Fix a potential UAF bug in the zipfile extension.

FossilOrigin-Name: 46fbc23c16b3d104605f5abe5d7a5e779021e264bde409f2d9939de9b5cb9b37

diff --git a/ext/misc/zipfile.c b/ext/misc/zipfile.c
index fe0941823dafcaf1ecb40d6279dafaa6b227f0eb..40b14f148db9ead3ac6435eabfed2e813a6eea39 100644 (file)
--- a/ext/misc/zipfile.c
+++ b/ext/misc/zipfile.c
@@ -488,6 +488,7 @@ static void zipfileResetCursor(ZipfileCsr *pCsr){
     pNext = p->pNext;
     zipfileEntryFree(p);
   }
+  pCsr->pFreeEntry = 0;
 }
 
 /*

diff --git a/manifest b/manifest
index 8874c08c1640b47245022fe60b5742c4f08edfab..eb3d7a4a170c569f6ba603f0251a75d48b802d32 100644 (file)
--- a/manifest
+++ b/manifest
@@ -1,5 +1,5 @@
-C Avoid\sexcessive\srecursion\sand\sstack\soverflow\sin\sfts3\swhen\sprocessing\sa\scorrupt\ndatabase.
-D 2026-06-03T12:04:07.869
+C Fix\sa\spotential\sUAF\sbug\sin\sthe\szipfile\sextension.
+D 2026-06-03T13:16:20.850
 F .fossil-settings/binary-glob 61195414528fb3ea9693577e1980230d78a1f8b0a54c78cf1b9b24d0a409ed6a x
 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
@@ -417,7 +417,7 @@ F ext/misc/vtablog.c 6c0c11c4822ab6c1a205718ea7c6d1bb561d96b27104b9c1fe84d01aa62
 F ext/misc/vtshim.c f5ab480d1e33fa46a0b138359bedc9979e32798d72348e04bbe6093f9ae95c7b
 F ext/misc/wholenumber.c aa5e6d786fe8d79bc100ea0e852249c026a91ae65a5c1bcb2b869cd1a7cdd6d5
 F ext/misc/windirent.h 02211ce51f3034c675f2dbf4d228194d51b3ee05734678bad5106fff6292e60c
-F ext/misc/zipfile.c 38211d2b23e1fcb57af2d7c597458112e6c3d6130bf97dc4c224816d9f8218fa
+F ext/misc/zipfile.c 58d535e6f177709c3f3607e19aa8e1b4c3c57c1f2c78bd4cdfac15e0b2f53e5a
 F ext/misc/zorder.c bddff2e1b9661a90c95c2a9a9c7ecd8908afab5763256294dd12d609d4664eee
 F ext/qrf/README.md 9e644615d7d7b77ef7e9db798765679e50c5ed12eda48bce21c9ef9eb4715e9d
 F ext/qrf/dev-notes.md e68a6d91ce4c7eb296ef2daadc2bb79c95c317ad15b9fafe40850c67b29c2430
@@ -2102,7 +2102,7 @@ F test/writecrash.test 13520af28f376bfc8c0bcd130efc1fff20bb165198e8b94cf153f1f75
 F test/zeroblob.test 7b74cefc7b281dfa2b07cd237987fbe94b4a2037a7771e9e83f2d5f608b1d99e
 F test/zeroblobfault.test 861d8191a0d944dfebb3cb4d2c5b4e46a5a119eaec5a63dd996c2389f8063441
 F test/zerodamage.test 9c41628db7e8d9e8a0181e59ea5f189df311a9f6ce99cc376dc461f66db6f8dc
-F test/zipfile.test 3aa05e7311f01679d81a2b49ddb7189b433dfda17580d7e8f9e904e87ee99440
+F test/zipfile.test 7b5c2f43ce9f7c882237e74822a331d94f4f83891e7a64c503519b434d06a5bf
 F test/zipfile2.test 21afaffcf4f7769df38bf16e4a9c4dfa6ba1b0f5b695f844ec61fafb92db0db7
 F test/zipfilefault.test 44d4d7a7f7cca7521d569d7f71026b241d65a6b1757aa409c1a168827edbbc2c
 F tool/GetFile.cs 47852aa0d806fe47ed1ac5138bdce7f000fe87aaa7f28107d0cb1e26682aeb44
@@ -2199,9 +2199,9 @@ F tool/warnings-clang.sh bbf6a1e685e534c92ec2bfba5b1745f34fb6f0bc2a362850723a9ee
 F tool/warnings.sh a554d13f6e5cf3760f041b87939e3d616ec6961859c3245e8ef701d1eafc2ca2
 F tool/win/sqlite.vsix deb315d026cc8400325c5863eef847784a219a2f
 F tool/winmain.c 00c8fb88e365c9017db14c73d3c78af62194d9644feaf60e220ab0f411f3604c
-P b5f9dc646df5059e546ceb1404a62aadeff4a33163d9b3758e78a33ff3c23467
-Q +21369378769195f20f839231f625582552eaa3f79044ca3e3efb7f9476b515a8
-R d7a1da736302ff0f4eb39d108db9460e
+P c32ddb6a3fe2b8cd5f8a8a133bd2d4061243a3bc0e7e29a96b4d0e5e6090977f
+Q +1fb5e9169ace6bea2bdf9013f39002c1ce5dc9ce51d6007bec22d91f456c15f0
+R a44611ce0f7837b5b17f84d541e0d6d5
 U drh
-Z 9a32bc29740450280217675caa06ea13
+Z 7a252a0b8444f7f230e7f12f5658f78d
 # Remove this line to create a well-formed Fossil manifest.

diff --git a/manifest.uuid b/manifest.uuid
index dfbdd3fca4a78616a56f19f845a67060548e1570..2044db265bbbb195652e376be07834da0437d1a6 100644 (file)
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-c32ddb6a3fe2b8cd5f8a8a133bd2d4061243a3bc0e7e29a96b4d0e5e6090977f
+46fbc23c16b3d104605f5abe5d7a5e779021e264bde409f2d9939de9b5cb9b37

diff --git a/test/zipfile.test b/test/zipfile.test
index fe4f41503a1d03e2c0076fc309f24e27b0446817..9924dddeb547752144516feeb6ecf6260a262de7 100644 (file)
--- a/test/zipfile.test
+++ b/test/zipfile.test
@@ -930,4 +930,15 @@ if {[catch {db one {SELECT length( zeroblob(1200000000) )}}]==0} {
   } {1 {out of memory}}
 }
 
+# Bug 2026-06-03T10:58:51Z
+do_catchsql_test 25.0 {
+  WITH t(v) AS (
+    SELECT unhex(
+     '504B03041400000000000000000000000000000000000000000001000000
+      61504B01021E031400000000000000000000000000000000000000000001
+      000000000000000000000000000000000061504B05060000000001000100
+      2F0000001F0000000000',char(10,13,32))
+    UNION ALL SELECT 'x'
+  ) SELECT z.name FROM t, zipfile(t.v) AS z;
+} {1 {cannot open file: x}}
 finish_test