Fix a potential buffer overwrite that could occur when in fts5 when handling corrupt...

FossilOrigin-Name: de009593f692251c4a033742b1e79c4ddb5ddcb174209d58c4d1bea19ceb360c

diff --git a/ext/fts5/fts5_index.c b/ext/fts5/fts5_index.c
index ffb356a0d3837e5517037bf94647e37f0518557c..70c781b61bbd57972720c657774b14c543d58b3b 100644 (file)
--- a/ext/fts5/fts5_index.c
+++ b/ext/fts5/fts5_index.c
@@ -3803,8 +3803,11 @@ static void fts5IterSetOutputs_Col100(Fts5Iter *pIter, Fts5SegIter *pSeg){
 
   assert( pIter->pIndex->pConfig->eDetail==FTS5_DETAIL_COLUMNS );
   assert( pIter->pColset );
+  assert( pIter->poslist.nSpace>=pIter->pIndex->pConfig->nCol );
 
-  if( pSeg->iLeafOffset+pSeg->nPos>pSeg->pLeaf->szLeaf ){
+  if( pSeg->iLeafOffset+pSeg->nPos>pSeg->pLeaf->szLeaf 
+   || pSeg->nPos>pIter->pIndex->pConfig->nCol
+  ){
     fts5IterSetOutputs_Col(pIter, pSeg);
   }else{
     u8 *a = (u8*)&pSeg->pLeaf->p[pSeg->iLeafOffset];

diff --git a/ext/fts5/test/fts5corrupt5.test b/ext/fts5/test/fts5corrupt5.test
index 6a16214a3c078eb1336597498166994c091024ef..caffb0eeb9549c1f3ab60f3a0cf5f0c45a5c97a3 100644 (file)
--- a/ext/fts5/test/fts5corrupt5.test
+++ b/ext/fts5/test/fts5corrupt5.test
@@ -1917,6 +1917,86 @@ do_catchsql_test 11.3 {
   REPLACE INTO t1(rowid,b,a,rowid) VALUES(x'44023b9eb002d28b0ee90c',1,2,3);
 } {1 {database disk image is malformed}}
 
