From: dan <Dan Kennedy>
Date: Mon, 6 Jul 2026 11:58:21 +0000 (+0000)
Subject: Return an error if a patchset is passed to sqlite3rebaser_configure(). This was causi... 
X-Git-Url: http://git.ipfire.org/index.cgi?a=commitdiff_plain;h=711af3d328a241ee6b02ed464fb5926220182d7f;p=thirdparty%2Fsqlite.git

Return an error if a patchset is passed to sqlite3rebaser_configure(). This was causing a buffer overread.

FossilOrigin-Name: 887a29a8373bc3a5405df2288840c4918c045560a3a1de5303a4984eb4b40b50
---

diff --git a/ext/session/sessionrebase2.test b/ext/session/sessionrebase2.test
index 8e34a3dcd0..be42ece12c 100644
--- a/ext/session/sessionrebase2.test
+++ b/ext/session/sessionrebase2.test
@@ -37,4 +37,25 @@ do_test 1.0 {
   R delete
 } {}
 
+#-------------------------------------------------------------------------
+# Ensure that is an error to pass a patchset to sqlite3rebase_configure().
+#
+set input "0000ff0021"
+set rebaser [string map {{ } {}} \
+  "5003030000 7400 0921 010000000d00490006"
+]
+
+set I [db one {SELECT unhex($input)}]
+set R [db one {SELECT unhex($rebaser)}]
+
+do_test 2.0 {
+  sqlite3rebaser_create R
+  list [catch { R configure $R } msg] $msg
+} {1 SQLITE_ERROR}
+
+do_test 2.1 {
+  set I2 [R rebase $I]
+  R delete
+} {}
+
 finish_test
diff --git a/ext/session/sqlite3session.c b/ext/session/sqlite3session.c
index 10b97a8d52..00f96cc92b 100644
--- a/ext/session/sqlite3session.c
+++ b/ext/session/sqlite3session.c
@@ -6563,7 +6563,12 @@ static int sessionChangesetToHash(
 
   pIter->in.bNoDiscard = 1;
   while( SQLITE_ROW==(sessionChangesetNext(pIter, &aRec, &nRec, 0)) ){
-    rc = sessionOneChangeIterToHash(pGrp, pIter, bRebase);
+    if( bRebase && pIter->bPatchset ){
+      /* A patchset may not be used as a rebase */
+      rc = SQLITE_ERROR;
+    }else{
+      rc = sessionOneChangeIterToHash(pGrp, pIter, bRebase);
+    }
     if( rc!=SQLITE_OK ) break;
   }
 
@@ -7148,8 +7153,8 @@ int sqlite3rebaser_configure(
   sqlite3_rebaser *p, 
   int nRebase, const void *pRebase
 ){
-  sqlite3_changeset_iter *pIter = 0;   /* Iterator opened on pData/nData */
   int rc;                              /* Return code */
+  sqlite3_changeset_iter *pIter = 0;   /* Iterator opened on pData/nData */
   rc = sqlite3changeset_start(&pIter, nRebase, (void*)pRebase);
   if( rc==SQLITE_OK ){
     rc = sessionChangesetToHash(pIter, &p->grp, 1);
diff --git a/ext/session/test_session.c b/ext/session/test_session.c
index f985e9cd47..40680ead74 100644
--- a/ext/session/test_session.c
+++ b/ext/session/test_session.c
@@ -1340,8 +1340,9 @@ static int SQLITE_TCLAPI test_rebaser_cmd(
   switch( iSub ){
     case 0: {   /* configure */
       Tcl_Size nRebase = 0;
-      unsigned char *pRebase = Tcl_GetByteArrayFromObj(objv[2], &nRebase);
+      unsigned char *pRebase = testGetByteArrayFromObj(objv[2], &nRebase);
       rc = sqlite3rebaser_configure(p, (int)nRebase, pRebase);
+      free(pRebase);
       break;
     }
 
@@ -1504,7 +1505,7 @@ static int SQLITE_TCLAPI test_changeset(
     Tcl_WrongNumArgs(interp, 1, objv, "CHANGESET");
     return TCL_ERROR;
   }
-  pChangeset = (void *)Tcl_GetByteArrayFromObj(objv[1], &nChangeset);
+  pChangeset = (void*)testGetByteArrayFromObj(objv[1], &nChangeset);
 
