From: drh <>
Date: Tue, 23 Jun 2026 10:56:26 +0000 (+0000)
Subject: Fixes for three separate AI-discovered bugs in non-deliverable extensions.
X-Git-Tag: release~22
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=4f53fb28cd6f8812682548a74a248a7d01dbd139;p=thirdparty%2Fsqlite.git

Fixes for three separate AI-discovered bugs in non-deliverable extensions.

FossilOrigin-Name: c980094956a348423469015952455a97df3ca08709338aa03ea8bbb418e8af24
---

diff --git a/ext/misc/decimal.c b/ext/misc/decimal.c
index 67b56f95b6..a2fab71e49 100644
--- a/ext/misc/decimal.c
+++ b/ext/misc/decimal.c
@@ -319,7 +319,7 @@ static void decimal_round(Decimal *p, int N){
     ** by adding a new 0 to the front */
     for(i=0; i<N && p->a[i]==9; i++){}
     if( i==N ){
-      decimal_expand(p, p->nDigit+1, 0);
+      decimal_expand(p, p->nDigit+1, p->nFrac);
       if( p->oom ) return;
     }
 
@@ -477,6 +477,7 @@ static void decimal_expand(Decimal *p, int nDigit, int nFrac){
   signed char *a;
   if( p==0 ) return;
   nAddFrac = nFrac - p->nFrac;
+  assert( nAddFrac>=0 );
   nAddSig = (nDigit - p->nDigit) - nAddFrac;
   if( nAddFrac==0 && nAddSig==0 ) return;
   if( nDigit+1>SQLITE_DECIMAL_MAX_DIGIT ){ p->oom = 1; return; }
diff --git a/ext/misc/fuzzer.c b/ext/misc/fuzzer.c
index 12785e3a40..33ebd4b2cf 100644
--- a/ext/misc/fuzzer.c
+++ b/ext/misc/fuzzer.c
@@ -466,6 +466,8 @@ static char *fuzzerDequote(const char *zIn){
         if( zIn[iIn]==q ) iIn++;
         zOut[iOut++] = zIn[iIn];
       }
+      assert( iOut<=nIn );
+      zOut[iOut] = 0;
     }
     assert( (int)strlen(zOut)<=nIn );
   }
diff --git a/ext/misc/nextchar.c b/ext/misc/nextchar.c
index 60fa3db94d..176e4b695a 100644
--- a/ext/misc/nextchar.c
+++ b/ext/misc/nextchar.c
@@ -181,6 +181,10 @@ static void findNextChars(nextCharContext *p){
     }else{
       const unsigned char *zOut = sqlite3_column_text(p->pStmt, 0);
       unsigned cNext;
+      if( sqlite3_column_bytes(p->pStmt,0)<=p->nPrefix ){
+        sqlite3_reset(p->pStmt);
+        continue;
+      }
       n = readUtf8(zOut+p->nPrefix, &cNext);
       sqlite3_reset(p->pStmt);
       nextCharAppend(p, cNext);
diff --git a/manifest b/manifest
index 24766b68f1..8d739b823f 100644
--- a/manifest
+++ b/manifest
@@ -1,5 +1,5 @@
-C Fixes\sfor\skvvfs\sjournaling.\sBug\sreports\s[bugs:20e208fe172cae4f|2026-06-20T08:49:41Z]\sand\s[bugs:76acc88b573e3a16|2026-06-20T18:35:54Z].
-D 2026-06-22T10:38:03.366
+C Fixes\sfor\sthree\sseparate\sAI-discovered\sbugs\sin\snon-deliverable\sextensions.
+D 2026-06-23T10:56:26.976
 F .fossil-settings/binary-glob 61195414528fb3ea9693577e1980230d78a1f8b0a54c78cf1b9b24d0a409ed6a x
 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
@@ -372,17 +372,17 @@ F ext/misc/completion.c 3f5db28e88c3313103b2dd86d910a2944fd500c46754e473493968ce
 F ext/misc/compress.c 5cc142aa82d1589a31c384657d0418c0eb0871348a2201e5dca32d24a0dd6654
