Fix a problem in SQLITE_DIRECT_OVERFLOW_READ builds that could allow a concurrent...

FossilOrigin-Name: 11015b4ed161263ae14bcd0fe6a24074a545bb6d2a0b3f6f1f75ba3eaa91bfc0

diff --git a/manifest b/manifest
index 4c6c3bfb01f97320994621b1a87386f0be897ff0..a4ed2d43c4eea8bae12bbc00eb9487320dc3d8bf 100644 (file)
--- a/manifest
+++ b/manifest
@@ -1,5 +1,5 @@
-C Improve\sthe\slog\smessage\semitted\swhen\sa\sBEGIN\sCONCURRENT\stransaction\scannot\sbe\scommitted\sdue\sto\sconflicts\sso\sthat\sit\sidentifies\sthe\sconflicting\stable\sin\sa\sfew\smore\scases.
-D 2024-03-29T18:04:56.855
+C Fix\sa\sproblem\sin\sSQLITE_DIRECT_OVERFLOW_READ\sbuilds\sthat\scould\sallow\sa\sconcurrent\stransaction\sto\sbe\scommitted\seven\sif\sit\sread\sfrom\san\soverflow\spage\sthat\swas\smodified\sconcurrently,\sin\scases\swhere\sthe\soverflow\spage\swas\swritten\swithout\salso\swriting\sthe\sb-tree\spage\sto\swhich\sit\sis\slinked.
+D 2024-03-29T18:07:41.196
 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
 F LICENSE.md df5091916dbb40e6e9686186587125e1b2ff51f022cc334e886c19a0e9982724
@@ -697,7 +697,7 @@ F src/auth.c 19b7ccacae3dfba23fc6f1d0af68134fa216e9040e53b0681b4715445ea030b4
 F src/backup.c 5c97e8023aab1ce14a42387eb3ae00ba5a0644569e3476f38661fa6f824c3523
 F src/bitvec.c 501daeef838fa82a9fb53540d72f29e3d9172c8867f1e19f94f681e2e20b966e
 F src/btmutex.c 79a43670447eacc651519a429f6ece9fd638563cf95b469d6891185ddae2b522
-F src/btree.c 8a9fbb7474f32a23f01ddd1475b8f376544e188049b212bb8d01d7bcdd04a6b2
+F src/btree.c 7eaa4a4d74faeae5ae0f7de2e2773c2ac5a3b97c1e6f5482a60a159b6d435da1
 F src/btree.h bdeeb35614caa33526b603138f04c8d07a3f90a1300b5ade76848b755edf2027
 F src/btreeInt.h bb28bf05e6206befd5f5fd2ed3825fc6382979fa4a83bf50f1875a0d3404111b
 F src/build.c 8574feab7d44c245100232fe5d5b60150e88d21ce5959a388f44d4d08426d596
@@ -745,8 +745,8 @@ F src/os_setup.h 6011ad7af5db4e05155f385eb3a9b4470688de6f65d6166b8956e58a3d87210
 F src/os_unix.c 400bd61bef6405ff75475690ecb40cf6bb6d8ffb0ec454329fe77d6c84f42a9f
 F src/os_win.c 6ff43bac175bd9ed79e7c0f96840b139f2f51d01689a638fd05128becf94908a
 F src/os_win.h 7b073010f1451abe501be30d12f6bc599824944a
-F src/pager.c 76a1c3cc5fe198c38c6d15d7bda1e864642eb0131c53c2f2a94f0bcff50930a5
-F src/pager.h a195b4396e0f374922d7162ceb66f6d48a6583242b7200fa999ab52fed6341ca
+F src/pager.c dc75e2a5d5c916cc58d5a280d6fdafc4ba645034a7c27c9f5691a1c07a3aa199
+F src/pager.h dd6ade22dd303a8ca6c34f1ff0f299add7191c1bff65f0289b7fd7c3460f9551
 F src/parse.y 08247e876d6508e7bcf624d48f4993f4051899e1e73400fe7da9de34af755a90
 F src/pcache.c 040b165f30622a21b7a9a77c6f2e4877a32fb7f22d4c7f0d2a6fa6833a156a75
 F src/pcache.h 1497ce1b823cf00094bb0cf3bac37b345937e6f910890c626b16512316d3abf5
@@ -1011,7 +1011,7 @@ F test/concurrent.test fb624ddac9b008f347685911f90b6b5a022fd0a3f884c0ffef8056bc4
 F test/concurrent2.test 847cd11edc82229a95e1eaf88b55c974430b0f669cefd67a453d274e3480981c
 F test/concurrent3.test 82923fc2ea7321144b4448f98ea38aa316ddceef9020a392c5f6dea536506434
 F test/concurrent4.test e0b12cd467137e50259df3b4f837507e82aaa07c35941c88664dc8ed1d089c44
-F test/concurrent5.test f2064650d8a1558199fbca19ebd1f0fda5115109ab981b8fe3827ff56c76efa7
+F test/concurrent5.test aeb438ead1b9bb5204fa1066e8aed0bb27e5a08e4fa9b0ad42932f96eb0f97eb
 F test/concurrent6.test a7860e9ca13bb5fb76bcf41c5524fbfa9c37e6e258ecf84ffb5748a272488c67
 F test/concurrent7.test b96fa5c4cfdf8d5c0bc66b6934214500bad0260884a736f054ccc76e81aae85d
 F test/concurrent8.test b93937e74a8efb8b84f2fea7595b53418c5f29777bbe9cbdb5dc219b3dd72a7d
@@ -2220,9 +2220,9 @@ F vsixtest/vsixtest.tcl 6a9a6ab600c25a91a7acc6293828957a386a8a93
 F vsixtest/vsixtest.vcxproj.data 2ed517e100c66dc455b492e1a33350c1b20fbcdc
 F vsixtest/vsixtest.vcxproj.filters 37e51ffedcdb064aad6ff33b6148725226cd608e
 F vsixtest/vsixtest_TemporaryKey.pfx e5b1b036facdb453873e7084e1cae9102ccc67a0
-P 33d3453f467791eecc81dd682890eaadbbb2afc105ef70e22a815f82ead2c350
-Q +5d30e362cf72da3e17663dcb4299047ebe797ab6054fb14b2150ba82c2e698e1
-R 16f01b3a77791bd9d35e7bdb137c6f9d
+P 19ff2d4e1e7c6d29773d76ba752338c1c2e9ab355cdd45aed1d936880fa1c917
+Q +49263c9136c81638833aa71c9d590e318ead2ca60c4d7207ebf8884174df9c8f
+R 917aec6b3a199fcb35c3b5297d51faf1
 U dan
-Z ab68803579257300aec327bfc0466023
+Z 2d6ffda77a836c2f76cf18db98912e02
 # Remove this line to create a well-formed Fossil manifest.

