From: drh <> Date: Fri, 3 Jul 2026 20:26:45 +0000 (+0000) Subject: Improved data validation in fts5SecureDeleteOverflow(). X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=c9a90ce1ece31b8ba9b81353dd5b852962705144;p=thirdparty%2Fsqlite.git Improved data validation in fts5SecureDeleteOverflow(). [bugs:/info/2026-07-03T19:16:18Z|Bug 2026-07-03T19:16:18Z] FossilOrigin-Name: bb1588f04a745ff130edf300f1216e0957c0de28734ccdba1b8a6a4a161dbddf --- diff --git a/ext/fts5/fts5_index.c b/ext/fts5/fts5_index.c index 4e404f2e26..c0aa45a492 100644 --- a/ext/fts5/fts5_index.c +++ b/ext/fts5/fts5_index.c @@ -5170,7 +5170,7 @@ static void fts5SecureDeleteOverflow( if( iNext!=0 ){ *pbLastInDoclist = 0; } - if( iNext==0 && pLeaf->szLeaf!=pLeaf->nn ){ + if( iNext==0 && pLeaf->szLeafnn ){ fts5GetVarint32(&aPg[pLeaf->szLeaf], iNext); } diff --git a/ext/fts5/test/fts5corruptB.test b/ext/fts5/test/fts5corruptB.test index b46b953ae8..e4625d3e70 100644 --- a/ext/fts5/test/fts5corruptB.test +++ b/ext/fts5/test/fts5corruptB.test @@ -2454,5 +2454,92 @@ do_catchsql_test 2.1 { } {1 {database disk image is malformed}} sqlite3_test_control_pending_byte $pending_prev + +# Bug 2026-07-03T19:16:18Z +# +do_test 3.0 { + sqlite3 db {} + db deserialize [decode_hexdb { +.open --hexdb +| size 24576 pagesize 4096 filename v2.db +| page 1 offset 0 +| 0: 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00 SQLite format 3. +| 16: 10 00 01 01 00 40 20 20 00 00 00 05 00 00 00 06 .....@ ........ +| 32: 00 00 00 00 00 00 00 00 00 00 00 06 00 00 00 04 ................ +| 48: 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 ................ +| 80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 05 ................ +| 96: 00 2e 76 89 0d 00 00 00 06 0e 10 00 0f cd 0f 7a ..v............z +| 112: 0f 12 0e be 0e 65 0e 10 00 00 00 00 00 00 00 00 .....e.......... +| 3600: 53 06 06 17 1d 1d 01 7b 74 61 62 6c 65 74 5f 63 S.......tablet_c +| 3616: 6f 6e 66 69 67 74 5f 63 6f 6e 66 69 67 06 43 52 onfigt_config.CR +| 3632: 45 41 54 45 20 54 41 42 4c 45 20 27 74 5f 63 6f EATE TABLE 't_co +| 3648: 6e 66 69 67 27 28 6b 20 50 52 49 4d 41 52 59 20 nfig'(k PRIMARY +| 3664: 4b 45 59 2c 20 76 29 20 57 49 54 48 4f 55 54 20 KEY, v) WITHOUT +| 3680: 52 4f 57 49 44 57 05 06 17 1f 1f 01 7f 74 61 62 ROWIDW.......tab +| 3696: 6c 65 74 5f 64 6f 63 73 69 7a 65 74 5f 64 6f 63 let_docsizet_doc +| 3712: 73 69 7a 65 05 43 52 45 41 54 45 20 54 41 42 4c size.CREATE TABL +| 3728: 45 20 27 74 5f 64 6f 63 73 69 7a 65 27 28 69 64 E 't_docsize'(id +| 3744: 20 49 4e 54 45 47 45 52 20 50 52 49 4d 41 52 59 INTEGER PRIMARY +| 3760: 20 4b 45 59 2c 20 73 7a 20 42 4c 4f 42 29 52 04 KEY, sz BLOB)R. +| 3776: 06 17 1f 1f 01 75 74 61 62 6c 65 74 5f 63 6f 6e .....utablet_con +| 3792: 74 65 6e 74 74 5f 63 6f 6e 74 65 6e 74 04 43 52 tentt_content.CR +| 3808: 45 41 54 45 20 54 41 42 4c 45 20 27 74 5f 63 6f EATE TABLE 't_co +| 3824: 6e 74 65 6e 74 27 28 69 64 20 49 4e 54 45 47 45 ntent'(id INTEGE +| 3840: 52 20 50 52 49 4d 41 52 59 20 4b 45 59 2c 20 63 R PRIMARY KEY, c +| 3856: 30 29 66 03 07 17 17 17 01 81 2b 74 61 62 6c 65 0)f.......