+#-------------------------------------------------------------------------
+reset_db
+do_test 12.0 {
+  sqlite3 db {}
+  db deserialize [decode_hexdb {
+.open --hexdb
+| size 24576 pagesize 4096 filename p.db
+| page 1 offset 0
+|      0: 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00   SQLite format 3.
+|     16: 10 00 01 01 00 40 20 20 00 00 00 03 00 00 00 06   .....@  ........
+|     32: 00 00 00 00 00 00 00 00 00 00 00 06 00 00 00 04   ................
+|     48: 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00   ................
+|     80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03   ................
+|     96: 00 2e 76 89 0d 00 00 00 06 0d ed 00 0f bb 0f 64   ..v............d
+|    112: 0e f9 0e a2 0e 45 0d ed 00 00 00 00 00 00 00 00   .....E..........
+|   3552: 00 00 00 00 00 00 00 00 00 00 00 00 00 56 06 06   .............V..
+|   3568: 17 1f 1f 01 7d 74 61 62 6c 65 66 74 5f 63 6f 6e   .....tableft_con
+|   3584: 66 69 67 66 74 5f 63 6f 6e 66 69 67 06 43 52 45   figft_config.CRE
+|   3600: 41 54 45 20 54 41 42 4c 45 20 27 66 74 5f 63 6f   ATE TABLE 'ft_co
+|   3616: 6e 66 69 67 27 28 6b 20 50 52 49 4d 41 52 59 20   nfig'(k PRIMARY 
+|   3632: 4b 45 59 2c 20 76 29 20 57 49 54 48 4f 55 54 20   KEY, v) WITHOUT 
+|   3648: 52 4f 57 49 44 5b 05 07 17 21 21 01 81 01 74 61   ROWID[...!!...ta
+|   3664: 62 6c 65 66 74 5f 64 6f 63 73 69 7a 65 66 74 5f   bleft_docsizeft_
+|   3680: 64 6f 63 73 69 7a 65 05 43 52 45 41 54 45 20 54   docsize.CREATE T
+|   3696: 41 42 4c 45 20 27 66 74 5f 64 6f 63 73 69 7a 65   ABLE 'ft_docsize
+|   3712: 27 28 69 64 20 49 4e 54 45 47 45 52 20 50 52 49   '(id INTEGER PRI
+|   3728: 4d 41 52 59 20 4b 45 59 2c 20 73 7a 20 42 4c 4f   MARY KEY, sz BLO
+|   3744: 42 29 55 04 06 17 21 21 01 77 74 61 62 6c 65 66   B)U...!!.wtablef
+|   3760: 74 5f 63 6f 6e 74 65 6e 74 66 74 5f 63 6f 6e 74   t_contentft_cont
+|   3776: 65 6e 74 04 43 52 45 41 54 45 20 54 41 42 4c 45   ent.CREATE TABLE
+|   3792: 20 27 66 74 5f 63 6f 6e 74 65 6e 74 27 28 69 64    'ft_content'(id
+|   3808: 20 49 4e 54 45 47 45 52 20 50 52 49 4d 41 52 59    INTEGER PRIMARY
+|   3824: 20 4b 45 59 2c 20 63 30 29 69 03 07 17 19 19 01    KEY, c0)i......
+|   3840: 81 2d 74 61 62 6c 65 66 74 5f 69 64 78 66 74 5f   .-tableft_idxft_
+|   3856: 69 64 78 03 43 52 45 41 54 45 20 54 41 42 4c 45   idx.CREATE TABLE
+|   3872: 20 27 66 74 5f 69 64 78 27 28 73 65 67 69 64 2c    'ft_idx'(segid,
+|   3888: 20 74 65 72 6d 2c 20 70 67 6e 6f 2c 20 50 52 49    term, pgno, PRI
+|   3904: 4d 41 52 59 20 4b 45 59 28 73 65 67 69 64 2c 20   MARY KEY(segid, 
+|   3920: 74 65 72 6d 29 29 20 57 49 54 48 4f 55 54 20 52   term)) WITHOUT R
+|   3936: 4f 57 49 44 55 02 07 17 1b 1b 01 81 01 74 61 62   OWIDU........tab
+|   3952: 6c 65 66 74 5f 64 61 74 61 66 74 5f 64 61 74 61   left_dataft_data
+|   3968: 02 43 52 45 41 54 45 20 54 41 42 4c 45 20 27 66   .CREATE TABLE 'f
+|   3984: 74 5f 64 61 74 61 27 28 69 64 20 49 4e 54 45 47   t_data'(id INTEG
+|   4000: 45 52 20 50 52 49 4d 41 52 59 20 4b 45 59 2c 20   ER PRIMARY KEY, 
+|   4016: 62 6c 6f 63 6b 20 42 4c 4f 42 29 43 01 06 17 11   block BLOB)C....
+|   4032: 11 08 75 74 61 62 6c 65 66 74 66 74 43 52 45 41   ..utableftftCREA
+|   4048: 54 45 20 56 49 52 54 55 41 4c 20 54 41 42 4c 45   TE VIRTUAL TABLE
+|   4064: 20 66 74 20 55 53 49 4e 47 20 66 74 73 35 28 61    ft USING fts5(a
+|   4080: 2c 20 64 65 74 61 69 6c 3d 63 6f 6c 75 6d 6e 29   , detail=column)
+| page 2 offset 4096
+|      0: 0d 00 00 00 03 0f 7f 00 0f e8 0f ef 0f 7f 00 00   ................
+|   3952: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 62   ...............b
+|   3968: 84 80 80 80 80 01 04 00 81 48 00 00 00 54 04 30   .........H...T.0
+|   3984: 61 61 61 01 81 02 02 02 02 02 02 02 02 02 02 02   aaa.............
+|   4000: 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02   ................
+|   4016: 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02   ................
+|   4032: 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02   ................
+|   4048: 02 02 02 02 02 02 02 03 6a 6a 6a 01 02 02 04 08   ........jjj.....
+|   4064: 08 08 08 08 08 08 08 08 05 01 03 00 10 01 0a 0f   ................
+|   4080: 0a 03 00 24 00 00 00 00 01 01 01 00 01 01 01 01   ...$............
+| page 3 offset 8192
+|      0: 0a 00 00 00 01 0f fa 00 0f fa 00 00 00 00 00 00   ................
+|   4080: 00 00 00 00 00 00 00 00 00 00 05 04 09 0c 01 02   ................
+| page 4 offset 12288
+|      0: 0d 00 00 00 01 0f d4 00 0f d4 00 00 00 00 00 00   ................
+|   4048: 00 00 00 00 2a 01 03 00 5b 61 61 61 20 62 62 62   ....*...[aaa bbb
+|   4064: 20 63 63 63 20 64 64 64 20 65 65 65 20 66 66 66    ccc ddd eee fff
+|   4080: 20 67 67 67 20 68 68 68 20 69 69 69 20 6a 6a 6a    ggg hhh iii jjj
+| page 5 offset 16384
+|      0: 0d 00 00 00 01 0f fa 00 0f fa 00 00 00 00 00 00   ................
+|   4080: 00 00 00 00 00 00 00 00 00 00 04 01 03 00 0e 0a   ................
+| page 6 offset 20480
+|      0: 0a 00 00 00 01 0f f4 00 0f f4 00 00 00 00 00 00   ................
+|   4080: 00 00 00 00 0b 03 1b 01 76 65 72 73 69 6f 6e 04   ........version.
+| end p.db
+}]} {}
+
+do_catchsql_test 12.1 {
+  SELECT rowid FROM ft('a:aaa')
+} {0 1}
 
