Avoid an assert() failure in allocateSpace() triggered by a corrupt database. dbsqlfu...

FossilOrigin-Name: 2de7f8cc7fe18f0828bb53f1fd11f5eb828faf4d6dfaf39693dff4f8926c1c7a

diff --git a/manifest b/manifest
index 275be40dfb48ce50e53eb68dcc73d8feba7c8b6b..141bae7e734d5fe122fadf7e293d755d82ab5242 100644 (file)
--- a/manifest
+++ b/manifest
@@ -1,5 +1,5 @@
-C Improved\scomment\sfield\sin\sthe\sbytecode\sgenerated\sfor\sOP_Column\sand\sOP_Rowid.
-D 2022-04-18T14:15:07.659
+C Avoid\san\sassert()\sfailure\sin\sallocateSpace()\striggered\sby\sa\scorrupt\sdatabase.\sdbsqlfuzz\sf022eb0ce64d27808574d1dcde5cf7d002dabde8.
+D 2022-04-18T15:56:58.902
 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
 F LICENSE.md df5091916dbb40e6e9686186587125e1b2ff51f022cc334e886c19a0e9982724
@@ -492,7 +492,7 @@ F src/auth.c f4fa91b6a90bbc8e0d0f738aa284551739c9543a367071f55574681e0f24f8cf
 F src/backup.c a2891172438e385fdbe97c11c9745676bec54f518d4447090af97189fd8e52d7
 F src/bitvec.c 7c849aac407230278445cb069bebc5f89bf2ddd87c5ed9459b070a9175707b3d
 F src/btmutex.c 8acc2f464ee76324bf13310df5692a262b801808984c1b79defb2503bbafadb6
-F src/btree.c 093c940ddf1d0753542d04e37eb9903cbc126e997815d234dd2b6317e812b192
+F src/btree.c df695e953c2ce78ce4878ee5016751df9bc9a921dc0500a0f53ab3bb3196e505
 F src/btree.h 74d64b8f28cfa4a894d14d4ed64fa432cd697b98b61708d4351482ae15913e22
 F src/btreeInt.h 8ce1332edd89dfd2461d561ac10a0ab5601c8e06200cb5230596c3caaf54482e
 F src/build.c ff119be98394a65bc8be7afc39d4a791a66f03a778d396de3ec456f5dfaf39e8
@@ -814,7 +814,7 @@ F test/corruptH.test 79801d97ec5c2f9f3c87739aa1ec2eb786f96454
 F test/corruptI.test a17bbf54fdde78d43cf3cc34b0057719fd4a173a3d824285b67dc5257c064c7b
 F test/corruptJ.test 4d5ccc4bf959464229a836d60142831ef76a5aa4
 F test/corruptK.test 5b4212fe346699831c5ad559a62c54e11c0611bdde1ea8423a091f9c01aa32af
-F test/corruptL.test 7d3440831ca24ba64305583c4d4506d417d3f89f5775c0b7cc8102db078f8ff5
+F test/corruptL.test 21a951d1eb09120f3c1561af5bac30ed49be2d9dfcad039f71759c5d9e28a349
 F test/corruptM.test 7d574320e08c1b36caa3e47262061f186367d593a7e305d35f15289cc2c3e067
 F test/corruptN.test 60b5a62944b4f0029ba07edaa5fd8e670539d6b0a8d99db26c068d435675cbfe
 F test/cost.test b11cdbf9f11ffe8ef99c9881bf390e61fe92baf2182bad1dbe6de59a7295c576
@@ -1945,9 +1945,8 @@ F vsixtest/vsixtest.tcl 6a9a6ab600c25a91a7acc6293828957a386a8a93
 F vsixtest/vsixtest.vcxproj.data 2ed517e100c66dc455b492e1a33350c1b20fbcdc
 F vsixtest/vsixtest.vcxproj.filters 37e51ffedcdb064aad6ff33b6148725226cd608e
 F vsixtest/vsixtest_TemporaryKey.pfx e5b1b036facdb453873e7084e1cae9102ccc67a0
-P 82366436ef74838dae1f379f3e5b8ad187225a30ec58fb49f047ab7c08a263cf
-Q +009bbf8026106c5a74cced06cced48badb870a4b6e6a2f8104a544d2a8d79e45
-R 7ec2e027f14c1113394a6f2b89ad97e8
-U drh
-Z 913b185da9d2fc4d6a61edeeeba6fe46
+P 1b2c5cef9560123344db391cd065090d1914724715ec6643d2d9b5fac2051a21
+R e0f5c0c7d688fc682a2227f01f890489
+U dan
+Z ae7698eacadb5d5e1bd63dbe1476a21d
 # Remove this line to create a well-formed Fossil manifest.

