Add reference counting to the EditDist3Config object in the spellfix

extension.  This should prevent possible UAF following OOM as
described by [bugs:/info/2026-07-26T07:55:13Z|Bug 2026-07-26T07:55:13Z].

FossilOrigin-Name: 37364eaecc148133de4e5b329e10c70922e65829244b4abd448c0adb5ca40877

diff --git a/ext/misc/spellfix.c b/ext/misc/spellfix.c
index b7961dc9c47d5ea28a455a8e26d1e9d15e5358fd..48acd983dc235caffe969ee56ea3d727802a4d44 100644 (file)
--- a/ext/misc/spellfix.c
+++ b/ext/misc/spellfix.c
@@ -590,6 +590,7 @@ static const EditDist3Lang editDist3Lang = { 0, 100, 100, 150, 0 };
 ** Complete configuration
 */
 struct EditDist3Config {
+  int nRef;              /* Reference counter.  Free when zero */
   int nLang;             /* Number of language IDs.  Size of a[] */
   EditDist3Lang *a;      /* One for each distinct language ID */
 };
@@ -654,12 +655,19 @@ static void editDist3ConfigClear(EditDist3Config *p){
     }
   }
   sqlite3_free(p->a);
-  memset(p, 0, sizeof(*p));
+  p->nLang = 0;
+  p->a = 0;
 }
 static void editDist3ConfigDelete(void *pIn){
-  EditDist3Config *p = (EditDist3Config*)pIn;
-  editDist3ConfigClear(p);
-  sqlite3_free(p);
+  if( pIn ){
+    EditDist3Config *p = (EditDist3Config*)pIn;
+    assert( p->nRef>=1 );
+    p->nRef--;
+    if( p->nRef==0 ){
+      editDist3ConfigClear(p);
+      sqlite3_free(p);
+    }
+  }
 }
 
 /* Compare the FROM values of two EditDist3Cost objects, for sorting.
@@ -1220,21 +1228,23 @@ static int editDist3Install(sqlite3 *db){
   EditDist3Config *pConfig = sqlite3_malloc64( sizeof(*pConfig) );
   if( pConfig==0 ) return SQLITE_NOMEM;
   memset(pConfig, 0, sizeof(*pConfig));
+  pConfig->nRef = 2;
   rc = sqlite3_create_function_v2(db, "editdist3",
               2, SQLITE_UTF8|SQLITE_DETERMINISTIC, pConfig,
-              editDist3SqlFunc, 0, 0, 0);
+              editDist3SqlFunc, 0, 0, editDist3ConfigDelete);
   if( rc==SQLITE_OK ){
+    pConfig->nRef++;
     rc = sqlite3_create_function_v2(db, "editdist3",
                 3, SQLITE_UTF8|SQLITE_DETERMINISTIC, pConfig,
-                editDist3SqlFunc, 0, 0, 0);
+                editDist3SqlFunc, 0, 0, editDist3ConfigDelete);
   }
   if( rc==SQLITE_OK ){
+    pConfig->nRef++;
     rc = sqlite3_create_function_v2(db, "editdist3",
                 1, SQLITE_UTF8|SQLITE_DETERMINISTIC, pConfig,
                 editDist3SqlFunc, 0, 0, editDist3ConfigDelete);
-  }else{
-    sqlite3_free(pConfig);
   }
+  editDist3ConfigDelete(pConfig);
   return rc;
 }
 /* End configurable cost unicode edit distance routines
@@ -2556,6 +2566,7 @@ static int spellfix1FilterForMatch(
     p->pConfig3 = sqlite3_malloc64( sizeof(p->pConfig3[0]) );
     if( p->pConfig3==0 ) return SQLITE_NOMEM;
     memset(p->pConfig3, 0, sizeof(p->pConfig3[0]));
+    p->pConfig3->nRef = 1;
     rc = editDist3ConfigLoad(p->pConfig3, p->db, p->zCostTable);
     if( rc ) return rc;
   }