 sqlite3_fts5_may_be_corrupt 0
 finish_test

diff --git a/manifest b/manifest
index 310f1eb75b9e6dd82a8b960e0b5afa25543d297b..ddb46188411b233426749dc303c5695589553cdf 100644 (file)
--- a/manifest
+++ b/manifest
@@ -1,5 +1,5 @@
-C Make\sthe\s/A\ssubstitution\sin\sthe\sCLI\sprompt\sexpansion\sresponsive\sto\sthe\nSQLITE_CLI_APPNAME\scompile-time\soption.
-D 2026-05-23T12:14:05.823
+C Fix\sa\spotential\sbuffer\soverwrite\sthat\scould\soccur\swhen\sin\sfts5\swhen\shandling\scorrupt\srecords.
+D 2026-05-25T17:09:37.095
 F .fossil-settings/binary-glob 61195414528fb3ea9693577e1980230d78a1f8b0a54c78cf1b9b24d0a409ed6a x
 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
@@ -114,7 +114,7 @@ F ext/fts5/fts5_buffer.c dcc3f0352339fe79c9d8abbc1c2009bc3469206467880bf43558447
 F ext/fts5/fts5_config.c bfba970fe1e4eed18ee57c8d51458e226db9a960ddf775c5e50e3d76603a667e
 F ext/fts5/fts5_expr.c 71d48e8cf0358deace4949276647d317ff7665db6db09f40b81e2e7fe6664c7c
 F ext/fts5/fts5_hash.c d5871df92ce3fa210a650cf419ee916b87c29977e86084d06612edf772bff6f5
-F ext/fts5/fts5_index.c 4ac3d9e9f83280d9b7bf29c0948c3a1ed17533ecaab3fbf0ad95218c3409b42e
+F ext/fts5/fts5_index.c 87faf9a9ca65ec7be0886e13e9f7571d0d2416ab88e77a06d57bbaf3734bd51f
 F ext/fts5/fts5_main.c b0fed47b3b4420ba6810373480a75bc28a9c0b7d16478d19a396436fb3ff17d7
 F ext/fts5/fts5_storage.c 19bc7c4cbe1e6a2dd9849ef7d84b5ca1fcbf194cefc3e386b901e00e08bf05c2
 F ext/fts5/fts5_tcl.c 2be6cc14f9448f720fd4418339cd202961a0801ea9424cb3d9de946f8f5a051c
@@ -165,7 +165,7 @@ F ext/fts5/test/fts5corrupt.test 237fce1c3261bb3a5bec333b0f0dbf5b105ec32627ef14c
 F ext/fts5/test/fts5corrupt2.test 4a03a158c2cb617c9f76d26b35c1ef2534124bc0bbddcea38dfd5b170ebea27b
 F ext/fts5/test/fts5corrupt3.test 121a8a7622dfe1be1bc55cbe70eddd6a3416f76a837dc8c06a11a32e781595a4
 F ext/fts5/test/fts5corrupt4.test dc08d19f5b8943e95a7778a7d8da592042504faf18dd93f68f7d7a0d7d7dd733
-F ext/fts5/test/fts5corrupt5.test 329fb0e21b1dfb9752e1769ca078f27a8e99cfcc017055c8a6d724011b73c9c6
+F ext/fts5/test/fts5corrupt5.test bdf6c04a1c9176507c8c0e66842b78b3fbcafccde20a41bb22a1b19896784b54
 F ext/fts5/test/fts5corrupt6.test 2d72db743db7b5d9c9a6d0cfef24d799ed1aa5e8192b66c40e871a37ed9eed06
 F ext/fts5/test/fts5corrupt7.test 814aab492d7a09abb5bfdd81cc66fc206d7f3868f9a3bae91876e02efc466fb3
 F ext/fts5/test/fts5corrupt8.test 0b10750caf8aa23fa1c379ca4caf6130d41454505e4d5315590f4061eedcbe44
@@ -2207,8 +2207,8 @@ F tool/warnings-clang.sh bbf6a1e685e534c92ec2bfba5b1745f34fb6f0bc2a362850723a9ee
 F tool/warnings.sh a554d13f6e5cf3760f041b87939e3d616ec6961859c3245e8ef701d1eafc2ca2
 F tool/win/sqlite.vsix deb315d026cc8400325c5863eef847784a219a2f
 F tool/winmain.c 00c8fb88e365c9017db14c73d3c78af62194d9644feaf60e220ab0f411f3604c
-P 64b707f4b3177384b611df5f5e4ca7da44d86313f74ff943a00581a6dd924b08
-R 44b7a14314a6436705357a7241f0da91
-U drh
-Z dfafbb338d591d12574f1675286845de
+P 624dc12e9e6dece22f7d247b66f0889755295cb2154502ade6553c13b8fecd83
+R dbd3300d0e7e3b6d597a8244bd068e34
+U dan
+Z 4559d145c3b492c37fba3b96a38d5b3c
 # Remove this line to create a well-formed Fossil manifest.

diff --git a/manifest.uuid b/manifest.uuid
index a344c86306683ac73b3302aeca5d2325f42a0f4d..6e30f998ea5e674a2f29b4d4bdd382e1e8a6caae 100644 (file)
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-624dc12e9e6dece22f7d247b66f0889755295cb2154502ade6553c13b8fecd83
+de009593f692251c4a033742b1e79c4ddb5ddcb174209d58c4d1bea19ceb360c