Improved data validation in fts5SecureDeleteOverflow().

[bugs:/info/2026-07-03T19:16:18Z|Bug 2026-07-03T19:16:18Z]

FossilOrigin-Name: bb1588f04a745ff130edf300f1216e0957c0de28734ccdba1b8a6a4a161dbddf

diff --git a/ext/fts5/fts5_index.c b/ext/fts5/fts5_index.c
index 4e404f2e2659ae9ee5109bc902b1df6d147bdeb4..c0aa45a4929f1b0a7814fab6aefa5aa0fb1968d0 100644 (file)
--- a/ext/fts5/fts5_index.c
+++ b/ext/fts5/fts5_index.c
@@ -5170,7 +5170,7 @@ static void fts5SecureDeleteOverflow(
     if( iNext!=0 ){
       *pbLastInDoclist = 0;
     }
-    if( iNext==0 && pLeaf->szLeaf!=pLeaf->nn ){
+    if( iNext==0 && pLeaf->szLeaf<pLeaf->nn ){
       fts5GetVarint32(&aPg[pLeaf->szLeaf], iNext);
     }
 

diff --git a/ext/fts5/test/fts5corruptB.test b/ext/fts5/test/fts5corruptB.test
index b46b953ae8d725f66c40d8a8f4509e0851acc588..e4625d3e704199baf6fc8e1a1a17a80cb3304995 100644 (file)
--- a/ext/fts5/test/fts5corruptB.test
+++ b/ext/fts5/test/fts5corruptB.test
@@ -2454,5 +2454,92 @@ do_catchsql_test 2.1 {
 } {1 {database disk image is malformed}}
 sqlite3_test_control_pending_byte $pending_prev
 
