Fix a potential buffer overread in fts5 that could occur when handling

corrupt records.  Improved detection of corrupt fts5 records.

FossilOrigin-Name: fad98805b7d73abf0cf17919397ac50757a2b888354fcf42b72640a12f32926c

diff --git a/ext/fts5/fts5_index.c b/ext/fts5/fts5_index.c
index 29be766042b6264bc487cac2bef3ce0ddcd67011..ffb356a0d3837e5517037bf94647e37f0518557c 100644 (file)
--- a/ext/fts5/fts5_index.c
+++ b/ext/fts5/fts5_index.c
@@ -2576,6 +2576,10 @@ static void fts5LeafSeek(
     if( nKeep<nMatch ){
       goto search_failed;
     }
+    if( (iOff+nNew)>n ){
+      FTS5_CORRUPT_ITER(p, pIter);
+      return;
+    }
 
     assert( nKeep>=nMatch );
     if( nKeep==nMatch ){
@@ -3702,7 +3706,7 @@ static void fts5IndexExtractColset(
       /* Advance pointer p until it points to pEnd or an 0x01 byte that is
       ** not part of a varint */
       while( p<pEnd && *p!=0x01 ){
-        while( *p++ & 0x80 );
+        while( p<pEnd && (*p++ & 0x80) );
       }
 
       if( pColset->aiCol[i]==iCurrent ){

diff --git a/ext/fts5/test/fts5corrupt3.test b/ext/fts5/test/fts5corrupt3.test
index 20be7c45cfdafa2124157680293500b894d5b77b..38621751a016369605ca08585b3ed6fc5bdeb7af 100644 (file)
--- a/ext/fts5/test/fts5corrupt3.test
+++ b/ext/fts5/test/fts5corrupt3.test
@@ -15153,9 +15153,9 @@ do_execsql_test 78.1 {
   CREATE VIRTUAL TABLE t3 USING fts5vocab('t1','col');
 }
 
-do_execsql_test 78.2 {
+do_catchsql_test 78.2 {
   SELECT count(rowid) FROM t3 WHERE term>='nsocse';
-} 2
+} {1 {database disk image is malformed}}
 
 #-------------------------------------------------------------------------
 reset_db

diff --git a/ext/fts5/test/fts5corrupt5.test b/ext/fts5/test/fts5corrupt5.test
index 4b21a9ff74b16b306d2af9a5877b5908d5387f86..6a16214a3c078eb1336597498166994c091024ef 100644 (file)
--- a/ext/fts5/test/fts5corrupt5.test
+++ b/ext/fts5/test/fts5corrupt5.test
@@ -1220,7 +1220,7 @@ do_test 8.0 {
 
 do_catchsql_test 8.1 {
   SELECT rowid FROM t1('a* NOT ý\91') ;
-} {0 {1 2 3 4 5 6 7}}
+} {1 {fts5: corruption on page 1, segment 1, table "t1"}}
 
 #-------------------------------------------------------------------------
 reset_db

diff --git a/ext/fts5/test/fts5corruptA.test b/ext/fts5/test/fts5corruptA.test
index 838cded5780fa564a2b9ddccb7eca3c25618e287..dc6a2df40bc6ef13233d3358ec0d71f3f880d00b 100644 (file)
--- a/ext/fts5/test/fts5corruptA.test
+++ b/ext/fts5/test/fts5corruptA.test
@@ -68,5 +68,61 @@ do_catchsql_test 1.5 {
   SELECT rowid FROM t WHERE t MATCH 'a'
 } {1 {fts5: corruption found reading blob 137438953481 from table "t"}}
 