+table +| 3872: 74 5f 69 64 78 74 5f 69 64 78 03 43 52 45 41 54 t_idxt_idx.CREAT +| 3888: 45 20 54 41 42 4c 45 20 27 74 5f 69 64 78 27 28 E TABLE 't_idx'( +| 3904: 73 65 67 69 64 2c 20 74 65 72 6d 2c 20 70 67 6e segid, term, pgn +| 3920: 6f 2c 20 50 52 49 4d 41 52 59 20 4b 45 59 28 73 o, PRIMARY KEY(s +| 3936: 65 67 69 64 2c 20 74 65 72 6d 29 29 20 57 49 54 egid, term)) WIT +| 3952: 48 4f 55 54 20 52 4f 57 49 44 51 02 06 17 19 19 HOUT ROWIDQ..... +| 3968: 01 7f 74 61 62 6c 65 74 5f 64 61 74 61 74 5f 64 ..tablet_datat_d +| 3984: 61 74 61 02 43 52 45 41 54 45 20 54 41 42 4c 45 ata.CREATE TABLE +| 4000: 20 27 74 5f 64 61 74 61 27 28 69 64 20 49 4e 54 't_data'(id INT +| 4016: 45 47 45 52 20 50 52 49 4d 41 52 59 20 4b 45 59 EGER PRIMARY KEY +| 4032: 2c 20 62 6c 6f 63 6b 20 42 4c 4f 42 29 31 01 06 , block BLOB)1.. +| 4048: 17 0f 0f 08 55 74 61 62 6c 65 74 74 43 52 45 41 ....UtablettCREA +| 4064: 54 45 20 56 49 52 54 55 41 4c 20 54 41 42 4c 45 TE VIRTUAL TABLE +| 4080: 20 74 20 55 53 49 4e 47 20 66 74 73 35 28 78 29 t USING fts5(x) +| page 2 offset 4096 +| 0: 0d 00 00 00 04 0f 93 00 0f e8 0f ef 0f a1 0f 93 ................ +| 3984: 00 00 00 07 84 80 80 80 80 02 03 00 14 00 00 ff ................ +| 4000: ff 40 84 80 80 80 80 01 04 00 81 04 00 00 00 3b .@.............; +| 4016: 02 30 61 01 64 02 03 03 03 03 03 03 03 03 03 03 .0a.d........... +| 4032: 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 ................ +| 4048: 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 03 ................ +| 4064: 03 03 03 03 03 03 03 04 05 01 03 00 10 02 35 0f ..............5. +| 4080: 0a 03 00 24 00 00 00 02 01 01 02 00 01 01 01 02 ...$............ +| page 3 offset 8192 +| 0: 0a 00 00 00 02 0f f2 00 0f fa 0f f2 00 00 00 00 ................ +| 4080: 00 00 07 04 09 10 01 30 62 04 05 04 09 0c 01 02 .......0b....... +| page 4 offset 12288 +| 0: 0d 00 00 00 02 0f 8d 00 0f 97 0f 8d 00 00 00 00 ................ +| 3968: 00 00 00 00 00 00 00 00 00 00 00 00 00 08 02 03 ................ +| 3984: 00 17 62 20 62 20 62 67 01 04 00 81 53 61 20 61 ..b b bg....Sa a +| 4000: 20 61 20 61 20 61 20 61 20 61 20 61 20 61 20 61 a a a a a a a a +| 4016: 20 61 20 61 20 61 20 61 20 61 20 61 20 61 20 61 a a a a a a a a +| 4032: 20 61 20 61 20 61 20 61 20 61 20 61 20 61 20 61 a a a a a a a a +| 4048: 20 61 20 61 20 61 20 61 20 61 20 61 20 61 20 61 a a a a a a a a +| 4064: 20 61 20 61 20 61 20 61 20 61 20 61 20 61 20 61 a a a a a a a a +| 4080: 20 61 20 61 20 61 20 61 20 61 20 61 20 61 20 61 a a a a a a a a +| page 5 offset 16384 +| 0: 0d 00 00 00 02 0f f4 00 0f fa 0f f4 00 00 00 00 ................ +| 4080: 00 00 00 00 04 02 03 00 0e 03 04 01 03 00 0e 32 ...............2 +| page 6 offset 20480 +| 0: 0a 00 00 00 03 0f da 00 0f eb 0f da 0f f4 00 00 ................ +| 4048: 00 00 00 00 00 00 00 00 00 00 10 03 27 09 73 65 ............'.se +| 4064: 63 75 72 65 2d 64 65 6c 65 74 65 08 03 15 01 70 cure-delete....p +| 4080: 67 73 7a 40 0b 03 1b 01 76 65 72 73 69 6f 6e 04 gsz@....version. +| end v2.db + }] +} {} +do_catchsql_test 3.1 { + DELETE FROM t WHERE rowid=1; +} {0 {}} +do_catchsql_test 3.2 { + INSERT INTO t(t) VALUES('integrity-check'); +} {1 {fts5: corruption found reading blob 137438953474 from table "t"}} + sqlite3_fts5_may_be_corrupt 0 finish_test diff --git a/manifest b/manifest index f383ccb6c8..6ace5cee81 100644 --- a/manifest +++ b/manifest @@ -1,5 +1,5 @@ -C Avoid\san\sinteger\soverflow\sin\sthe\sstring\sallocator\sfor\sthe\ssnippet()\nfunction\sof\sFTS3/4,\swhen\sSQLITE_MAX_LENGTH\sis\sunusually\slarge.