From: dan <Dan Kennedy>
Date: Mon, 6 Jul 2026 14:37:08 +0000 (+0000)
Subject: Fix another buffer overread in RBU that could occur when processing an RBU database... 
X-Git-Url: http://git.ipfire.org/index.cgi?a=commitdiff_plain;h=70ca21fa464eb5406e7e8c8a7887b3b7d8edbe10;p=thirdparty%2Fsqlite.git

Fix another buffer overread in RBU that could occur when processing an RBU database with corrupt rbu_control fields. Bug [bugs:/info/2026-07-06T13:01:41Z | 2026-07-06T13:01:41Z].

FossilOrigin-Name: 46c2476b1074fb56c54068dcc04cac5a3b9da3a25bc0d3b95c00439e63d6ec43
---

diff --git a/ext/rbu/rbucorrupt.test b/ext/rbu/rbucorrupt.test
index 0f9841e638..f05b6d1dbb 100644
--- a/ext/rbu/rbucorrupt.test
+++ b/ext/rbu/rbucorrupt.test
@@ -14,6 +14,13 @@ source [file join [file dirname [info script]] rbu_common.tcl]
 if_no_rbu_support { finish_test ; return }
 set ::testprefix rbucorrupt
 
+catch {db close}
+sqlite3_shutdown
+sqlite3_config_lookaside 0 0
+sqlite3_initialize
+autoinstall_test_functions
+reset_db
+
 forcedelete rbu.db
 forcedelete state.db
 
@@ -57,5 +64,37 @@ do_test 1.4 {
   list [catch { rbu close } msg] $msg
 } {1 SQLITE_CORRUPT}
 
+#-------------------------------------------------------------------------
+reset_db
+forcedelete rbu.db
+forcedelete state.db
+
+do_test 2.0 {
+  for {set ii 0} {$ii<200} {incr ii} {
+    lappend cols "c$ii"
+  }
+  execsql "
+    CREATE TABLE t1(a INTEGER PRIMARY KEY, [join $cols ,]);
+    INSERT INTO t1(a, c0) VALUES(10, 100);
+  "
+} {}
+
+db close
+sqlite3 db rbu.db
+do_test 2.1 {
+  execsql "
+    CREATE TABLE data_t1(a INTEGER PRIMARY KEY, [join $cols ,], rbu_control);
+    INSERT INTO data_t1(a, c0, rbu_control) VALUES(10, 100, 'x');
+  "
+  db close
+} {}
+
+breakpoint
+do_test 2.2 {
+  sqlite3rbu rbu test.db rbu.db
+  while {[rbu step]=="SQLITE_OK"} {}
+  list [catch { rbu close } msg] $msg
+} {1 {SQLITE_ERROR - invalid rbu_control value}}
+
 
 finish_test
diff --git a/ext/rbu/sqlite3rbu.c b/ext/rbu/sqlite3rbu.c
index d55442b54a..85492b4b16 100644
--- a/ext/rbu/sqlite3rbu.c
+++ b/ext/rbu/sqlite3rbu.c
@@ -2662,13 +2662,13 @@ static int rbuGetUpdateStmt(
     char *zUpdate = 0;
 
     pUp->zMask = (char*)&pUp[1];
-    memcpy(pUp->zMask, zMask, pIter->nTblCol);
     pUp->pNext = pIter->pRbuUpdate;
     pIter->pRbuUpdate = pUp;
 