+
+# Bug 2026-07-03T19:16:18Z
+#
+do_test 3.0 {
+  sqlite3 db {}
+  db deserialize [decode_hexdb {
+.open --hexdb
+| size 24576 pagesize 4096 filename v2.db
+| page 1 offset 0
+|      0: 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00   SQLite format 3.
+|     16: 10 00 01 01 00 40 20 20 00 00 00 05 00 00 00 06   .....@  ........
+|     32: 00 00 00 00 00 00 00 00 00 00 00 06 00 00 00 04   ................
+|     48: 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00   ................
+|     80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 05   ................
+|     96: 00 2e 76 89 0d 00 00 00 06 0e 10 00 0f cd 0f 7a   ..v............z
+|    112: 0f 12 0e be 0e 65 0e 10 00 00 00 00 00 00 00 00   .....e..........
+|   3600: 53 06 06 17 1d 1d 01 7b 74 61 62 6c 65 74 5f 63   S.......tablet_c
+|   3616: 6f 6e 66 69 67 74 5f 63 6f 6e 66 69 67 06 43 52   onfigt_config.CR
+|   3632: 45 41 54 45 20 54 41 42 4c 45 20 27 74 5f 63 6f   EATE TABLE 't_co
+|   3648: 6e 66 69 67 27 28 6b 20 50 52 49 4d 41 52 59 20   nfig'(k PRIMARY 
+|   3664: 4b 45 59 2c 20 76 29 20 57 49 54 48 4f 55 54 20   KEY, v) WITHOUT 
+|   3680: 52 4f 57 49 44 57 05 06 17 1f 1f 01 7f 74 61 62   ROWIDW.......tab
+|   3696: 6c 65 74 5f 64 6f 63 73 69 7a 65 74 5f 64 6f 63   let_docsizet_doc
+|   3712: 73 69 7a 65 05 43 52 45 41 54 45 20 54 41 42 4c   size.CREATE TABL
+|   3728: 45 20 27 74 5f 64 6f 63 73 69 7a 65 27 28 69 64   E 't_docsize'(id
+|   3744: 20 49 4e 54 45 47 45 52 20 50 52 49 4d 41 52 59    INTEGER PRIMARY
+|   3760: 20 4b 45 59 2c 20 73 7a 20 42 4c 4f 42 29 52 04    KEY, sz BLOB)R.
+|   3776: 06 17 1f 1f 01 75 74 61 62 6c 65 74 5f 63 6f 6e   .....utablet_con
+|   3792: 74 65 6e 74 74 5f 63 6f 6e 74 65 6e 74 04 43 52   tentt_content.CR
+|   3808: 45 41 54 45 20 54 41 42 4c 45 20 27 74 5f 63 6f   EATE TABLE 't_co
+|   3824: 6e 74 65 6e 74 27 28 69 64 20 49 4e 54 45 47 45   ntent'(id INTEGE
+|   3840: 52 20 50 52 49 4d 41 52 59 20 4b 45 59 2c 20 63   R PRIMARY KEY, c
+|   3856: 30 29 66 03 07 17 17 17 01 81 2b 74 61 62 6c 65   0)f.......+table
+|   3872: 74 5f 69 64 78 74 5f 69 64 78 03 43 52 45 41 54   t_idxt_idx.CREAT
+|   3888: 45 20 54 41 42 4c 45 20 27 74 5f 69 64 78 27 28   E TABLE 't_idx'(
+|   3904: 73 65 67 69 64 2c 20 74 65 72 6d 2c 20 70 67 6e   segid, term, pgn
+|   3920: 6f 2c 20 50 52 49 4d 41 52 59 20 4b 45 59 28 73   o, PRIMARY KEY(s
+|   3936: 65 67 69 64 2c 20 74 65 72 6d 29 29 20 57 49 54   egid, term)) WIT
+|   3952: 48 4f 55 54 20 52 4f 57 49 44 51 02 06 17 19 19   HOUT ROWIDQ.....
+|   3968: 01 7f 74 61 62 6c 65 74 5f 64 61 74 61 74 5f 64   ..tablet_datat_d
+|   3984: 61 74 61 02 43 52 45 41 54 45 20 54 41 42 4c 45   ata.CREATE TABLE
+|   4000: 20 27 74 5f 64 61 74 61 27 28 69 64 20 49 4e 54    't_data'(id INT
