From: dan <Dan Kennedy>
Date: Mon, 6 Jul 2026 16:04:51 +0000 (+0000)
Subject: Fix an OOB read caused by passing an out-of-range phrase number to fts5 auxiliary... 
X-Git-Url: http://git.ipfire.org/index.cgi?a=commitdiff_plain;h=2f7c4bbc19225eca8ec744df4e5fdc229cea1fb4;p=thirdparty%2Fsqlite.git

Fix an OOB read caused by passing an out-of-range phrase number to fts5 auxiliary API xPhraseFirstColumn() in detail=columns mode.

FossilOrigin-Name: aeb85fdfca0a546cfd3ef26efd58b9ffc8d5fda15562558d8479dee55321596f
---

diff --git a/ext/fts5/fts5_main.c b/ext/fts5/fts5_main.c
index 2e3b5b3af5..8faae3c93c 100644
--- a/ext/fts5/fts5_main.c
+++ b/ext/fts5/fts5_main.c
@@ -2704,19 +2704,23 @@ static int fts5ApiPhraseFirstColumn(
 
   if( pConfig->eDetail==FTS5_DETAIL_COLUMNS ){
     Fts5Sorter *pSorter = pCsr->pSorter;
-    int n;
-    if( pSorter ){
-      int i1 = (iPhrase==0 ? 0 : pSorter->aIdx[iPhrase-1]);
-      n = pSorter->aIdx[iPhrase] - i1;
-      pIter->a = &pSorter->aPoslist[i1];
+    if( iPhrase<0 || iPhrase>=sqlite3Fts5ExprPhraseCount(pCsr->pExpr) ){
+      rc = SQLITE_RANGE;
     }else{
-      rc = sqlite3Fts5ExprPhraseCollist(pCsr->pExpr, iPhrase, &pIter->a, &n);
-    }
-    if( rc==SQLITE_OK ){
-      assert( pIter->a || n==0 );
-      pIter->b = (pIter->a ? &pIter->a[n] : 0);
-      *piCol = 0;
-      fts5ApiPhraseNextColumn(pCtx, pIter, piCol);
+      int n;
+      if( pSorter ){
+        int i1 = (iPhrase==0 ? 0 : pSorter->aIdx[iPhrase-1]);
+        n = pSorter->aIdx[iPhrase] - i1;
+        pIter->a = &pSorter->aPoslist[i1];
+      }else{
+        rc = sqlite3Fts5ExprPhraseCollist(pCsr->pExpr, iPhrase, &pIter->a, &n);
+      }
+      if( rc==SQLITE_OK ){
+        assert( pIter->a || n==0 );
+        pIter->b = (pIter->a ? &pIter->a[n] : 0);
+        *piCol = 0;
+        fts5ApiPhraseNextColumn(pCtx, pIter, piCol);
+      }
     }
   }else{
     int n;
diff --git a/ext/fts5/test/fts5aux.test b/ext/fts5/test/fts5aux.test
index 960dbc5117..5a01ec30d7 100644
--- a/ext/fts5/test/fts5aux.test
+++ b/ext/fts5/test/fts5aux.test
@@ -377,6 +377,10 @@ do_catchsql_test 12.3.3 {
   SELECT fts5_collist(t1, 1) FROM t1('one AND two');
 } {0 1}
 
+do_catchsql_test 12.3.4 {
+  SELECT fts5_collist(t1, 15000) FROM t1('one AND two');
+} {1 SQLITE_RANGE}
+
 #-------------------------------------------------------------------------
 reset_db
 do_execsql_test 13.1 {
@@ -401,4 +405,33 @@ do_catchsql_test 13.4 {
   SELECT highlight(t1, 0, '[', ']') FROM t1
 } {1 {SQL logic error}}
 