     if( zSet ){
       const char *zPrefix = "";
-
+      assert( p->rc==SQLITE_OK );
+      memcpy(pUp->zMask, zMask, pIter->nTblCol);
       if( pIter->eType!=RBU_PK_VTAB ) zPrefix = "rbu_imp_";
       zUpdate = sqlite3_mprintf("UPDATE \"%s%w\" SET %s WHERE %s", 
           zPrefix, pIter->zTbl, zSet, zWhere
diff --git a/manifest b/manifest
index f8471abc3b..9c88e53fd8 100644
--- a/manifest
+++ b/manifest
@@ -1,5 +1,5 @@
-C Fix\san\sOOB\sread\sthat\scould\soccur\sin\sRBU\swhen\susing\sa\sstate\sdb\swith\scorrupt\scontents.\sBug\s[bugs:/info/2026-07-06T13:02:00Z\s|\s2026-07-06T13:02:00Z].
-D 2026-07-06T14:10:43.203
+C Fix\sanother\sbuffer\soverread\sin\sRBU\sthat\scould\soccur\swhen\sprocessing\san\sRBU\sdatabase\swith\scorrupt\srbu_control\sfields.\sBug\s[bugs:/info/2026-07-06T13:01:41Z\s|\s2026-07-06T13:01:41Z].
+D 2026-07-06T14:37:08.207
 F .fossil-settings/binary-glob 61195414528fb3ea9693577e1980230d78a1f8b0a54c78cf1b9b24d0a409ed6a x
 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
@@ -446,7 +446,7 @@ F ext/rbu/rbuC.test 5326ea3954754c68fd518beb70d3e6b6690af53e1a5fa102d650e4110b26
 F ext/rbu/rbu_common.tcl 15d063397a89aeaf26b4cbdf6f29911b4154a902ba61a40c4f180ab452454a63
 F ext/rbu/rbubusy.test 88298187ad35aac9084436d85ca66b3722f96eaa704a09cfe5f931d452ab7237
 F ext/rbu/rbucollate.test 9852ec5e5ba7f3b04ce849a24ef7298e03ae0f16e58e6031d0f845234559feec
-F ext/rbu/rbucorrupt.test 289363dc1a66362368925cffce90d781dc8ac49f85943b2618027bf830bb9d7e
+F ext/rbu/rbucorrupt.test 0d308014dfb1b7ea97c4ac1e8ed3057fa843fdc7b054403ac72b14bd653a6ede
 F ext/rbu/rbucrash.test d2b5d619d9281c89cad74401b73b46172daa89906940b1d739c813ddc0cd2cf5
 F ext/rbu/rbucrash2.test 0a1a72223d880215ce2893a3260320c31a9358d23cb124c610e4f0d984a93285
 F ext/rbu/rbudiff.test 8b8b8b569c68fc880134e0fac4bf6b4b7a907aea4cc6eacf7e1d45e1d47b6aac
@@ -472,7 +472,7 @@ F ext/rbu/rbuvacuum.test e3585cfda220038e8186c583e9bd2aaa9eccd0a5c2e40ed861de3c9
 F ext/rbu/rbuvacuum2.test 1a9bd41f127be2826de2a65204df9118525a8af8d16e61e6bc63ba3ac0010a23
 F ext/rbu/rbuvacuum3.test 3ce42695fdf21aaa3499e857d7d4253bc499ad759bcd6c9362042c13cd37d8de
 F ext/rbu/rbuvacuum4.test ffccd22f67e2d0b380d2889685742159dfe0d19a3880ca3d2d1d69eefaebb205
-F ext/rbu/sqlite3rbu.c 3b99497c995eb19163bf4409dd95988859700778380bb07391998866a9aff94f
+F ext/rbu/sqlite3rbu.c 2c180aa33096156d9ee2886bbef43a8599aee58463d5a460cae8c0a61d7d412a
 F ext/rbu/sqlite3rbu.h e3a5bf21e09ca93ce4e8740e00d6a853e90a697968ec0ea98f40826938bdb68e
 F ext/rbu/test_rbu.c 8b6e64e486c28c41ef29f6f4ea6be7b3091958987812784904f5e903f6b56418
 F ext/recover/dbdata.c 10d3c56968a9af6853722a47280805ad1564714d79ea45ac6f7da14bb57fd137
@@ -2213,8 +2213,8 @@ F tool/warnings-clang.sh bbf6a1e685e534c92ec2bfba5b1745f34fb6f0bc2a362850723a9ee
 F tool/warnings.sh a554d13f6e5cf3760f041b87939e3d616ec6961859c3245e8ef701d1eafc2ca2
 F tool/win/sqlite.vsix deb315d026cc8400325c5863eef847784a219a2f
 F tool/winmain.c 00c8fb88e365c9017db14c73d3c78af62194d9644feaf60e220ab0f411f3604c
-P b1d7123bc619e3cb9dffa8dd52ba31cc18329b14557d8f2d9e547b729016548c
-R 5b00a3394e222b46e736bcc82bff1810
+P 9e54159f9a839f7fae3dee348fab862dc4bbe36ab866d0b3927f05fd10b1414a
+R f7f23e3a412609f598e3a3c195eea1ec
 U dan
-Z 5cf870c30bacf696146bc3c88c8044c7
+Z 5bd0e17709e68140593cef351f67a951
 # Remove this line to create a well-formed Fossil manifest.
diff --git a/manifest.uuid b/manifest.uuid
index 71c712cf21..ad328f59db 100644
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-9e54159f9a839f7fae3dee348fab862dc4bbe36ab866d0b3927f05fd10b1414a
+46c2476b1074fb56c54068dcc04cac5a3b9da3a25bc0d3b95c00439e63d6ec43