 F ext/misc/csv.c 5e9d4dd749e762c144104c0f01db5bf4458735b19081ebe481a64e589a66687a
 F ext/misc/dbdump.c 678f1b9ae2317b4473f65d03132a2482c3f4b08920799ed80feedd2941a06680
-F ext/misc/decimal.c fa3a9062c861e3e3bde165ad20dbec60ad43a10df4ae269fbba9e5ecc53b93c4
+F ext/misc/decimal.c f6770efd3cd4242932274e38bfc3e264308556d42fb909e1f50fed2cdb733ca0
 F ext/misc/eval.c 04bc9aada78c888394204b4ed996ab834b99726fb59603b0ee3ed6e049755dc1
 F ext/misc/explain.c 9670c8ff7b255eea7845abc5123a4958e74016c16990b10497e56380f91704b9
 F ext/misc/fileio.c e72033f987894ed821bf324a426ed462743399c274f1290dcb646349b6d7548f
 F ext/misc/fossildelta.c 356682c1df24806ed186ded6998a71ba4db4945b707a457f0b8e7e7674cb20c9
-F ext/misc/fuzzer.c decaca5a3479dfba69576cd41d4e17161eaf154a5438e12d316bbc5853571802
+F ext/misc/fuzzer.c e916972f69ea1d275a33c5b72ab8cea0e68ae3871fafdc10260df9688140d3c5
 F ext/misc/ieee754.c 2901d08a586d00a1d3c0fd89e03c57ee9e2b5f013b0daab9e49c7a48a9d5946b
 F ext/misc/memstat.c 03ab52d2d841eb3f55118105c1964d5225f152b23bd708844c648b48d14ccbcf
 F ext/misc/memtrace.c 7c0d115d2ef716ad0ba632c91e05bd119cb16c1aedf3bec9f06196ead2d5537b
 F ext/misc/mmapwarm.c a81af4aaec00f24f308e2f4c19bf1d88f3ac3ce848c36daa7a4cd38145c4080d
-F ext/misc/nextchar.c 7877914c2a80c2f181dd04c3dbef550dfb54c93495dc03da2403b5dd58f34edd
+F ext/misc/nextchar.c bb5bc64780c9ef4aa903b510249d0d37ec05a2f8faa5420bca71a6552cc1bd59
 F ext/misc/noop.c f1a21cc9b7a4e667e5c8458d80ba680b8bd4315a003f256006046879f679c5a0
 F ext/misc/normalize.c fbb144a861809686ff2b5b6eee8bb2e1207f9bf13ce7376e5273c700a1eafbd5
 F ext/misc/pcachetrace.c f4227ce03fb16aa8d6f321b72dd051097419d7a028a9853af048bee7645cb405
@@ -1045,7 +1045,7 @@ F test/dbpage.test 2e3a50548edea551ef974b8f121f975852de9c5b16cb3284ac4bf2c9f2ed5
 F test/dbpagefault.test ea39de2ca86041a9c6df1135645180a76d0a8da93ac159e2fafe38e39636530b
 F test/dbstatus.test 4a4221a883025ffd39696b3d1b3910b928fb097d77e671351acb35f3aed42759
 F test/dbstatus2.test a36518c0f0951d8fd5a3dc36f99948ad1af93fb7fc0d2e03e5bb5a643186cf52
-F test/decimal.test 9e1c40ff2835775a3dae88e1e2f0d81438070e987aafa4d9aeb0a22d60e5bf44
+F test/decimal.test e5a85d6b81313fa50a4361b041a8702c99eca2ff7ad147ea6e2525132550cb19
 F test/default.test c7124864cded213a3f118bc7e2e26f34b7c36dfa26cf6945cc8b7f5db1191277
 F test/delete.test 2686e1c98d552ef37d79ad55b17b93fe96fad9737786917ce3839767f734c48f
 F test/delete2.test 3a03f2cca1f9a67ec469915cb8babd6485db43fa
@@ -1256,7 +1256,7 @@ F test/fuzzdata5.db e35f64af17ec48926481cfaf3b3855e436bd40d1cfe2d59a9474cb4b748a
 F test/fuzzdata6.db b8725a5f5cf7a3b7241a9038e57ca7e7cc8c3f4d86b44bd770617bda245ab2b0
 F test/fuzzdata7.db 0166b56fd7a6b9636a1d60ef0a060f86ddaecf99400a666bb6e5bbd7199ad1f2
 F test/fuzzdata8.db 8f34ae00d8d5d4747dd80983cf46161065e4f78324dcff3c893506ff8db3a4a6
-F test/fuzzer1.test 3d4c4b7e547aba5e5511a2991e3e3d07166cfbb8
