Fix both a buffer overread and overwrite in the sessions rebase module.

FossilOrigin-Name: 12d0d2363a3082f68153393ed1aa91264ee987bc9187e7afd131d503f66e4faa

diff --git a/ext/session/sessionbig2.test b/ext/session/sessionbig2.test
new file mode 100644 (file)
index 0000000..4f4ded8
--- /dev/null
+++ b/ext/session/sessionbig2.test
@@ -0,0 +1,62 @@
+# 2026 June 26
+#
+# The author disclaims copyright to this source code.  In place of
+# a legal notice, here is a blessing:
+#
+#    May you do good and not evil.
+#    May you find forgiveness for yourself and forgive others.
+#    May you share freely, never taking more than you give.
+#
+#***********************************************************************
+#
+# This file implements regression tests for sessions SQLite extension.
+#
+
+if {![info exists testdir]} {
+  set testdir [file join [file dirname [info script]] .. .. test]
+} 
+source [file join [file dirname [info script]] session_common.tcl]
+source $testdir/tester.tcl
+ifcapable !session {finish_test; return}
+
+if {[permutation]=="session_strm" || [permutation]=="session_eec"} {
+  finish_test
+  return
+}
+
+if {$::tcl_platform(pointerSize)<8} {
+  finish_test
+  return
+}
+
+set testprefix sessionbig2
+
+foreach {tn sz} {
+  1 1000
+  2 1073741820
+} {
+  reset_db
+
+  set big [string repeat A $sz]
+
+  do_execsql_test 1.$tn.0 {
+    CREATE TABLE t(pk BLOB PRIMARY KEY);
+    INSERT INTO t VALUES($big);
+  }
+  set D [changeset_from_sql { DELETE FROM t WHERE 1 }]
+  do_execsql_test 1.$tn.1 {
+    DROP TABLE t;
+    CREATE TABLE t(pk BLOB PRIMARY KEY, v INT);
+    INSERT INTO t VALUES($big, 1);
+  }
+  set U [changeset_from_sql { UPDATE t SET v=2 WHERE 1 }]
+  do_test 1.$tn.2 {
+    sqlite3rebaser_create R
+    R configure $D
+    R rebase $U
+    R delete
+  } {}
+}
+
+finish_test
+

diff --git a/ext/session/sqlite3session.c b/ext/session/sqlite3session.c
index c94664cf843e307112736eb8a5f587a7417df399..cba81d54ff20553bca27fac8f3b6cc51274b5b6f 100644 (file)
--- a/ext/session/sqlite3session.c
+++ b/ext/session/sqlite3session.c
@@ -1477,7 +1477,7 @@ static void sessionAppendStr(
   int *pRc
 ){
   int nStr = sqlite3Strlen30(zStr);
-  if( 0==sessionBufferGrow(p, nStr+1, pRc) ){
+  if( 0==sessionBufferGrow(p, (i64)nStr+1, pRc) ){
     memcpy(&p->aBuf[p->nBuf], zStr, nStr);
     p->nBuf += nStr;
     p->aBuf[p->nBuf] = 0x00;
@@ -6875,14 +6875,17 @@ static void sessionAppendRecordMerge(
   u8 *a2, int n2,                 /* Record 2 */
   int *pRc                        /* IN/OUT: error code */
 ){
-  sessionBufferGrow(pBuf, n1+n2, pRc);
+  u8 *a1Eof = &a1[n1];
+  u8 *a2Eof = &a2[n2];
+
+  sessionBufferGrow(pBuf, (i64)n1+n2, pRc);
   if( *pRc==SQLITE_OK ){
     int i;
     u8 *pOut = &pBuf->aBuf[pBuf->nBuf];
     for(i=0; i<nCol; i++){
-      int nn1 = sessionSerialLen(a1);
-      int nn2 = sessionSerialLen(a2);
-      if( *a1==0 || *a1==0xFF ){
+      int nn1 = (a1<a1Eof ? sessionSerialLen(a1) : 0);
+      int nn2 = (a2<a2Eof ? sessionSerialLen(a2) : 0);
+      if( nn1==0 || (nn2>0 && (*a1==0 || *a1==0xFF)) ){
         memcpy(pOut, a2, nn2);
         pOut += nn2;
       }else{
@@ -6924,7 +6927,7 @@ static void sessionAppendPartialUpdate(
   u8 *aChange, int nChange,       /* Record to rebase against */
   int *pRc                        /* IN/OUT: Return Code */
 ){
-  sessionBufferGrow(pBuf, 2+nRec+nChange, pRc);
+  sessionBufferGrow(pBuf, (i64)2+nRec+nChange, pRc);
   if( *pRc==SQLITE_OK ){
     int bData = 0;
     u8 *pOut = &pBuf->aBuf[pBuf->nBuf];