+|   4016: 45 47 45 52 20 50 52 49 4d 41 52 59 20 4b 45 59   EGER PRIMARY KEY
+|   4032: 2c 20 62 6c 6f 63 6b 20 42 4c 4f 42 29 31 01 06   , block BLOB)1..
+|   4048: 17 0f 0f 08 55 74 61 62 6c 65 74 74 43 52 45 41   ....UtablettCREA
+|   4064: 54 45 20 56 49 52 54 55 41 4c 20 54 41 42 4c 45   TE VIRTUAL TABLE
+|   4080: 20 74 20 55 53 49 4e 47 20 66 74 73 35 28 78 29    t USING fts5(x)
+| page 2 offset 4096
+|      0: 0d 00 00 00 04 0f 93 00 0f e8 0f ef 0f a1 0f 93   ................
+|   3984: 00 00 00 07 84 80 80 80 80 02 03 00 14 00 00 ff   ................
+|   4000: ff 40 84 80 80 80 80 01 04 00 81 04 00 00 00 3b   .@.............;
+|   4016: 02 30 61 01 64 02 03 03 03 03 03 03 03 03 03 03   .0a.d...........
+|   4032: 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03   ................
+|   4048: 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03   ................
+|   4064: 03 03 03 03 03 03 03 04 05 01 03 00 10 02 35 0f   ..............5.
+|   4080: 0a 03 00 24 00 00 00 02 01 01 02 00 01 01 01 02   ...$............
+| page 3 offset 8192
+|      0: 0a 00 00 00 02 0f f2 00 0f fa 0f f2 00 00 00 00   ................
+|   4080: 00 00 07 04 09 10 01 30 62 04 05 04 09 0c 01 02   .......0b.......
+| page 4 offset 12288
+|      0: 0d 00 00 00 02 0f 8d 00 0f 97 0f 8d 00 00 00 00   ................
+|   3968: 00 00 00 00 00 00 00 00 00 00 00 00 00 08 02 03   ................
+|   3984: 00 17 62 20 62 20 62 67 01 04 00 81 53 61 20 61   ..b b bg....Sa a
+|   4000: 20 61 20 61 20 61 20 61 20 61 20 61 20 61 20 61    a a a a a a a a
+|   4016: 20 61 20 61 20 61 20 61 20 61 20 61 20 61 20 61    a a a a a a a a
+|   4032: 20 61 20 61 20 61 20 61 20 61 20 61 20 61 20 61    a a a a a a a a
+|   4048: 20 61 20 61 20 61 20 61 20 61 20 61 20 61 20 61    a a a a a a a a
+|   4064: 20 61 20 61 20 61 20 61 20 61 20 61 20 61 20 61    a a a a a a a a
+|   4080: 20 61 20 61 20 61 20 61 20 61 20 61 20 61 20 61    a a a a a a a a
+| page 5 offset 16384
+|      0: 0d 00 00 00 02 0f f4 00 0f fa 0f f4 00 00 00 00   ................
+|   4080: 00 00 00 00 04 02 03 00 0e 03 04 01 03 00 0e 32   ...............2
+| page 6 offset 20480
+|      0: 0a 00 00 00 03 0f da 00 0f eb 0f da 0f f4 00 00   ................
+|   4048: 00 00 00 00 00 00 00 00 00 00 10 03 27 09 73 65   ............'.se
+|   4064: 63 75 72 65 2d 64 65 6c 65 74 65 08 03 15 01 70   cure-delete....p
+|   4080: 67 73 7a 40 0b 03 1b 01 76 65 72 73 69 6f 6e 04   gsz@....version.
+| end v2.db
+  }]
+} {}
+do_catchsql_test 3.1 {
+  DELETE FROM t WHERE rowid=1;
+} {0 {}}
+do_catchsql_test 3.2 {
+  INSERT INTO t(t) VALUES('integrity-check');
+} {1 {fts5: corruption found reading blob 137438953474 from table "t"}}
+
 sqlite3_fts5_may_be_corrupt 0
 finish_test