+#-------------------------------------------------------------------------
+reset_db
+
+do_execsql_test 2.0 {
+  CREATE VIRTUAL TABLE t1 USING fts5(a);
+  BEGIN;
+    INSERT INTO t1(rowid, a) VALUES(1, 'aaaa');
+    INSERT INTO t1(rowid, a) VALUES(2, 'bbbb');
+    INSERT INTO t1(rowid, a) VALUES(3, 'cccc');
+  COMMIT;
+}
+
+db close
+
+do_test 2.1 {
+  set hex [hexio_read test.db 0 [file size test.db]]
+  set off [string first "010463636363" $hex]
+  set hex [string replace $hex $off [expr $off+11] 017F63636363]
+  hexio_write test.db 0 $hex
+  set {} {}
+} {}
+
+sqlite3 db test.db
+
+do_catchsql_test 2.2 {
+  SELECT rowid FROM t1('cccccccccccccccccccccccccccccccccccccccccccccccc');
+} {1 {fts5: corruption on page 1, segment 1, table "t1"}}
+
+#-------------------------------------------------------------------------
+reset_db
+do_execsql_test 3.0 {
+  CREATE VIRTUAL TABLE t1 USING fts5(a, b, c);
+  INSERT INTO t1 VALUES(
+      'hello',
+      'alpha bravo charlie delta echo foxtrot golf hotel india juliet kilo lima mike november oscar papa quebec romeo sierra tango uniform victor whiskey xray yankee zulu',
+      'ant bear cat dog elephant fox gorilla hippo iguana jaguar kangaroo lion monkey newt octopus panda quail rabbit snake turtle unicorn vulture walrus xerus yak zebra'
+  );
+
+  UPDATE t1_data SET block = unhex(
+      -- Preserve bytes 0-168: header through hello's nSz field
+      hex(substr(block, 1, 169))
+      -- Inject 448 bytes of 0xFF: corrupted poslist + subsequent term data
+      || replace(hex(zeroblob(448)), '00', 'FF')
+      -- Preserve 16 bytes of page index needed for hello lookup
+      || hex(substr(block, 618, 16))
+      -- Corrupt remaining 37 footer bytes (not needed for hello lookup)
+      || replace(hex(zeroblob(37)), '00', 'FF')
+      )
+  WHERE id = 137438953473;
+}
+
+do_test 3.1 {
+  execsql { SELECT * FROM t1 WHERE t1 MATCH '{a b}: hello' }
+  set {} {}
+} {}
+
 sqlite3_fts5_may_be_corrupt 0
 finish_test