diff --git a/manifest b/manifest
index 1b426005bf7ec5198d85de192ec64dbcb5cda4a3..16dcc313b84f95046206decb5ac3e542fd33d798 100644 (file)
--- a/manifest
+++ b/manifest
@@ -1,5 +1,5 @@
-C Add\sa\sJS\stest\sfor\s[d5d8ee76d3]\sresp.\s[012550c089].
-D 2026-07-26T16:05:47.150
+C Add\sreference\scounting\sto\sthe\sEditDist3Config\sobject\sin\sthe\sspellfix\nextension.\s\sThis\sshould\sprevent\spossible\sUAF\sfollowing\sOOM\sas\ndescribed\sby\s[bugs:/info/2026-07-26T07:55:13Z|Bug\s2026-07-26T07:55:13Z].
+D 2026-07-26T18:45:54.684
 F .fossil-settings/binary-glob 61195414528fb3ea9693577e1980230d78a1f8b0a54c78cf1b9b24d0a409ed6a x
 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
@@ -400,7 +400,7 @@ F ext/misc/series.c fd82b5c14849b861a299a316b0c63bfd69f7249601ee9bcc6fda2317fec0
 F ext/misc/sha1.c eed0ad67ad7c69798278183a74523d95623d4864821a3f4dd82b234568e307c1
 F ext/misc/shathree.c fd22d70620f86a0467acfdd3acd8435d5cb54eb1e2d9ff36ae44e389826993df
 F ext/misc/showauth.c 732578f0fe4ce42d577e1c86dc89dd14a006ab52
-F ext/misc/spellfix.c 9bef7d381247e20d9da8a74d98a528512daf4c69fb1d7a901ac89d041d5ea27c
+F ext/misc/spellfix.c 9099bd2d8701d820904663242e470537e919826060042288e6bfafd3e406c9b4
 F ext/misc/sqlar.c 97c100b010159c08a7a9acd8eb1ea510a5522e64741aaafcd7b6c629de682edc
 F ext/misc/sqlite3_stdio.c b43a0f530c6f0fb3d41d9af8c0b40f3f71198a1db55ab8ffffbef5c8cc329d22
 F ext/misc/sqlite3_stdio.h 27a4ecea47e61bc9574ccdf2806f468afe23af2f95028c9b689bfa08ab1ce99f
@@ -2217,8 +2217,8 @@ F tool/warnings-clang.sh bbf6a1e685e534c92ec2bfba5b1745f34fb6f0bc2a362850723a9ee
 F tool/warnings.sh a554d13f6e5cf3760f041b87939e3d616ec6961859c3245e8ef701d1eafc2ca2
 F tool/win/sqlite.vsix deb315d026cc8400325c5863eef847784a219a2f
 F tool/winmain.c 00c8fb88e365c9017db14c73d3c78af62194d9644feaf60e220ab0f411f3604c
-P 422b4303dae214e23a53b181e5cdf7888d159da33e1675fd8317cbe66834b78e
-R 7dbf050ce274c14c856ae45c93c056c5
-U stephan
-Z 63463d9cd082972880070940b62f1be0
+P f28494eeafc37320932a932044ecd66b6900632a1eccd45a9f8bed653cee3466
+R ff8e7fa43c25f15b4af427dedff8d5b9
+U drh
+Z 17cd07d977686b1b28954f791aa43695
 # Remove this line to create a well-formed Fossil manifest.

diff --git a/manifest.uuid b/manifest.uuid
index 5afd2e0ea505cbd300140c717631edd03471e775..2a3f7257095a75173683d73a47c5be4deb9e90da 100644 (file)
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-f28494eeafc37320932a932044ecd66b6900632a1eccd45a9f8bed653cee3466
+37364eaecc148133de4e5b329e10c70922e65829244b4abd448c0adb5ca40877