diff --git a/manifest b/manifest
index f383ccb6c8b35cf5e8e50124cb92c5d34d534a3a..6ace5cee81ddc6cd4d035a7e61aa42db56417475 100644 (file)
--- a/manifest
+++ b/manifest
@@ -1,5 +1,5 @@
-C Avoid\san\sinteger\soverflow\sin\sthe\sstring\sallocator\sfor\sthe\ssnippet()\nfunction\sof\sFTS3/4,\swhen\sSQLITE_MAX_LENGTH\sis\sunusually\slarge.\n[bugs:/info/2026-07-03T18:34:04Z|Bug\s2026-07-03T18:34:04Z]
-D 2026-07-03T19:13:27.907
+C Improved\sdata\svalidation\sin\sfts5SecureDeleteOverflow().\n[bugs:/info/2026-07-03T19:16:18Z|Bug\s2026-07-03T19:16:18Z]
+D 2026-07-03T20:26:45.710
 F .fossil-settings/binary-glob 61195414528fb3ea9693577e1980230d78a1f8b0a54c78cf1b9b24d0a409ed6a x
 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
@@ -114,7 +114,7 @@ F ext/fts5/fts5_buffer.c dcc3f0352339fe79c9d8abbc1c2009bc3469206467880bf43558447
 F ext/fts5/fts5_config.c bfba970fe1e4eed18ee57c8d51458e226db9a960ddf775c5e50e3d76603a667e
 F ext/fts5/fts5_expr.c b906c59e9e842805cc3eea4e131b822e586bb01260e542f67920c61798dcb53d
 F ext/fts5/fts5_hash.c 341a08ad0153b397b819ef3d7a7959c1dc3c84a6988a431d93dece8bd62ae10e
-F ext/fts5/fts5_index.c f11a53bb7b18f68a773c0b1e6186c82e36906192a94a1e19c06c67f39bf5ec88
+F ext/fts5/fts5_index.c 8be7cc58317fdef4dc4a352fcfdd7811b74b9b6be08bf6edeb237459bd045cc5
 F ext/fts5/fts5_main.c b0fed47b3b4420ba6810373480a75bc28a9c0b7d16478d19a396436fb3ff17d7
 F ext/fts5/fts5_storage.c 46b0024fdd8002fbfba162230e5cc212c8f019ba4075396860354bfaf549a546
 F ext/fts5/fts5_tcl.c 2be6cc14f9448f720fd4418339cd202961a0801ea9424cb3d9de946f8f5a051c
@@ -172,7 +172,7 @@ F ext/fts5/test/fts5corrupt7.test 9664c15360e8b649ad76f457a0bbf5a7271b8eff1a8ee1
 F ext/fts5/test/fts5corrupt8.test 0b10750caf8aa23fa1c379ca4caf6130d41454505e4d5315590f4061eedcbe44
 F ext/fts5/test/fts5corrupt9.test 4253b9b59f33effac8b67da72ec34309c738aca2d5e8e2656bfbbd6a489a1dfe
 F ext/fts5/test/fts5corruptA.test 50b48f15548a3466dbd17000956ee86c2eb7d18d5a649bc11126ec917113b807
-F ext/fts5/test/fts5corruptB.test 6a56dff7f30415f9baf09e9c21eaa86473f4bee1c6a3286db8e1d57f75999c14
+F ext/fts5/test/fts5corruptB.test 2aa911447497c95aaefb10d409c2f2861fb344e8d6f79cbbe17481a20797373c
 F ext/fts5/test/fts5corruptbig.test 9f95b40fa36e292feceab02b2ef06e21878bfa1ac7afefa138aae05518b51774
 F ext/fts5/test/fts5delete.test 2a5008f8b1174ef41d1974e606928c20e4f9da77d9f8347aed818994d89cced4
 F ext/fts5/test/fts5detail.test 54015e9c43ec4ba542cfb93268abdf280e0300f350efd08ee411284b03595cc4
@@ -2210,8 +2210,8 @@ F tool/warnings-clang.sh bbf6a1e685e534c92ec2bfba5b1745f34fb6f0bc2a362850723a9ee
 F tool/warnings.sh a554d13f6e5cf3760f041b87939e3d616ec6961859c3245e8ef701d1eafc2ca2
 F tool/win/sqlite.vsix deb315d026cc8400325c5863eef847784a219a2f
 F tool/winmain.c 00c8fb88e365c9017db14c73d3c78af62194d9644feaf60e220ab0f411f3604c
-P 0d70a15c3b35e9af3052042cd5332db1b38a66416f1c3c8a50d342395bf22c01
-R 0163fb542a69e34ded5c853ce37b9cc4
+P b2816b4d6a2a526e50219aad6051627595ae3a02ef125b5026db6e33509efb0c
+R d2ed02a9ca954198c8eb82e797c436d8
 U drh
-Z f8aaab7abf4c8ac043cf95b768b0096d
+Z 1a763b108acd101d2173a8f2191a1843
 # Remove this line to create a well-formed Fossil manifest.

diff --git a/manifest.uuid b/manifest.uuid
index e4bccfa9cfb5099bcf8f49876d93d4199f207586..445cad06cb6f147c233b821a07e05120221d4105 100644 (file)
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-b2816b4d6a2a526e50219aad6051627595ae3a02ef125b5026db6e33509efb0c
+bb1588f04a745ff130edf300f1216e0957c0de28734ccdba1b8a6a4a161dbddf