diff --git a/manifest.uuid b/manifest.uuid
index da113a594171a245120eefc0d7b651036be0a3be..f29a4816df0e43a094de783e70a4a0ab6f74a006 100644 (file)
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-1b2c5cef9560123344db391cd065090d1914724715ec6643d2d9b5fac2051a21
\ No newline at end of file
+2de7f8cc7fe18f0828bb53f1fd11f5eb828faf4d6dfaf39693dff4f8926c1c7a
\ No newline at end of file

diff --git a/src/btree.c b/src/btree.c
index 734c92e46c12828d22432dceb9a3b145875ba616..7ebdec5b62f8516b99d156471a8f7f94339a7ccf 100644 (file)
--- a/src/btree.c
+++ b/src/btree.c
@@ -1657,6 +1657,8 @@ static u8 *pageFindSlot(MemPage *pPg, int nByte, int *pRc){
         ** fragmented bytes within the page. */
         memcpy(&aData[iAddr], &aData[pc], 2);
         aData[hdr+7] += (u8)x;
+        testcase( pc+x>maxPC );
+        return &aData[pc];
       }else if( x+pc > maxPC ){
         /* This slot extends off the end of the usable part of the page */
         *pRc = SQLITE_CORRUPT_PAGE(pPg);

diff --git a/test/corruptL.test b/test/corruptL.test
index b7ff45d2ed148dca9a4432cc135682834d070631..eef91b774783583fce4dfd8484967cd73f08bfda 100644 (file)
--- a/test/corruptL.test
+++ b/test/corruptL.test
@@ -1429,4 +1429,59 @@ do_catchsql_test 18.1 {
 } {1 {JSON cannot hold BLOB values}}
 } ;# ifcapable json1
 
+#-------------------------------------------------------------------------
+reset_db
+do_test 19.0 {
+  sqlite3 db {}
+  db deserialize [decode_hexdb {
+.open --hexdb
+| size 20480 pagesize 4096 filename crash-f022eb0ce64d27.db
+| page 1 offset 0
+|      0: 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00   SQLite format 3.
+|     16: 10 00 01 01 00 40 20 20 00 00 00 00 00 00 00 05   .....@  ........
+|     32: 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00 04   ................
+|     48: 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00   ................
+|     96: 00 00 00 00 0d 0f f8 00 04 0e d2 00 0f 08 0f d3   ................
+|    112: 0f ae 0e d2 00 00 00 00 00 00 00 00 00 00 00 00   ................
+|   3792: 00 00 34 04 06 17 0f 11 01 57 69 6e 64 65 78 61   ..4......Windexa
+|   3808: 74 31 05 43 52 45 41 54 45 20 55 4e 49 51 55 45   t1.CREATE UNIQUE
+|   3824: 20 49 4e 44 45 58 20 61 20 4f 4e 20 74 31 28 61    INDEX a ON t1(a
+|   3840: 2c 20 30 20 7c 20 61 29 81 23 01 07 17 11 11 01   , 0 | a).#......
+|   3856: 82 31 74 61 62 6c 65 74 31 74 31 02 43 52 45 41   .1tablet1t1.CREA
+|   3872: 54 45 20 54 41 42 4c 45 20 74 31 28 0a 20 20 20   TE TABLE t1(.   
+|   3888: 20 67 63 62 20 41 53 20 28 62 2a 31 29 2c 0a 20    gcb AS (b*1),. 
+|   3904: 20 20 20 61 20 49 34 54 45 47 45 52 20 50 52 49      a I4TEGER PRI
+|   3920: 4d 41 52 59 20 4b 45 59 2c 0a 20 20 20 20 67 63   MARY KEY,.    gc
+|   3936: 63 20 41 53 20 28 74 32 2b 30 29 2c 0a 20 20 20   c AS (t2+0),.   
+|   3952: 20 62 20 55 4e 49 51 55 45 2c 0a 20 20 20 20 67    b UNIQUE,.    g
+|   3968: 63 61 20 41 53 20 28 31 2a 61 2b 30 29 2c 0a 20   ca AS (1*a+0),. 
+|   3984: 20 20 20 74 32 20 55 4e 49 51 55 45 0a 20 20 29      t2 UNIQUE.  )
+|   4000: 20 57 49 54 48 4f 55 54 20 52 4f 57 49 44 23 03    WITHOUT ROWID#.
+|   4016: 06 17 37 11 01 00 69 6e 64 65 78 73 71 6c 69 74   ..7...indexsqlit
+|   4032: 65 5f 61 75 74 6f 69 6e 64 65 78 5f 74 31 5f 33   e_autoindex_t1_3
+|   4048: 74 31 02 23 02 06 17 37 11 01 00 69 6e 64 65 78   t1.#...7...index
+|   4064: 73 71 6c 69 74 65 5f 61 75 74 6f 69 6e 64 65 78   sqlite_autoindex
+|   4080: 5f 74 31 5f 32 74 31 02 00 00 00 08 00 00 00 00   _t1_2t1.........
+| page 2 offset 4096
+|      0: 0a 00 00 00 05 0f d8 00 0f f8 0f f8 9f e8 0f e0   ................
+|     16: 0f d8 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
+|   4048: 00 00 00 00 00 00 00 00 07 04 01 02 00 0f 13 88   ................
+|   4064: 07 04 01 02 00 0e 0f a0 07 04 01 02 00 0d 0b b8   ................
+|   4080: 07 04 01 02 00 0c 07 d0 07 04 01 02 00 0b 03 e8   ................
+| page 5 offset 16384
+|      0: 0a 00 00 00 05 0f e2 00 0f fa 0f f4 0f ee 0f e8   ................
+|     16: 0f e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
+|   4064: 00 00 05 03 01 01 0f 0f 05 03 01 01 0e 0e 05 03   ................
+|   4080: 01 01 0d 0d 05 03 01 01 0c 0c 05 03 01 01 0b 0b   ................
+| end crash-f022eb0ce64d27.db
+}]} {}
+
+do_execsql_test 19.1 {
+  PRAGMA writable_schema=ON;
+}
+
+do_catchsql_test 19.2 {
+  UPDATE t1 SET a=1;
+} {1 {UNIQUE constraint failed: index 'a'}}
+
 finish_test