From: drh <>
Date: Sat, 4 Jul 2026 09:22:27 +0000 (+0000)
Subject: Fix possible one-byte OOB read in the fossildelta.c extension.
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=2f13a5162802f690c69969c52b3cc16c6f3879f9;p=thirdparty%2Fsqlite.git

Fix possible one-byte OOB read in the fossildelta.c extension.
[bugs:/info/2026-07-04T04:53:59Z|Bug 2026-07-04T04:53:59Z]

FossilOrigin-Name: 8001a373d1c91f92639fb34fca18f9667f1ee92eb6bfa49df06b8cc256385292
---

diff --git a/ext/misc/fossildelta.c b/ext/misc/fossildelta.c
index 766688436f..676c313739 100644
--- a/ext/misc/fossildelta.c
+++ b/ext/misc/fossildelta.c
@@ -579,7 +579,7 @@ static int delta_apply(
     return -1;
   }
   zDelta++; lenDelta--;
-  while( *zDelta && lenDelta>0 ){
+  while( lenDelta>0 && *zDelta ){
     unsigned int cnt, ofst;
     cnt = deltaGetInt(&zDelta, &lenDelta);
     if( lenDelta<=0 ) return -1;
diff --git a/ext/rbu/sqlite3rbu.c b/ext/rbu/sqlite3rbu.c
index 3f4927b2e5..f0e08ad242 100644
--- a/ext/rbu/sqlite3rbu.c
+++ b/ext/rbu/sqlite3rbu.c
@@ -616,7 +616,7 @@ static int rbuDeltaApply(
     return -1;
   }
   zDelta++; lenDelta--;
-  while( *zDelta && lenDelta>0 ){
+  while( lenDelta>0 && *zDelta ){
     unsigned int cnt, ofst;
     cnt = rbuDeltaGetInt(&zDelta, &lenDelta);
     if( lenDelta<=0 ) return -1;
diff --git a/manifest b/manifest
index 52b9cec38c..da7117396d 100644
--- a/manifest
+++ b/manifest
@@ -1,5 +1,5 @@
-C Fix\spossible\s1-byte\sOOB\sread\swhen\sdecoding\sa\smalformed\sFLOAT5\selement\nin\sJSONB.\n[bugs:/info/2026-07-04T04:59:19Z|Bug\s2026-07-04T04:59:19Z]
-D 2026-07-04T08:48:52.541
+C Fix\spossible\sone-byte\sOOB\sread\sin\sthe\sfossildelta.c\sextension.\n[bugs:/info/2026-07-04T04:53:59Z|Bug\s2026-07-04T04:53:59Z]
+D 2026-07-04T09:22:27.831
 F .fossil-settings/binary-glob 61195414528fb3ea9693577e1980230d78a1f8b0a54c78cf1b9b24d0a409ed6a x
 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
@@ -379,7 +379,7 @@ F ext/misc/diskused.c 0ef61ab38a877430e104d24c6d55f172634563f584bb08af2f33eaa04a
 F ext/misc/eval.c 04bc9aada78c888394204b4ed996ab834b99726fb59603b0ee3ed6e049755dc1
 F ext/misc/explain.c 04c9270fd8cf93a9bceb12d2f5f67e3f09a4e58b3e0efe14d24531444d2fffdf
 F ext/misc/fileio.c a8caf3ffb59af6e9870d1a1c739981727ba165cd667bda085fa21ccfc8694059
-F ext/misc/fossildelta.c 37b67b2710a0dd2da7b3aeea19388a069471eb0fc04702a0521237770d0d04f1
+F ext/misc/fossildelta.c d379a8c76fa2c0ff99edc8259951cacf454f73afb8af51976e78f1e4f3a42bd1
 F ext/misc/fuzzer.c 32cef9a29864a1bc1329ccb6dfa613f197bb83491a7612c2ca2c83ee26cd8f14
 F ext/misc/ieee754.c 2901d08a586d00a1d3c0fd89e03c57ee9e2b5f013b0daab9e49c7a48a9d5946b
 F ext/misc/memstat.c 03ab52d2d841eb3f55118105c1964d5225f152b23bd708844c648b48d14ccbcf
@@ -470,7 +470,7 @@ F ext/rbu/rbuvacuum.test e3585cfda220038e8186c583e9bd2aaa9eccd0a5c2e40ed861de3c9
 F ext/rbu/rbuvacuum2.test 1a9bd41f127be2826de2a65204df9118525a8af8d16e61e6bc63ba3ac0010a23
 F ext/rbu/rbuvacuum3.test 3ce42695fdf21aaa3499e857d7d4253bc499ad759bcd6c9362042c13cd37d8de
 F ext/rbu/rbuvacuum4.test ffccd22f67e2d0b380d2889685742159dfe0d19a3880ca3d2d1d69eefaebb205
-F ext/rbu/sqlite3rbu.c c84dd68888640c56aa4d713e38013a202b10bf1ef2e423f7be2167bd826e69d8
+F ext/rbu/sqlite3rbu.c fe93f6d115d4c856c7cc385c9acafde6b9ccbb7eda1637cc09823fc6bb79caca
 F ext/rbu/sqlite3rbu.h e3a5bf21e09ca93ce4e8740e00d6a853e90a697968ec0ea98f40826938bdb68e
 F ext/rbu/test_rbu.c 8b6e64e486c28c41ef29f6f4ea6be7b3091958987812784904f5e903f6b56418
 F ext/recover/dbdata.c 10d3c56968a9af6853722a47280805ad1564714d79ea45ac6f7da14bb57fd137
@@ -2210,8 +2210,8 @@ F tool/warnings-clang.sh bbf6a1e685e534c92ec2bfba5b1745f34fb6f0bc2a362850723a9ee
 F tool/warnings.sh a554d13f6e5cf3760f041b87939e3d616ec6961859c3245e8ef701d1eafc2ca2
 F tool/win/sqlite.vsix deb315d026cc8400325c5863eef847784a219a2f
 F tool/winmain.c 00c8fb88e365c9017db14c73d3c78af62194d9644feaf60e220ab0f411f3604c
-P bb1588f04a745ff130edf300f1216e0957c0de28734ccdba1b8a6a4a161dbddf
-R 5102c382c6ac40b4f1acd371e185752a
+P 6ed20ab693b298b6b645ee73801ee19952e9c188fba93594634325e12de02848
+R b40730bf9c4cff05ae69daba033be6ed
 U drh
-Z 5124bdb1fb9fc1654f1a65cb02a40595
+Z ed129da9874d555da1bea1d316139af0
 # Remove this line to create a well-formed Fossil manifest.
diff --git a/manifest.uuid b/manifest.uuid
index 51a707bdc1..f370d5f683 100644
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-6ed20ab693b298b6b645ee73801ee19952e9c188fba93594634325e12de02848
+8001a373d1c91f92639fb34fca18f9667f1ee92eb6bfa49df06b8cc256385292