6a9192d249731c90dbdffbd2c68654
@@ -103,7 +103,7 @@ F src/attach.c 1c35f95da3c62d19de75b44cfefd12c81c1791b3
 F src/auth.c c8b2ab5c8bad4bd90ed7c294694f48269162c627
 F src/bitvec.c 44f7059ac1f874d364b34af31b9617e52223ba75
 F src/btmutex.c 63c5cc4ad5715690767ffcb741e185d7bc35ec1a
-F src/btree.c 01b3af74d9e756901f21401ca1a3d0bb8b2b9368
+F src/btree.c 606c67b1b544d2324a9e4ab365cedaa1f828c7f4
 F src/btree.h 07359623fa24748709dd61212a32364a6adc6b56
 F src/btreeInt.h 44bcbfe387ba99a3a9f2527bd12fa1bb8bc574b3
 F src/build.c c8bf5dcef4d5889bc57eecdb8b3dba178e5e06a8
@@ -692,7 +692,7 @@ F tool/speedtest16.c c8a9c793df96db7e4933f0852abb7a03d48f2e81
 F tool/speedtest2.tcl ee2149167303ba8e95af97873c575c3e0fab58ff
 F tool/speedtest8.c 2902c46588c40b55661e471d7a86e4dd71a18224
 F tool/speedtest8inst1.c 293327bc76823f473684d589a8160bde1f52c14e
-P 3a049ca761f36d0fdb3b5b5f254c00210b373e9e
-R 766b006fdd07f8460587633c372a5356
-U vapier
-Z 32257921f8b0ce07e48f308acb642ba9
+P 813a3c96863acc9dd6ccd41e7ac9f57d635bcc0d
+R 1d921b41466ddcb216497f4cc6d6fe23
+U drh
+Z c108c05ffdcb51b987aecb70b13d99f1

diff --git a/manifest.uuid b/manifest.uuid
index 008098cb728c59a343f07817e5c37884a5ef9ae2..779ca682bb5f3b391314bfeba67eb087fa7d7cd9 100644 (file)
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-813a3c96863acc9dd6ccd41e7ac9f57d635bcc0d
\ No newline at end of file
+68957cf0c4bae0c6cf450b4de1d6bc1bc64b232c
\ No newline at end of file

diff --git a/src/btree.c b/src/btree.c
index 173e4f95c6dbf3f96d29f8596a276e11b8adcb6c..2bc33363e3a75831a701d4e29a971ca69c18c0dd 100644 (file)
--- a/src/btree.c
+++ b/src/btree.c
@@ -9,7 +9,7 @@
 **    May you share freely, never taking more than you give.
 **
 *************************************************************************
-** $Id: btree.c,v 1.561 2009/01/20 17:06:27 danielk1977 Exp $
+** $Id: btree.c,v 1.562 2009/01/28 20:21:17 drh Exp $
 **
 ** This file implements a external (disk-based) database using BTrees.
 ** See the header comment on "btreeInt.h" for additional information.
@@ -4663,7 +4663,9 @@ static int fillInCell(
     nSrc = nData;
     nData = 0;
   }else{ 
-    /* TBD:  Perhaps raise SQLITE_CORRUPT if nKey is larger than 31 bits? */
+    if( nKey>0x7fffffff || pKey==0 ){
+      return SQLITE_CORRUPT;
+    }
     nPayload += (int)nKey;
     pSrc = pKey;
     nSrc = (int)nKey;
@@ -5585,7 +5587,10 @@ static int balance_nonroot(BtCursor *pCur){
         j--;
         sqlite3BtreeParseCellPtr(pNew, apCell[j], &info);
         pCell = pTemp;
-        fillInCell(pParent, pCell, 0, info.nKey, 0, 0, 0, &sz);
+        rc = fillInCell(pParent, pCell, 0, info.nKey, 0, 0, 0, &sz);
+        if( rc!=SQLITE_OK ){
+          goto balance_cleanup;
+        }
         pTemp = 0;
       }else{
         pCell -= 4;