From: drh <>
Date: Fri, 9 Jan 2026 16:01:51 +0000 (+0000)
Subject: Avoid signed integer overflow when an fts5 'merge' command is passed -2147483648... 
X-Git-Tag: release~2
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=c51f318f6a69d074d09222b62408483d8f20e60b;p=thirdparty%2Fsqlite.git

Avoid signed integer overflow when an fts5 'merge' command is passed -2147483648 as a parameter.

FossilOrigin-Name: 127b3270f8716e0eda06ea6979def88283e15aecdceb5d56c82105b300c98bdc
---

diff --git a/ext/fts5/fts5Int.h b/ext/fts5/fts5Int.h
index a13a65d3c2..d5404535cc 100644
--- a/ext/fts5/fts5Int.h
+++ b/ext/fts5/fts5Int.h
@@ -81,7 +81,13 @@ typedef sqlite3_uint64 u64;
 # define FLEXARRAY 1
 #endif
 
-#endif
+#endif /* SQLITE_AMALGAMATION */
+
+/*
+** Constants for the largest and smallest possible 32-bit signed integers.
+*/
+# define LARGEST_INT32  ((int)(0x7fffffff))
+# define SMALLEST_INT32 ((int)((-1) - LARGEST_INT32))
 
 /* Truncate very long tokens to this many bytes. Hard limit is 
 ** (65536-1-1-4-9)==65521 bytes. The limiting factor is the 16-bit offset
diff --git a/ext/fts5/fts5_index.c b/ext/fts5/fts5_index.c
index 7e25731ed5..acd0570a5d 100644
--- a/ext/fts5/fts5_index.c
+++ b/ext/fts5/fts5_index.c
@@ -5931,7 +5931,7 @@ int sqlite3Fts5IndexMerge(Fts5Index *p, int nMerge){
       fts5StructureRelease(pStruct);
       pStruct = pNew;
       nMin = 1;
-      nMerge = nMerge*-1;
+      nMerge = (nMerge==SMALLEST_INT32 ? LARGEST_INT32 : (nMerge*-1));
     }
     if( pStruct && pStruct->nLevel ){
       if( fts5IndexMerge(p, &pStruct, nMerge, nMin) ){
diff --git a/ext/fts5/test/fts5merge.test b/ext/fts5/test/fts5merge.test
index c57c21ded3..09c18245f3 100644
--- a/ext/fts5/test/fts5merge.test
+++ b/ext/fts5/test/fts5merge.test
@@ -238,6 +238,22 @@ do_execsql_test 6.3 {
   INSERT INTO g1(g1) VALUES('integrity-check');
 }
 
+#--------------------------------------------------------------------------
+# Check that passing -2147483648 as the parameter to a merge command
+# does not cause a signed integer overflow error.
+#
+reset_db
+do_execsql_test 7.0 {
+  CREATE VIRTUAL TABLE f1 USING fts5(a);
+}
+do_execsql_test 7.1 {
+  INSERT INTO f1 VALUES('one two three');
+  INSERT INTO f1 VALUES('four five six');
+  INSERT INTO f1 VALUES('seven eight nine');
+}
+do_execsql_test 7.2 {
+  INSERT INTO f1(f1, rank) VALUES('merge', -2147483648);
+}
 