\n[bugs:/info/2026-07-03T18:34:04Z|Bug\s2026-07-03T18:34:04Z] -D 2026-07-03T19:13:27.907 +C Improved\sdata\svalidation\sin\sfts5SecureDeleteOverflow().\n[bugs:/info/2026-07-03T19:16:18Z|Bug\s2026-07-03T19:16:18Z] +D 2026-07-03T20:26:45.710 F .fossil-settings/binary-glob 61195414528fb3ea9693577e1980230d78a1f8b0a54c78cf1b9b24d0a409ed6a x F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea @@ -114,7 +114,7 @@ F ext/fts5/fts5_buffer.c dcc3f0352339fe79c9d8abbc1c2009bc3469206467880bf43558447 F ext/fts5/fts5_config.c bfba970fe1e4eed18ee57c8d51458e226db9a960ddf775c5e50e3d76603a667e F ext/fts5/fts5_expr.c b906c59e9e842805cc3eea4e131b822e586bb01260e542f67920c61798dcb53d F ext/fts5/fts5_hash.c 341a08ad0153b397b819ef3d7a7959c1dc3c84a6988a431d93dece8bd62ae10e -F ext/fts5/fts5_index.c f11a53bb7b18f68a773c0b1e6186c82e36906192a94a1e19c06c67f39bf5ec88 +F ext/fts5/fts5_index.c 8be7cc58317fdef4dc4a352fcfdd7811b74b9b6be08bf6edeb237459bd045cc5 F ext/fts5/fts5_main.c b0fed47b3b4420ba6810373480a75bc28a9c0b7d16478d19a396436fb3ff17d7 F ext/fts5/fts5_storage.c 46b0024fdd8002fbfba162230e5cc212c8f019ba4075396860354bfaf549a546 F ext/fts5/fts5_tcl.c 2be6cc14f9448f720fd4418339cd202961a0801ea9424cb3d9de946f8f5a051c @@ -172,7 +172,7 @@ F ext/fts5/test/fts5corrupt7.test 9664c15360e8b649ad76f457a0bbf5a7271b8eff1a8ee1 F ext/fts5/test/fts5corrupt8.test 0b10750caf8aa23fa1c379ca4caf6130d41454505e4d5315590f4061eedcbe44 F ext/fts5/test/fts5corrupt9.test 4253b9b59f33effac8b67da72ec34309c738aca2d5e8e2656bfbbd6a489a1dfe F ext/fts5/test/fts5corruptA.test 50b48f15548a3466dbd17000956ee86c2eb7d18d5a649bc11126ec917113b807 -F ext/fts5/test/fts5corruptB.test 6a56dff7f30415f9baf09e9c21eaa86473f4bee1c6a3286db8e1d57f75999c14 +F ext/fts5/test/fts5corruptB.test 2aa911447497c95aaefb10d409c2f2861fb344e8d6f79cbbe17481a20797373c F ext/fts5/test/fts5corruptbig.test 9f95b40fa36e292feceab02b2ef06e21878bfa1ac7afefa138aae05518b51774 F ext/fts5/test/fts5delete.test 2a5008f8b1174ef41d1974e606928c20e4f9da77d9f8347aed818994d89cced4 F ext/fts5/test/fts5detail.test 54015e9c43ec4ba542cfb93268abdf280e0300f350efd08ee411284b03595cc4 @@ -2210,8 +2210,8 @@ F tool/warnings-clang.sh bbf6a1e685e534c92ec2bfba5b1745f34fb6f0bc2a362850723a9ee F tool/warnings.sh a554d13f6e5cf3760f041b87939e3d616ec6961859c3245e8ef701d1eafc2ca2 F tool/win/sqlite.vsix deb315d026cc8400325c5863eef847784a219a2f F tool/winmain.c 00c8fb88e365c9017db14c73d3c78af62194d9644feaf60e220ab0f411f3604c -P 0d70a15c3b35e9af3052042cd5332db1b38a66416f1c3c8a50d342395bf22c01 -R 0163fb542a69e34ded5c853ce37b9cc4 +P b2816b4d6a2a526e50219aad6051627595ae3a02ef125b5026db6e33509efb0c +R d2ed02a9ca954198c8eb82e797c436d8 U drh -Z f8aaab7abf4c8ac043cf95b768b0096d +Z 1a763b108acd101d2173a8f2191a1843 # Remove this line to create a well-formed Fossil manifest. diff --git a/manifest.uuid b/manifest.uuid index e4bccfa9cf..445cad06cb 100644 --- a/manifest.uuid +++ b/manifest.uuid @@ -1 +1 @@ -b2816b4d6a2a526e50219aad6051627595ae3a02ef125b5026db6e33509efb0c +bb1588f04a745ff130edf300f1216e0957c0de28734ccdba1b8a6a4a161dbddf