+F test/fuzzer1.test 33dfbddc7b70c8639af895e1f4db6fe895c1e6e048b71b30413890e5b3822872
 F test/fuzzer2.test a85ef814ce071293bce1ad8dffa217cbbaad4c14
 F test/fuzzerfault.test f64c4aef4c9e9edf1d6dc0d3f1e65dcc81e67c996403c88d14f09b74807a42bc
 F test/fuzzinvariants.c 6768bcd03290776cd982624729d2abee2e89e6aba62b4a2b839a98332725a167
@@ -1669,7 +1669,7 @@ F test/speed4p.test 377a0c48e5a92e0b11c1c5ebb1bc9d83a7312c922bc0cb05970ef5d6a96d
 F test/speedtest.md ea0c85ebe0ecff8b45ba6cdb26e694871f469009a5a29dcfe634b055f05ab241
 F test/speedtest.tcl b06f6321ef90bb68f18f7b0e430e25203d9da79b80f8926986a0d5f21ac485fb x
 F test/speedtest1.c 6c01252e66f46de0b6b8d5316e03521e2151782104f3608c10262aa5dce85721
-F test/spellfix.test 951a6405d49d1a23d6b78027d3877b4a33eeb8221dcab5704b499755bb4f552e
+F test/spellfix.test 7f7770ee8bc738fb0dab182d9bb4ee998e3982e534bdffd1a176c08bafec50f1
 F test/spellfix2.test dfc8f519a3fc204cb2dfa8b4f29821ae90f6f8c3
 F test/spellfix3.test 0f9efaaa502a0e0a09848028518a6fb096c8ad33
 F test/spellfix4.test 7c56a09de68b95051ef0627fe235e514efbba2aa816dc2a9c5c670d98877e632
@@ -2200,14 +2200,11 @@ F tool/warnings-clang.sh bbf6a1e685e534c92ec2bfba5b1745f34fb6f0bc2a362850723a9ee
 F tool/warnings.sh a554d13f6e5cf3760f041b87939e3d616ec6961859c3245e8ef701d1eafc2ca2
 F tool/win/sqlite.vsix deb315d026cc8400325c5863eef847784a219a2f
 F tool/winmain.c 00c8fb88e365c9017db14c73d3c78af62194d9644feaf60e220ab0f411f3604c
-P 6c22c34e9a7bc7bb68680de87a73667f21d14bf201990040423afc426c23a4af
-Q +7c4db1cd2d06d9dc6c4b5eed5c4fc0fc5466128a169a5d4ba261e0cb17020ae1
-Q +96a48a15760a2eee2642926874e9dfd4082518c6669f930fcc367ffd16669f39
-Q +a396d7c54c5f251daaaac1e68321c2a54d3b6969599027c29b7ca7abe7fb8c4e
-Q +bd6bbd0e84226c90d864c28ac4d6acd908c4f06bfe63dcfd6fa6b8d17105b338
-Q +c36fc5df62c7eb8fca6a43cb0b3154a030b39a4cfade8fb04496120d4d339b97
-Q +c9171221160f241b450d425f41bb53b42362dccfad4c3fdf64dd5c3562ed4096
-R cf621caee52cc74f8ce2c282ffe08d08
-U stephan
-Z 480f67db0bf2e95783b20a7e3e648f93
+P 4c773f5d64246c7c47a569218215787ba2104bc2966c4bbd8907b936e396f6ea
+Q +21b2692c8363f2c0629beef4860400a1d27f499a3f27745c23391bcfa09da898
+Q +410045796b4486fc2d301e661bf9fce3ca3a1ba61c72fe5d6c5d59a330443dd5
+Q +6ede22e13f8e85c1a341c9a80a3be2f2677baee897c659af4ca43a04698e29a5
+R bbb0ee12fb996048323fe52ed267765d
+U drh
+Z af16eb528dbe504918ec7c0d80ed28d9
 # Remove this line to create a well-formed Fossil manifest.
diff --git a/manifest.uuid b/manifest.uuid
index 8397bfcd78..0b221f58d4 100644
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-4c773f5d64246c7c47a569218215787ba2104bc2966c4bbd8907b936e396f6ea
+c980094956a348423469015952455a97df3ca08709338aa03ea8bbb418e8af24
diff --git a/test/decimal.test b/test/decimal.test
index f6a2c6eff5..89456bf919 100644
--- a/test/decimal.test
+++ b/test/decimal.test
@@ -237,6 +237,11 @@ do_execsql_test 7080 {
   SELECT decimal('998999999999999', 14);
 } {999000000000000}
 