+#-------------------------------------------------------------------------
+
+foreach_detail_mode $testprefix {
+  reset_db
+  fts5_aux_test_functions db
+
+  do_execsql_test 14.0 {
+    CREATE VIRTUAL TABLE t1 USING fts5(x, detail=%DETAIL%);
+    INSERT INTO t1 VALUES('one two three');
+    INSERT INTO t1 VALUES('three two one');
+  }
+
+  do_catchsql_test 14.1 {
+    SELECT fts5_collist(t1, 15000) FROM t1('one AND two');
+  } {1 SQLITE_RANGE}
+
+  do_catchsql_test 14.2 {
+    SELECT fts5_collist(t1, 0) FROM t1('one AND two');
+  } {0 {0 0}}
+
+  do_catchsql_test 14.3 {
+    SELECT fts5_collist(t1, 0) FROM t1('one AND two') ORDER BY rank;
+  } {0 {0 0}}
+
+  do_catchsql_test 14.3 {
+    SELECT fts5_collist(t1, 15000) FROM t1('one AND two') ORDER BY rank;
+  } {1 SQLITE_RANGE}
+}
+
 finish_test
diff --git a/manifest b/manifest
index 8a54252b0b..1c996f2568 100644
--- a/manifest
+++ b/manifest
@@ -1,5 +1,5 @@
-C Fix\sa\sproblem\sin\sthe\sfossil-delta\simplementation\swithin\sRBU\scausing\sit\sto\sreject\ssome\swell-formed\sdelta\srecords.\sBug\s[bugs:/info/2026-07-06T13:01:22Z\s|\s2026-07-06T13:01:22Z].
-D 2026-07-06T15:13:52.085
+C Fix\san\sOOB\sread\scaused\sby\spassing\san\sout-of-range\sphrase\snumber\sto\sfts5\sauxiliary\sAPI\sxPhraseFirstColumn()\sin\sdetail=columns\smode.
+D 2026-07-06T16:04:51.815
 F .fossil-settings/binary-glob 61195414528fb3ea9693577e1980230d78a1f8b0a54c78cf1b9b24d0a409ed6a x
 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
@@ -115,7 +115,7 @@ F ext/fts5/fts5_config.c bfba970fe1e4eed18ee57c8d51458e226db9a960ddf775c5e50e3d7
 F ext/fts5/fts5_expr.c b906c59e9e842805cc3eea4e131b822e586bb01260e542f67920c61798dcb53d
 F ext/fts5/fts5_hash.c 341a08ad0153b397b819ef3d7a7959c1dc3c84a6988a431d93dece8bd62ae10e
 F ext/fts5/fts5_index.c 8be7cc58317fdef4dc4a352fcfdd7811b74b9b6be08bf6edeb237459bd045cc5
-F ext/fts5/fts5_main.c b0fed47b3b4420ba6810373480a75bc28a9c0b7d16478d19a396436fb3ff17d7
+F ext/fts5/fts5_main.c 7819fc80808a135c3ad7bec65071a053827d1e8fe7b77ddfd734ed451c2db7a9
 F ext/fts5/fts5_storage.c 46b0024fdd8002fbfba162230e5cc212c8f019ba4075396860354bfaf549a546
 F ext/fts5/fts5_tcl.c 2be6cc14f9448f720fd4418339cd202961a0801ea9424cb3d9de946f8f5a051c
 F ext/fts5/fts5_test_mi.c 4308d5658cb1f5eee5998dcbaac7d5bdf7a2ef43c8192ca6e0c843f856ccee26
@@ -141,7 +141,7 @@ F ext/fts5/test/fts5ak.test 25e2f8afdcff30d98ca9dee8c5cacca2f26db17501c9401f16d9
 F ext/fts5/test/fts5al.test f0e655606771b2b5dbaf70e7f0044d560257cf3531d5eea40df58d0d7add8c39
 F ext/fts5/test/fts5alter.test ebbee06419c2d3cee5ef7ebb5ba6a9996f1aa374035361c0acd37368cc5f64f3
 F ext/fts5/test/fts5auto.test 2278de323172ced485d2844cb1357d00036ac1665f27e70fa1a48ce57bf31c2c
-F ext/fts5/test/fts5aux.test 27210687338133b1e9bc0dd669322fca59fd432439f40b126895e2d7c2f899d6
+F ext/fts5/test/fts5aux.test b1b63c5f2d176c22992a6b41e014bf51ed7f5ee9567dca1152dc177f2ca9ea55
 F ext/fts5/test/fts5aux2.test 4f59ac5e7c06c430a9f4890877e10f7b4708e46897422ee6743d27b0a8d01497
 F ext/fts5/test/fts5auxdata.test 372549088ff792655f73e62b9dfaf4863ce74f5e604c06cffec0b37ce4624161
 F ext/fts5/test/fts5bigid.test 2860854c2561a57594192b00c33a29f91cb85e25f3d6c03b5c2b8f62708f39dd
@@ -2213,8 +2213,8 @@ F tool/warnings-clang.sh bbf6a1e685e534c92ec2bfba5b1745f34fb6f0bc2a362850723a9ee
 F tool/warnings.sh a554d13f6e5cf3760f041b87939e3d616ec6961859c3245e8ef701d1eafc2ca2
 F tool/win/sqlite.vsix deb315d026cc8400325c5863eef847784a219a2f
 F tool/winmain.c 00c8fb88e365c9017db14c73d3c78af62194d9644feaf60e220ab0f411f3604c
-P 46c2476b1074fb56c54068dcc04cac5a3b9da3a25bc0d3b95c00439e63d6ec43
-R 614f120796fe27e8f43757a43c2fcb46
+P 0bfba3824f3d4c136db8479c97bd789fa0df7c86ba95bd0f011c569004be2166
+R 5058ab107d87f08c2ffa1cdfde5ddf10
 U dan
-Z 4a1140244b5691488c0ec857a764c5c3
+Z e1bf6439edecbab962bcd3e56ea252b7
 # Remove this line to create a well-formed Fossil manifest.
diff --git a/manifest.uuid b/manifest.uuid
index 8463c0cfc2..e257819673 100644
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-0bfba3824f3d4c136db8479c97bd789fa0df7c86ba95bd0f011c569004be2166
+aeb85fdfca0a546cfd3ef26efd58b9ffc8d5fda15562558d8479dee55321596f