diff --git a/manifest.uuid b/manifest.uuid
index 6be023044df63bfee996200253ea66847261b0b6..7cb0bbdf19049bd7ebdf0a0af72b5f4913b7505e 100644 (file)
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-19ff2d4e1e7c6d29773d76ba752338c1c2e9ab355cdd45aed1d936880fa1c917
\ No newline at end of file
+11015b4ed161263ae14bcd0fe6a24074a545bb6d2a0b3f6f1f75ba3eaa91bfc0
\ No newline at end of file

diff --git a/src/btree.c b/src/btree.c
index 3d92b4a7c36684a317205ec7e6deb4e509b81bdc..7bd3a20cf95bd7d66c9b89fc8c336cb480f85696 100644 (file)
--- a/src/btree.c
+++ b/src/btree.c
@@ -5687,6 +5687,8 @@ static int accessPayload(
           u8 *aWrite = &pBuf[-4];
           assert( aWrite>=pBufStart );                         /* due to (6) */
           memcpy(aSave, aWrite, 4);
+          rc = sqlite3PagerUsePage(pBt->pPager, nextPage);
+          if( rc!=SQLITE_OK ) break;
           rc = sqlite3OsRead(fd, aWrite, a+4, (i64)pBt->pageSize*(nextPage-1));
           nextPage = get4byte(aWrite);
           memcpy(aWrite, aSave, 4);

diff --git a/src/pager.c b/src/pager.c
index 951b42c1a222c1659a84ae4e6908bdc1f184f401..9a6d6de909b1e9d93d0fe1913ea932d375061898 100644 (file)
--- a/src/pager.c
+++ b/src/pager.c
@@ -5518,6 +5518,23 @@ static void pagerUnlockIfUnused(Pager *pPager){
   }
 }
 