 
 finish_test
diff --git a/manifest b/manifest
index af0779540e..275347261d 100644
--- a/manifest
+++ b/manifest
@@ -1,5 +1,5 @@
-C Fix\spotential\sOOB\sread\son\sthe\sundocumented\stest\sfunction\srtreenode()\sin\nthe\sRTREE\sextension.
-D 2026-01-09T00:45:41.901
+C Avoid\ssigned\sinteger\soverflow\swhen\san\sfts5\s'merge'\scommand\sis\spassed\s-2147483648\sas\sa\sparameter.
+D 2026-01-09T16:01:51.048
 F .fossil-settings/binary-glob 61195414528fb3ea9693577e1980230d78a1f8b0a54c78cf1b9b24d0a409ed6a x
 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
@@ -107,13 +107,13 @@ F ext/fts3/unicode/mkunicode.tcl cbf5f7b5c8ce8014bad731f246f2e520eece908465de477
 F ext/fts3/unicode/parseunicode.tcl a981bd6466d12dd17967515801c3ff23f74a281be1a03cf1e6f52a6959fc77eb
 F ext/fts5/extract_api_docs.tcl 009cf59c77afa86d137b0cca3e3b1a5efbe2264faa2df233f9a7aa8563926d15
 F ext/fts5/fts5.h ff5d3cc88b29e41612bfb29eb723e29e38973de62ca75ba3e8f94ccb67f5b5f2
-F ext/fts5/fts5Int.h 4bba2aeadbbd7378675b1fd2967c377fba3147c9a836350c437844b590068927
+F ext/fts5/fts5Int.h 8d98f8e180fe28d6067e240ed45b9011735d29d5cfb5bac194e1e376baa7c708
 F ext/fts5/fts5_aux.c da4a7a9a11ec15c6df0699d908915a209bcde48f0b04101461316b59f71abffb
 F ext/fts5/fts5_buffer.c f1e6d0324d7c55329d340673befc26681a372a4d36086caa8d1ec7d7c53066c7
 F ext/fts5/fts5_config.c e7d8dd062b44a66cd77e5a0f74f23a2354cd1f3f8575afb967b2773c3384f7f8
 F ext/fts5/fts5_expr.c b8c32da1127bafaf10d6b4768b0dcb92285798524bed2d87a8686f99a8e8d259
 F ext/fts5/fts5_hash.c a6266cedd801ab7964fa9e74ebcdda6d30ec6a96107fa24148ec6b7b5b80f6e0
-F ext/fts5/fts5_index.c 5e82963a6691ae519df1e018cc7971272a3da1fd47daca5029af0e9ce24f1a8b
+F ext/fts5/fts5_index.c 4e94cec64da9a61f8763f033fee310d3ce22805e1452fd4190e3f972ec60dfb0
 F ext/fts5/fts5_main.c 42025174a556257287071e90516d3ab8115daf1dd525a301883544469a260014
 F ext/fts5/fts5_storage.c 19bc7c4cbe1e6a2dd9849ef7d84b5ca1fcbf194cefc3e386b901e00e08bf05c2
 F ext/fts5/fts5_tcl.c 7fb5a3d3404099075aaa2457307cb459bbc257c0de3dbd52b1e80a5b503e0329
@@ -207,7 +207,7 @@ F ext/fts5/test/fts5leftjoin.test 1c14b51f4d1344a89e488160882f05a2246dd7e70c5cf0
 F ext/fts5/test/fts5limits.test 8ab67cf5d311c124b6ceb0062d0297767176df4572d955fce79fa43004dff01c
 F ext/fts5/test/fts5locale.test 83ba7ee12628b540d3098f39c39c1de0c0440eddff8f7512c8c698d0c4a3ae3c
 F ext/fts5/test/fts5matchinfo.test bc9e74157773db7f00aec1e85587f1145956ebdf1672c136f0f04323b2752aa0
-F ext/fts5/test/fts5merge.test 2654df0bcdb2d117c2d38b6aeb0168061be01c643f9e9194b36c43a2970e8082
+F ext/fts5/test/fts5merge.test 088133e135ef7dcd6701753c95b8b10be3c52fa1a99507933e00756d6437489e
 F ext/fts5/test/fts5merge2.test 3ebad1a59d6ad3fb66eff6523a09e95dc6367cbefb3cd73196801dea0425c8e2
 F ext/fts5/test/fts5misc.test 83d6c5101a092c5db8fb631cfdd69a6482e20528b2750427641ac9050d9d0381
 F ext/fts5/test/fts5multi.test a15bc91cdb717492e6e1b66fec1c356cb57386b980c7ba5af1915f97fe878581
@@ -2171,9 +2171,9 @@ F tool/version-info.c 33d0390ef484b3b1cb685d59362be891ea162123cea181cb8e6d2cf6dd
 F tool/warnings-clang.sh bbf6a1e685e534c92ec2bfba5b1745f34fb6f0bc2a362850723a9ee87c1b31a7
 F tool/warnings.sh d924598cf2f55a4ecbc2aeb055c10bd5f48114793e7ba25f9585435da29e7e98
 F tool/win/sqlite.vsix deb315d026cc8400325c5863eef847784a219a2f
-P a23d3b50fd7c2013d83f868a3a4114880887ec8fb6e9917b43c243607caab67c
-Q +9adab8b2bef4130abd358d53384cb5f4dd691b808336bb7102793b0165b1c516
-R da98a9735070591af65e2b833e66203f
+P f567ea96905ec58bb073b675e820ba505d3306338fdefd64bdd5cf965a3a9e88
+Q +52738908b04848b93d54431def37ffaa9723043270ff8ba1e2fa59ab0040afc5
+R c88fddcd46bbddec1ec76e59b00e967b
 U drh
-Z e310c8b92b93b0a750c14b33cf237076
+Z 4674c15fabf2e764d1d77dc8996ae9ae
 # Remove this line to create a well-formed Fossil manifest.
diff --git a/manifest.uuid b/manifest.uuid
index 0da97b1247..d9491fe099 100644
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-f567ea96905ec58bb073b675e820ba505d3306338fdefd64bdd5cf965a3a9e88
+127b3270f8716e0eda06ea6979def88283e15aecdceb5d56c82105b300c98bdc