From: drh <drh@noemail.net>
Date: Mon, 5 Aug 2019 16:22:20 +0000 (+0000)
Subject: Improved detection of corruption on the freeblock list of a btree page.
X-Git-Tag: version-3.30.0~168
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=2b96b6969ae7f2f8dfa6a07b97fea1057dbcdab5;p=thirdparty%2Fsqlite.git

Improved detection of corruption on the freeblock list of a btree page.

FossilOrigin-Name: 4b00799bdf107fce8a9dd84fd5bf6597e4f3373659b89aae4a1242be5964726f
---

diff --git a/manifest b/manifest
index 9132476b8b..6cfdcb0c00 100644
--- a/manifest
+++ b/manifest
@@ -1,5 +1,5 @@
-C Fix\sa\sproblem\swith\srenaming\sa\stable\swhen\sa\sview\sor\strigger\swithin\sthe\sschema\suses\sa\sFILTER\swith\san\saggregate\sfunction\sthat\sis\snot\scurrently\sregistered\swith\sthe\sdatabase.
-D 2019-08-05T13:19:25.017
+C Improved\sdetection\sof\scorruption\son\sthe\sfreeblock\slist\sof\sa\sbtree\spage.
+D 2019-08-05T16:22:20.557
 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
 F LICENSE.md df5091916dbb40e6e9686186587125e1b2ff51f022cc334e886c19a0e9982724
@@ -464,7 +464,7 @@ F src/auth.c a3d5bfdba83d25abed1013a8c7a5f204e2e29b0c25242a56bc02bb0c07bf1e06
 F src/backup.c f70077d40c08b7787bfe934e4d1da8030cb0cc57d46b345fba2294b7d1be23ab
 F src/bitvec.c 17ea48eff8ba979f1f5b04cc484c7bb2be632f33
 F src/btmutex.c 8acc2f464ee76324bf13310df5692a262b801808984c1b79defb2503bbafadb6
-F src/btree.c 4f122e985d939452677e67ce777a8ac68737c96a6e47aa0a4620e574b31bed0c
+F src/btree.c 397b5075441d0bd7366e93f6f2ef908dd0610cd80c4e351f4a900b614e32ccf0
 F src/btree.h c11446f07ec0e9dc85af8041cb0855c52f5359c8b2a43e47e02a685282504d89
 F src/btreeInt.h 6111c15868b90669f79081039d19e7ea8674013f907710baa3c814dc3f8bfd3f
 F src/build.c 48f22e7c3b80550eb9c0cc3a3738f9117109b87d5f5fdba027009b7f2917df4a
@@ -1838,7 +1838,7 @@ F vsixtest/vsixtest.tcl 6a9a6ab600c25a91a7acc6293828957a386a8a93
 F vsixtest/vsixtest.vcxproj.data 2ed517e100c66dc455b492e1a33350c1b20fbcdc
 F vsixtest/vsixtest.vcxproj.filters 37e51ffedcdb064aad6ff33b6148725226cd608e
 F vsixtest/vsixtest_TemporaryKey.pfx e5b1b036facdb453873e7084e1cae9102ccc67a0
-P b6d52c9364767ff4ab7279ae981afb97799299dcfaf38a0110c40ca82c72a825
-R 28ce5921d081582c0d1ccac9c38fc5f7
-U dan
-Z 3ddbf0b6cdda36b7df15d0621b9689d7
+P 2ac0e42f8ab7a9184c2a2efd13bd50ab51bc01f9f34e9e63591fd18db02dff54
+R 25b0309e54c4a44a38baef97d33cecfa
+U drh
+Z 87c0b13ed7ac3ffed0f21199971e8372
diff --git a/manifest.uuid b/manifest.uuid
index 952349fee7..14b089b424 100644
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-2ac0e42f8ab7a9184c2a2efd13bd50ab51bc01f9f34e9e63591fd18db02dff54
\ No newline at end of file
+4b00799bdf107fce8a9dd84fd5bf6597e4f3373659b89aae4a1242be5964726f
\ No newline at end of file
diff --git a/src/btree.c b/src/btree.c
index a6b4a551b9..8ebe0ccb37 100644
--- a/src/btree.c
+++ b/src/btree.c
@@ -1647,9 +1647,12 @@ static int allocateSpace(MemPage *pPage, int nByte, int *pIdx){
   if( (data[hdr+2] || data[hdr+1]) && gap+2<=top ){
     u8 *pSpace = pageFindSlot(pPage, nByte, &rc);
     if( pSpace ){
-      assert( pSpace>=data && (pSpace - data)<65536 );
-      *pIdx = (int)(pSpace - data);
-      return SQLITE_OK;
+      assert( pSpace+nByte<=data+pPage->pBt->usableSize );
+      if( (*pIdx = (int)(pSpace-data))<=gap ){
+        return SQLITE_CORRUPT_PAGE(pPage);
+      }else{
+        return SQLITE_OK;
+      }
     }else if( rc ){
       return rc;
     }
@@ -6896,7 +6899,7 @@ static int rebuildPage(
 
   assert( i<iEnd );
   j = get2byte(&aData[hdr+5]);
-  if( j>(u32)usableSize ){ j = 0; }
+  if( NEVER(j>(u32)usableSize) ){ j = 0; }
   memcpy(&pTmp[j], &aData[j], usableSize - j);
 
   for(k=0; pCArray->ixNx[k]<=i && ALWAYS(k<NB*2); k++){}