From: drh <>
Date: Fri, 3 Jul 2026 19:13:27 +0000 (+0000)
Subject: Avoid an integer overflow in the string allocator for the snippet()
X-Git-Url: http://git.ipfire.org/index.cgi?a=commitdiff_plain;h=4f670ff0136826bb91214c1f68eec6a4d16adabe;p=thirdparty%2Fsqlite.git

Avoid an integer overflow in the string allocator for the snippet()
function of FTS3/4, when SQLITE_MAX_LENGTH is unusually large.
[bugs:/info/2026-07-03T18:34:04Z|Bug 2026-07-03T18:34:04Z]

FossilOrigin-Name: b2816b4d6a2a526e50219aad6051627595ae3a02ef125b5026db6e33509efb0c
---

diff --git a/ext/fts3/fts3_snippet.c b/ext/fts3/fts3_snippet.c
index 9e35acb28b..1df0bc9cb3 100644
--- a/ext/fts3/fts3_snippet.c
+++ b/ext/fts3/fts3_snippet.c
@@ -613,8 +613,8 @@ static int fts3StringAppend(
   ** to grow the buffer until so that it is big enough to accommodate the
   ** appended data.
   */
-  if( pStr->n+nAppend+1>=pStr->nAlloc ){
-    sqlite3_int64 nAlloc = pStr->nAlloc+(sqlite3_int64)nAppend+100;
+  if( (i64)pStr->n+(i64)nAppend+1>=(i64)pStr->nAlloc ){
+    i64 nAlloc = pStr->nAlloc+(i64)nAppend+100;
     char *zNew = sqlite3_realloc64(pStr->z, nAlloc);
     if( !zNew ){
       return SQLITE_NOMEM;
diff --git a/manifest b/manifest
index 830dbb1238..f383ccb6c8 100644
--- a/manifest
+++ b/manifest
@@ -1,5 +1,5 @@
-C In\sext/wasm,\sadd\sthe\sability\sto\somit\sspecific\sJS\sAPIs\sand\sVFSes\sat\sbuild-time.
-D 2026-07-02T09:52:03.709
+C Avoid\san\sinteger\soverflow\sin\sthe\sstring\sallocator\sfor\sthe\ssnippet()\nfunction\sof\sFTS3/4,\swhen\sSQLITE_MAX_LENGTH\sis\sunusually\slarge.\n[bugs:/info/2026-07-03T18:34:04Z|Bug\s2026-07-03T18:34:04Z]
+D 2026-07-03T19:13:27.907
 F .fossil-settings/binary-glob 61195414528fb3ea9693577e1980230d78a1f8b0a54c78cf1b9b24d0a409ed6a x
 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
@@ -89,7 +89,7 @@ F ext/fts3/fts3_hash.c d9dba473741445789330c7513d4f65737c92df23c3212784312931641
 F ext/fts3/fts3_hash.h 39cf6874dc239d6b4e30479b1975fe5b22a3caaf
 F ext/fts3/fts3_icu.c 305ce7fb6036484085b5556a9c8e62acdc7763f0f4cdf5fd538212a9f3720116
 F ext/fts3/fts3_porter.c 024417020c57dd1ab39816f5fe6cf45222a857b78a1f6412f040ada1ceabd4ff
-F ext/fts3/fts3_snippet.c 004923c49dca8c711f83fd31d3abe2e663df174afeae096b1c902cc52fda2097
+F ext/fts3/fts3_snippet.c 268f9d21d7cbd5f71017663c3a8c222927ec0f0c3ce4643c13326c2b0512015d
 F ext/fts3/fts3_term.c 6a96027ad364001432545fe43322b6af04ed28bb5619ec51af1f59d0710d6d69
 F ext/fts3/fts3_test.c cc329471e573f95a6ea9fbca87e89dcfa1d355591c80172ffcd759ac521d25d8
 F ext/fts3/fts3_tokenize_vtab.c 66eba6c2baa04b2b15e80d68341b8fd0b4d3831f6b2edb33916a2906ff2d4389
@@ -2210,9 +2210,8 @@ F tool/warnings-clang.sh bbf6a1e685e534c92ec2bfba5b1745f34fb6f0bc2a362850723a9ee
 F tool/warnings.sh a554d13f6e5cf3760f041b87939e3d616ec6961859c3245e8ef701d1eafc2ca2
 F tool/win/sqlite.vsix deb315d026cc8400325c5863eef847784a219a2f
 F tool/winmain.c 00c8fb88e365c9017db14c73d3c78af62194d9644feaf60e220ab0f411f3604c
-P 88901fffcd445ccb97e4e379ea15d8b06d87b8170cad0f717c909944ff21851f 225dd27e147b46e85097ada7234a307f55842d98155cd36fe00da57744598bc3
-R d20cfce4969b948014d3a3d610a966ce
-T +closed 225dd27e147b46e85097ada7234a307f55842d98155cd36fe00da57744598bc3 Closed\sby\sintegrate-merge.
-U stephan
-Z 4776f4f7741018f2b4629b3adc43c7dd
+P 0d70a15c3b35e9af3052042cd5332db1b38a66416f1c3c8a50d342395bf22c01
+R 0163fb542a69e34ded5c853ce37b9cc4
+U drh
+Z f8aaab7abf4c8ac043cf95b768b0096d
 # Remove this line to create a well-formed Fossil manifest.
diff --git a/manifest.uuid b/manifest.uuid
index a089abfa64..e4bccfa9cf 100644
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-0d70a15c3b35e9af3052042cd5332db1b38a66416f1c3c8a50d342395bf22c01
+b2816b4d6a2a526e50219aad6051627595ae3a02ef125b5026db6e33509efb0c