diff --git a/manifest b/manifest
index 8e0a115ed5c73d0673385fe675fed7935bdc23b1..b9a5d9e236f126da2d44b28dc76fee9762e09cb5 100644 (file)
--- a/manifest
+++ b/manifest
@@ -1,5 +1,5 @@
-C Silently\signore\snested\sporter\stokenizers\sin\sFTS5.\s\sHaving\snested\sporter\ntokenizers\sis\spointless,\sbut\sit\sdoes\suse\sstack\sspace\sunnecessarily.
-D 2026-05-20T09:36:42.738
+C Fix\sa\spotential\sbuffer\soverread\sin\sfts5\sthat\scould\soccur\swhen\shandling\s\ncorrupt\srecords.\s\sImproved\sdetection\sof\scorrupt\sfts5\srecords.
+D 2026-05-20T10:01:25.377
 F .fossil-settings/binary-glob 61195414528fb3ea9693577e1980230d78a1f8b0a54c78cf1b9b24d0a409ed6a x
 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
@@ -113,7 +113,7 @@ F ext/fts5/fts5_buffer.c dcc3f0352339fe79c9d8abbc1c2009bc3469206467880bf43558447
 F ext/fts5/fts5_config.c bfba970fe1e4eed18ee57c8d51458e226db9a960ddf775c5e50e3d76603a667e
 F ext/fts5/fts5_expr.c 71d48e8cf0358deace4949276647d317ff7665db6db09f40b81e2e7fe6664c7c
 F ext/fts5/fts5_hash.c d5871df92ce3fa210a650cf419ee916b87c29977e86084d06612edf772bff6f5
-F ext/fts5/fts5_index.c 957534376f8ee60d4fd9af5d7d968831abf1c8cac7a6799b90acb5cd3b9ba25a
+F ext/fts5/fts5_index.c 4ac3d9e9f83280d9b7bf29c0948c3a1ed17533ecaab3fbf0ad95218c3409b42e
 F ext/fts5/fts5_main.c b0fed47b3b4420ba6810373480a75bc28a9c0b7d16478d19a396436fb3ff17d7
 F ext/fts5/fts5_storage.c 19bc7c4cbe1e6a2dd9849ef7d84b5ca1fcbf194cefc3e386b901e00e08bf05c2
 F ext/fts5/fts5_tcl.c 2be6cc14f9448f720fd4418339cd202961a0801ea9424cb3d9de946f8f5a051c
@@ -162,14 +162,14 @@ F ext/fts5/test/fts5contentless4.test ec34dc69ef474ca9997dae6d91e072906e0e9a5a4b
 F ext/fts5/test/fts5contentless5.test 38cd0392c730dc7090c550321ce3c24ba4c392bc97308b51a4180e9959dca7b5
 F ext/fts5/test/fts5corrupt.test 237fce1c3261bb3a5bec333b0f0dbf5b105ec32627ef14cccbda3cfe13833193
 F ext/fts5/test/fts5corrupt2.test 4a03a158c2cb617c9f76d26b35c1ef2534124bc0bbddcea38dfd5b170ebea27b
-F ext/fts5/test/fts5corrupt3.test e489b51b6c4ded2a808e0f78bdbe126f6d369de41a59ac2717878e37fc3db0e8
+F ext/fts5/test/fts5corrupt3.test 121a8a7622dfe1be1bc55cbe70eddd6a3416f76a837dc8c06a11a32e781595a4
 F ext/fts5/test/fts5corrupt4.test dc08d19f5b8943e95a7778a7d8da592042504faf18dd93f68f7d7a0d7d7dd733
-F ext/fts5/test/fts5corrupt5.test 73985d4fe6d8f0d5d5c7bcf79ae7c6522c376cd6ad710a0ff2f26e0c2e222abe
+F ext/fts5/test/fts5corrupt5.test 329fb0e21b1dfb9752e1769ca078f27a8e99cfcc017055c8a6d724011b73c9c6
 F ext/fts5/test/fts5corrupt6.test 2d72db743db7b5d9c9a6d0cfef24d799ed1aa5e8192b66c40e871a37ed9eed06
 F ext/fts5/test/fts5corrupt7.test 814aab492d7a09abb5bfdd81cc66fc206d7f3868f9a3bae91876e02efc466fb3
 F ext/fts5/test/fts5corrupt8.test 0b10750caf8aa23fa1c379ca4caf6130d41454505e4d5315590f4061eedcbe44
 F ext/fts5/test/fts5corrupt9.test 4253b9b59f33effac8b67da72ec34309c738aca2d5e8e2656bfbbd6a489a1dfe
-F ext/fts5/test/fts5corruptA.test 944c40f8da0f5db581ce60d32f82fb0eeb1af4dd8ea3172c207873082a0309a4
+F ext/fts5/test/fts5corruptA.test 7b31551444569420903d34ae50a55a1227d16969264f0b50de2dc812bc0b3414
 F ext/fts5/test/fts5corruptbig.test 9f95b40fa36e292feceab02b2ef06e21878bfa1ac7afefa138aae05518b51774
 F ext/fts5/test/fts5delete.test 2a5008f8b1174ef41d1974e606928c20e4f9da77d9f8347aed818994d89cced4
 F ext/fts5/test/fts5detail.test 54015e9c43ec4ba542cfb93268abdf280e0300f350efd08ee411284b03595cc4
@@ -2198,9 +2198,10 @@ F tool/warnings-clang.sh bbf6a1e685e534c92ec2bfba5b1745f34fb6f0bc2a362850723a9ee
 F tool/warnings.sh a554d13f6e5cf3760f041b87939e3d616ec6961859c3245e8ef701d1eafc2ca2
 F tool/win/sqlite.vsix deb315d026cc8400325c5863eef847784a219a2f
 F tool/winmain.c 00c8fb88e365c9017db14c73d3c78af62194d9644feaf60e220ab0f411f3604c
-P 42ef6f3f4fbe9fce3312259855df53d89e002adb0cf798c4aad074a8b7e988d5
-Q +0bdeedf56c9d7209d1ea8f950d0ef03c78cbf677528d9d30c5f4ec48c4e1a571
-R 39094aa773f1072255c022c05b993271
+P 8207ca671e1253135e5e36cd123fdcfb4d1f0fcf939d2c94238425fafd38c75a
+Q +70021c3291b38192832c99fa4d8155249dd39f5b26334595c71f5cee66d13ebb
+Q +87b653731171a26396f9796b0a5c436593571d39e991d8d040ef4473cf459b67
+R 09772adbad112a12ab59953e51ef5c29
 U drh
-Z e711451678a0c67bf7478ebad264222e
+Z 601e58774d1ea5c1f8d3859d1527e87f
 # Remove this line to create a well-formed Fossil manifest.

diff --git a/manifest.uuid b/manifest.uuid
index 6c70897f466784b4c2d736253313119eeeade4ae..cbcfda42f775b1efd10ed54fc9e20f03028be38f 100644 (file)
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-8207ca671e1253135e5e36cd123fdcfb4d1f0fcf939d2c94238425fafd38c75a
+fad98805b7d73abf0cf17919397ac50757a2b888354fcf42b72640a12f32926c