diff --git a/manifest b/manifest
index 91ad213f64f4d6e954f2fe397b421b481a4425b5..110c32b243f783fa2faf265301c1c0161ccd0362 100644 (file)
--- a/manifest
+++ b/manifest
@@ -1,5 +1,5 @@
-C Fix\sparsing\sof\sunterminated\s"["\stokens\sin\sthe\sincremental\sintegrity\ncheck\sextension.
-D 2026-06-26T14:47:07.965
+C Fix\sboth\sa\sbuffer\soverread\sand\soverwrite\sin\sthe\ssessions\srebase\smodule.
+D 2026-06-26T15:17:08.287
 F .fossil-settings/binary-glob 61195414528fb3ea9693577e1980230d78a1f8b0a54c78cf1b9b24d0a409ed6a x
 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
@@ -553,6 +553,7 @@ F ext/session/session_speed_test.c dcf0ef58d76b70c8fbd9eab3be77cf9deb8bc1638fed8
 F ext/session/sessionalter.test e852acb3d2357aac7d0b920a2109da758c4331bfdf85b41d39aa3a8c18914f65
 F ext/session/sessionat.test 00c8badb35e43a2f12a716d2734a44d614ff62361979b6b85419035bc04b45ee
 F ext/session/sessionbig.test 47c381e7acfabeef17d98519a3080d69151723354d220afa2053852182ca7adf
+F ext/session/sessionbig2.test 89b330d35339a5c533c81cbbbaf34221125b99cc87adf9e21a49296ca76b9200
 F ext/session/sessionblob.test 87faf667870b72f08e91969abd9f52a383ab7b514506ee194d64a39d8faff00a
 F ext/session/sessionchange.test 6618cb1c1338a4b6df173b6ac42d09623fb71269962abf23ebb7617fe9f45a50
 F ext/session/sessionchange2.test 6b5b7e3d1cc4ede43817f7fb68e3771aac4aa6500adb21a458b3e5a9fd841f83
@@ -572,7 +573,7 @@ F ext/session/sessionrowid.test 85187c2f1b38861a5844868126f69f9ec62223a03449a98a
 F ext/session/sessionsize.test 8fcf4685993c3dbaa46a24183940ab9f5aa9ed0d23e5fb63bfffbdb56134b795
 F ext/session/sessionstat1.test 5e718d5888c0c49bbb33a7a4f816366db85f59f6a4f97544a806421b85dc2dec
 F ext/session/sessionwor.test 6fd9a2256442cebde5b2284936ae9e0d54bde692d0f5fd009ecef8511f4cf3fc
-F ext/session/sqlite3session.c 1010718d9d88eeb1efd1bf3d6bcbc85e598e9d5bb094c2d202515622d2233481
+F ext/session/sqlite3session.c 7a2b0627a1f0095ae600f6d1c50c2b630daa3f09de3383ceca0522e7011c5970
 F ext/session/sqlite3session.h ca7c4422c1514a95056cc8d333217df6b1829d39058126b1de85d10cd62d7a9c
 F ext/session/test_session.c 95fbf8fc721fdb1a0d00268f930d6763c5299ed766b317f9dd3cf9ca5262e337
 F ext/wasm/GNUmakefile 68c750f173106d9d63f12c1edf1256c6f4bad9894b155da5db64322f4912de4b
@@ -1507,7 +1508,7 @@ F test/pcache.test c8acbedd3b6fd0f9a7ca887a83b11d24a007972b
 F test/pcache2.test 8a801d2b8e4b0ebb99701f026a67a9e84634c8aa24799a842c44003b93250da1
 F test/pendingrace.test e99efc5ab3584da3dfc8cd6a0ec4e5a42214820574f5ea24ee93f1d84655f463
 F test/percentile.test fd78896fa882fa4fbf693640097859721f3629926c2ccf804af5bcb7001fd35b
-F test/permutations.test e6de4f5777f7785737ac3d1d964b8656e5477a134665b2fe8a91884ab9b685b3
+F test/permutations.test 1e3f732d91bcb9fa38665488e7584eade025fb1d2948559673e41c95a2f7c8ee
 F test/pg_common.tcl 3b27542224db1e713ae387459b5d117c836a5f6e328846922993b6d2b7640d9f
 F test/pragma.test 7d07b7bb76e273215d6a20c4f83c3062cc28976c737ccb70a686025801e86c8f
 F test/pragma2.test e5d5c176360c321344249354c0c16aec46214c9f
@@ -2200,9 +2201,9 @@ F tool/warnings-clang.sh bbf6a1e685e534c92ec2bfba5b1745f34fb6f0bc2a362850723a9ee
 F tool/warnings.sh a554d13f6e5cf3760f041b87939e3d616ec6961859c3245e8ef701d1eafc2ca2
 F tool/win/sqlite.vsix deb315d026cc8400325c5863eef847784a219a2f
 F tool/winmain.c 00c8fb88e365c9017db14c73d3c78af62194d9644feaf60e220ab0f411f3604c
-P 2e1fdfbcc91da03795d6bb27980a329dc710d5c4c8540aa6e77413e29210be0e
-Q +c8f143bd618fe59c18eb92c8f5ae1b153f03cf05e1c457910f6a46599f719809
-R 55ee39a0376dc0de97edb8f07e031e29
+P 6a55dc85b73ef98f0ef31d7b0740bfe46ebb25653f2dff4eb34074d1b455925a
+Q +cc36f1741308ea354d540d27c89b92d69a0481885ca3463bdaf0b9ab27464d78
+R 3924a9995f73c73b45f171f23ff4b87a
 U drh
-Z ec66a52fdc9f4aca5ce55c2954bd05d6
+Z 8629b86aace1297c182a849c90e527db
 # Remove this line to create a well-formed Fossil manifest.

diff --git a/manifest.uuid b/manifest.uuid
index a1ac5d05ad29db0faedcdaaf3e53bee21229b6a7..a5aa280172c807abf3e5568287565ae777073745 100644 (file)
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-6a55dc85b73ef98f0ef31d7b0740bfe46ebb25653f2dff4eb34074d1b455925a
+12d0d2363a3082f68153393ed1aa91264ee987bc9187e7afd131d503f66e4faa

diff --git a/test/permutations.test b/test/permutations.test
index 02f4827189d2427285a03d5c1fec471d07b47bd0..b72e569bceeb98c1748dcefb157ab541ea10b726 100644 (file)
--- a/test/permutations.test
+++ b/test/permutations.test
@@ -139,6 +139,7 @@ set allquicktests [test_set $alltests -exclude {
 
   rtree4.test
   sessionbig.test
+  sessionbig2.test
 
   writecrash.test view3.test 
   fts5dlidx.test fts5ac.test fts4merge3.test fts5prefix.test