+#ifndef SQLITE_OMIT_CONCURRENT
+/*
+** If this pager is currently in a concurrent transaction (pAllRead!=0),
+** then set the bit in the pAllRead vector to indicate that the transaction
+** read from page pgno. Return SQLITE_OK if successful, or an SQLite error
+** code (i.e. SQLITE_NOMEM) if an error occurs.
+*/
+int sqlite3PagerUsePage(Pager *pPager, Pgno pgno){
+  int rc = SQLITE_OK;
+  if( pPager->pAllRead && pgno<=pPager->dbOrigSize ){
+    PAGERTRACE(("USING page %d\n", pgno));
+    rc = sqlite3BitvecSet(pPager->pAllRead, pgno);
+  }
+  return rc;
+}
+#endif
+
 /*
 ** The page getter methods each try to acquire a reference to a
 ** page with page number pgno. If the requested reference is
@@ -5591,17 +5608,13 @@ static int getPageNormal(
   assert( assert_pager_state(pPager) );
   assert( pPager->hasHeldSharedLock==1 );
 
-#ifndef SQLITE_OMIT_CONCURRENT
   /* If this is an CONCURRENT transaction and the page being read was
   ** present in the database file when the transaction was opened,
   ** mark it as read in the pAllRead vector.  */
-  pPg = 0;
-  if( pPager->pAllRead && pgno<=pPager->dbOrigSize ){
-    PAGERTRACE(("USING page %d\n", pgno));
-    rc = sqlite3BitvecSet(pPager->pAllRead, pgno);
-    if( rc!=SQLITE_OK ) goto pager_acquire_err;
+  if( sqlite3PagerUsePage(pPager, pgno)!=SQLITE_OK ){
+    pPg = 0;
+    goto pager_acquire_err;
   }
-#endif
 
   if( pgno==0 ) return SQLITE_CORRUPT_BKPT;
   pBase = sqlite3PcacheFetch(pPager->pPCache, pgno, 3);

diff --git a/src/pager.h b/src/pager.h
index 81701248b3c231dff104bed31704866a912d9ecb..5828c37f86ae0d4d048277cefe93961a8745eaf9 100644 (file)
--- a/src/pager.h
+++ b/src/pager.h
@@ -244,6 +244,7 @@ void sqlite3PagerTruncateImage(Pager*,Pgno);
 void sqlite3PagerRekey(DbPage*, Pgno, u16);
 
 #ifndef SQLITE_OMIT_CONCURRENT
+int sqlite3PagerUsePage(Pager*, Pgno);
 void sqlite3PagerEndConcurrent(Pager*);
 int sqlite3PagerBeginConcurrent(Pager*);
 void sqlite3PagerDropExclusiveLock(Pager*);
@@ -252,6 +253,7 @@ void sqlite3PagerSetDbsize(Pager *pPager, Pgno);
 int sqlite3PagerIsWal(Pager*);
 #else
 # define sqlite3PagerEndConcurrent(x)
+# define sqlite3PagerUsePage(x, y) SQLITE_OK
 #endif
 
 #if defined(SQLITE_DEBUG) || !defined(SQLITE_OMIT_CONCURRENT)

diff --git a/test/concurrent5.test b/test/concurrent5.test
index a7ecf9ddd0532f038a844a08df50e62f0910511f..4afd06bcaf861f339f018a67cdf8eb9eada7509b 100644 (file)
--- a/test/concurrent5.test
+++ b/test/concurrent5.test
@@ -161,8 +161,6 @@ sqlite3 db2 test.db
 set big1 [string repeat ab 10000]
 set big2 "[string repeat ab  9999]xy"
 
-catchsql { ROLLBACK }
-
 do_execsql_test 1.6.0 {
   CREATE TABLE x1(x, y);
   INSERT INTO x1 VALUES(1, $big1);
@@ -209,7 +207,36 @@ do_test_conflict_msg 1.6.1.5 {
 }
 catchsql ROLLBACK
 
+#--------------------------------------------------------------------------
+reset_db
+sqlite3 db2 test.db
+
+set big1 [string repeat ab 10000]
+set big2 "[string repeat ab  9999]xy"
+
+do_execsql_test 1.7.0 {
+  CREATE TABLE ww(a);
+  CREATE TABLE y1(x, y);
+  INSERT INTO y1 VALUES(1, $big1);
+  PRAGMA journal_mode = wal;
+} {wal}
 
+do_execsql_test -db db2 1.7.1 {
+  BEGIN;
+    UPDATE y1 SET y=$big2;
+    SELECT * FROM ww;
+}
+
+do_execsql_test 1.7.2 {
+  BEGIN CONCURRENT;
+    INSERT INTO ww SELECT y FROM y1;
+}
+
+do_execsql_test -db db2 1.7.3 COMMIT
+
+do_catchsql_test 1.7.4 {
+  COMMIT;
+} {1 {database is locked}}
 
 db close
 db2 close