+# Bug 2026-06-23T05:07:48Z
+#
+do_execsql_test 8000 {
+  SELECT decimal('999.999',3);
+} {1000.000}
 
 
 finish_test
diff --git a/test/fuzzer1.test b/test/fuzzer1.test
index 5e361e9df0..a5b45271a9 100644
--- a/test/fuzzer1.test
+++ b/test/fuzzer1.test
@@ -1817,4 +1817,24 @@ do_execsql_test 10.3 {
   SELECT length(word) FROM x5 WHERE word MATCH 'a' LIMIT 50;
 } {1 21 41 61 81}
 
+# Bug 2026-06-23T05:51:36Z
+#
+
+do_catchsql_test 11.1 {
+  DROP TABLE IF EXISTS f1;
+  CREATE VIRTUAL TABLE f1 USING fuzzer('aaaaaaaaaaaaaaaa'bbbbbbbbbbbbbbbb);
+} {1  {fuzzer: no such table: main.aaaaaaaaaaaaaaaabbbbbbbbbbbbbbbb}}
+do_catchsql_test 11.2 {
+  DROP TABLE IF EXISTS f2;
+  CREATE VIRTUAL TABLE f2 USING fuzzer("xxxxxxxxxxxxxxxx"yyyyyyyyyyyyyyyy);
+} {1  {fuzzer: no such table: main.xxxxxxxxxxxxxxxxyyyyyyyyyyyyyyyy}}
+do_catchsql_test 11.3 {
+  DROP TABLE IF EXISTS f3;
+  CREATE VIRTUAL TABLE f3 USING fuzzer([aaaaaaaaaaaaaaaa]bbbbbbbbbbbbbbbb);
+} {1  {fuzzer: no such table: main.aaaaaaaaaaaaaaaabbbbbbbbbbbbbbbb}}
+do_catchsql_test 11.4 {
+  DROP TABLE IF EXISTS f4;
+  CREATE VIRTUAL TABLE f4 USING fuzzer('a'b);
+} {1  {fuzzer: no such table: main.ab}}
+
 finish_test
diff --git a/test/spellfix.test b/test/spellfix.test
index 68bcfd5adb..82c578239d 100644
--- a/test/spellfix.test
+++ b/test/spellfix.test
@@ -402,4 +402,17 @@ foreach {tn conflict err bRollback res} {
   catchsql ROLLBACK
 }
 
+# Bug 2026-06-23T05:41:00Z
+#
+do_execsql_test 8.1 {
+  DROP TABLE IF EXISTS t1;
+  CREATE TABLE d(w);
+  INSERT INTO d VALUES(1);
+  WITH RECURSIVE cnt(n) AS (VALUES(1) UNION ALL SELECT n+1 FROM cnt WHERE n<100)
+  SELECT sum(length(next_char(
+    printf('%.*c',1000000,'A'),
+    'd',
+    'substr(printf(''%.*c'',2000000,''A''),1,if(abs(random())%2=0,1000001,1))')))>0
+    FROM cnt;
+} {1}
 finish_test