   Tcl_ResetResult(interp);
   rc = sqlite3_test_changeset((int)nChangeset, pChangeset, &z);
@@ -1514,6 +1515,7 @@ static int SQLITE_TCLAPI test_changeset(
     sqlite3_free(zErr);
   }
   sqlite3_free(z);
+  free(pChangeset);
 
   return rc ? TCL_ERROR : TCL_OK;
 }
diff --git a/manifest b/manifest
index 55ed91e360..862bf22d93 100644
--- a/manifest
+++ b/manifest
@@ -1,5 +1,5 @@
-C In\sthe\sstrdup.c\sexpension,\sdo\snot\sinvoke\smemcpy()\swith\sa\sNULL\spointer\neven\sif\sthe\scount\sis\szero.
-D 2026-07-06T11:34:46.416
+C Return\san\serror\sif\sa\spatchset\sis\spassed\sto\ssqlite3rebaser_configure().\sThis\swas\scausing\sa\sbuffer\soverread.
+D 2026-07-06T11:58:21.031
 F .fossil-settings/binary-glob 61195414528fb3ea9693577e1980230d78a1f8b0a54c78cf1b9b24d0a409ed6a x
 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
@@ -573,14 +573,14 @@ F ext/session/sessionnoact.test 2cf060c12a7a23e663f0ec796561e58638c5c10a846653d3
 F ext/session/sessionnoop.test a9366a36a95ef85f8a3687856ebef46983df399541174cb1ede2ee53b8011bc7
 F ext/session/sessionnoop2.test 2d8146321785bdc7cee8966d984560184cfca83fd46da2ff81ea883d6e977b36
 F ext/session/sessionrebase.test 702378bdcb5062f1106e74457beca8797d09c113a81768734a58b197b5b334e2
-F ext/session/sessionrebase2.test 138697941ea23ab5a3f9960b58efcfdfed343a3c0fe9de8461f9439b7aac6998
+F ext/session/sessionrebase2.test b3c9ca8f40290d9bca97beec6f985d8e56fee80328ea639ee0a0104275a9b4a9
 F ext/session/sessionrowid.test 85187c2f1b38861a5844868126f69f9ec62223a03449a98a80600a44396f7363
 F ext/session/sessionsize.test 8fcf4685993c3dbaa46a24183940ab9f5aa9ed0d23e5fb63bfffbdb56134b795
 F ext/session/sessionstat1.test 5e718d5888c0c49bbb33a7a4f816366db85f59f6a4f97544a806421b85dc2dec
 F ext/session/sessionwor.test 6fd9a2256442cebde5b2284936ae9e0d54bde692d0f5fd009ecef8511f4cf3fc
-F ext/session/sqlite3session.c eea6e55a4353262ec7b23833d7cf4947c0264283ea75b6ddc80b46f2d0165cfe
+F ext/session/sqlite3session.c 673a2c71a3e1fc909301ed15daa30485d774419d015eb7688c79396e6cba6378
 F ext/session/sqlite3session.h ca7c4422c1514a95056cc8d333217df6b1829d39058126b1de85d10cd62d7a9c
-F ext/session/test_session.c d3275da24b8d362e3c2b393c00d5248f75f1cd474dadf29d8c4683f75cb52e6d
+F ext/session/test_session.c f465f13c661919f8ba4485a9d0690c4df5bff1cc79e962cfdafa9ff376d5119f
 F ext/wasm/GNUmakefile 92936a75dc15057dae3a87d96fe8282b22e663edb139852551da9179b437f1b3
 F ext/wasm/README-dist.txt f01081a850ce38a56706af6b481e3a7878e24e42b314cfcd4b129f0f8427066a
 F ext/wasm/README.md 2e87804e12c98f1d194b7a06162a88441d33bb443efcfe00dc6565a780d2f259
@@ -2212,8 +2212,8 @@ F tool/warnings-clang.sh bbf6a1e685e534c92ec2bfba5b1745f34fb6f0bc2a362850723a9ee
 F tool/warnings.sh a554d13f6e5cf3760f041b87939e3d616ec6961859c3245e8ef701d1eafc2ca2
 F tool/win/sqlite.vsix deb315d026cc8400325c5863eef847784a219a2f
 F tool/winmain.c 00c8fb88e365c9017db14c73d3c78af62194d9644feaf60e220ab0f411f3604c
-P ea26bf3cd7fb1116a8a25e767c54a49ca153c29e243b68e523d79120c5832b1d
-R e35c08b3b8e5e545c4cd96dec893c304
-U drh
-Z 9e7a6b8e5db3a42d7ce8732766583f42
+P c56da4bba175cac55ea3f159520a583a8e4739dae77365ffe19e9ffcc5841804
+R d25b86b8076b580de02d8a6f70c15c11
+U dan
+Z 669a6641871f4bac158018ab7302b6de
 # Remove this line to create a well-formed Fossil manifest.
diff --git a/manifest.uuid b/manifest.uuid
index 49fbf90a03..77e017d400 100644
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-c56da4bba175cac55ea3f159520a583a8e4739dae77365ffe19e9ffcc5841804
+887a29a8373bc3a5405df2288840c4918c045560a3a1de5303a4984eb4b40b50