Fix an integer overflow problem in fts3 that could lead to a buffer overwrite on...

FossilOrigin-Name: ef0c66d2a2e0b8f523633efca66a97236bb5a502525eb6a00a28a350ec7c76e6

diff --git a/ext/fts3/fts3_aux.c b/ext/fts3/fts3_aux.c
index 0d88d014d5b6afc597b85a5ef4b2d5a2f2647370..f8f05682fc6b04c65104c2994a27b99c9728838b 100644 (file)
--- a/ext/fts3/fts3_aux.c
+++ b/ext/fts3/fts3_aux.c
@@ -341,7 +341,7 @@ static int fts3auxNextMethod(sqlite3_vtab_cursor *pCursor){
         /* State 3. The integer just read is a column number. */
         default: assert( eState==3 );
           iCol = (int)v;
-          if( iCol<1 || iCol>0x3fffffff ){
+          if( iCol<1 || iCol>(pFts3->nColumn+1) ){
             rc = SQLITE_CORRUPT_VTAB;
             break;
           }

diff --git a/manifest b/manifest
index f2b41e7b151d963a8bc446291c23ab1d44bc841e..c308ebc5fb03e2cf8249cfc6fe9703eea879515b 100644 (file)
--- a/manifest
+++ b/manifest
@@ -1,5 +1,5 @@
-C Fix\sanother\sbuffer\soverread\sin\sfts5\sthat\scould\soccur\swhen\sprocessing\scorrupt\srecords.\sBug\s[bugs:/info/2026-06-03T03:54:40Z\s|\s2026-06-03T03:54:40Z].
-D 2026-06-03T14:58:13.706
+C Fix\san\sinteger\soverflow\sproblem\sin\sfts3\sthat\scould\slead\sto\sa\sbuffer\soverwrite\son\splatforms\swhere\ssize_t\sis\s32-bits.\sBug\s[bugs:/info/2026-06-03T04:28:51Z\s|\s2026-06-03T04:28:51Z].
+D 2026-06-03T15:29:59.793
 F .fossil-settings/binary-glob 61195414528fb3ea9693577e1980230d78a1f8b0a54c78cf1b9b24d0a409ed6a x
 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
@@ -83,7 +83,7 @@ F ext/fts3/README.txt 8c18f41574404623b76917b9da66fcb0ab38328d
 F ext/fts3/fts3.c 1716994c40715223431d98e5132c40a3c1a00c011c5bde2270bad1bd06be3ccd
 F ext/fts3/fts3.h 3a10a0af180d502cecc50df77b1b22df142817fe
 F ext/fts3/fts3Int.h 277f32f304e82f4397fc2a74793c0a95318b7abb9670b519e4805a00946cbd9b
-F ext/fts3/fts3_aux.c c105f6502df588f49a383eb22aed953844fb0e31265361a0cc8dd73037b37e39
+F ext/fts3/fts3_aux.c bbb614abcc995bf748cba4717e9fd8de67898e33c80f60379f6feb2358189b4b
 F ext/fts3/fts3_expr.c 907dd64deb881c0586d5ecbabc96cfebdbe2ff9e7a052d379fd3b606edfa21ea
 F ext/fts3/fts3_hash.c d9dba473741445789330c7513d4f65737c92df23c3212784312931641814672a
 F ext/fts3/fts3_hash.h 39cf6874dc239d6b4e30479b1975fe5b22a3caaf
@@ -1171,7 +1171,7 @@ F test/fts3corrupt3.test 0d5b69a0998b4adf868cc301fc78f3d0707745f1d984ce044c205cd
 F test/fts3corrupt4.test c7f414fe29b97a478d15c90382c4ae077a2bbd2283bf8c63bf66dadaaed3edb8
 F test/fts3corrupt5.test 0549f85ec4bd22e992f645f13c59b99d652f2f5e643dac75568bfd23a6db7ed5
 F test/fts3corrupt6.test f417c910254f32c0bc9ead7affa991a1d5aec35b3b32a183ffb05eea78289525
-F test/fts3corrupt7.test 446901d400cad0d896165fd568dca7174140b695806f8d219833cceb7889e36e
+F test/fts3corrupt7.test 93622a4336b161a733accbd66311d93749660243cdda268fd647c21e1e680770
 F test/fts3cov.test 1e5ecea0e4c1394cea97adcfb9fd3d2d5998fd563dacf465f413e6c7fa5cffb3
 F test/fts3d.test 2bd8c97bcb9975f2334147173b4872505b6a41359a4f9068960a36afe07a679f
 F test/fts3defer.test f4c20e4c7153d20a98ee49ee5f3faef624fefc9a067f8d8d629db380c4d9f1de
@@ -2207,8 +2207,8 @@ F tool/warnings-clang.sh bbf6a1e685e534c92ec2bfba5b1745f34fb6f0bc2a362850723a9ee
 F tool/warnings.sh a554d13f6e5cf3760f041b87939e3d616ec6961859c3245e8ef701d1eafc2ca2
 F tool/win/sqlite.vsix deb315d026cc8400325c5863eef847784a219a2f
 F tool/winmain.c 00c8fb88e365c9017db14c73d3c78af62194d9644feaf60e220ab0f411f3604c
-P 6ee44b199512b8cac604bf062f893a9047af4b5bfc881bb7cb69ae42d0a0adb4
-R ad112a7ebba6eb6137c9d02b0ef5465b
+P b5337c87cc314e6830615e4efe2d4723fa7cedf87ce404f60d6e520aeab77cbc
+R 7ffce3fc97ff7ce1432e9efe31e9337b
 U dan
-Z f61aa1a4db5847cd1975bdf673c6d93c
+Z e27f8c6f98af49d21df54ea1ef1e29bf
 # Remove this line to create a well-formed Fossil manifest.

diff --git a/manifest.uuid b/manifest.uuid
index 07caceaaab99879924df8b4c9cf7c67f62685b51..d13a0a0bad0c962cf82fc870655b0054bca14b0c 100644 (file)
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-b5337c87cc314e6830615e4efe2d4723fa7cedf87ce404f60d6e520aeab77cbc
+ef0c66d2a2e0b8f523633efca66a97236bb5a502525eb6a00a28a350ec7c76e6

diff --git a/test/fts3corrupt7.test b/test/fts3corrupt7.test
index 6394820c790efac28e6c7609879246031f4080f4..ec5f1454b8a5d1faab1cd90682fd648a87758f42 100644 (file)
--- a/test/fts3corrupt7.test
+++ b/test/fts3corrupt7.test
@@ -322,4 +322,27 @@ do_catchsql_test 3.2 {
   SELECT * FROM fts WHERE fts MATCH 'x';
 } {1 {database disk image is malformed}}
 
+#-------------------------------------------------------------------------
+reset_db
+
+do_execsql_test 4.1 {
+  CREATE VIRTUAL TABLE t1 USING fts4(content);
+  DELETE FROM t1_segments;
+  DELETE FROM t1_segdir;
+}
+
+do_execsql_test 4.2 {
+  INSERT INTO t1_segdir
+  (level, idx, start_block, leaves_end_block, end_block, root)
+  VALUES(0, 0, 0, 0, 0, X'000568656C6C6F08010201FFFFFF7F00');
+}
+
+do_execsql_test 4.3 {
+  CREATE VIRTUAL TABLE t1_terms USING fts4aux(t1);
+}
+
+do_catchsql_test 4.4 {
+  SELECT * FROM t1_terms;
+} {1 {database disk image is malformed}}
+
 finish_test