From: drh <>
Date: Mon, 6 Jul 2026 13:43:42 +0000 (+0000)
Subject: Avoid a (harmless) 1-byte OOB read due to malformed inputs in the
X-Git-Url: http://git.ipfire.org/index.cgi?a=commitdiff_plain;h=b113e8953794cc78ef55a565b5a72b09320073b0;p=thirdparty%2Fsqlite.git

Avoid a (harmless) 1-byte OOB read due to malformed inputs in the
normalize.c extension.
[bugs:/info/2026-07-06T13:02:37Z|Bug 2026-07-06T13:02:37Z]

FossilOrigin-Name: b1d7123bc619e3cb9dffa8dd52ba31cc18329b14557d8f2d9e547b729016548c
---

diff --git a/ext/misc/normalize.c b/ext/misc/normalize.c
index 44ddcd3882..d142f6776d 100644
--- a/ext/misc/normalize.c
+++ b/ext/misc/normalize.c
@@ -613,7 +613,7 @@ char *sqlite3_normalize(const char *zSql){
     int nParen;
     if( zIn==0 ) break;
     n = (int)(zIn-z)+3;  /* Index of first char past "in(" */
-    if( n && IdChar(zIn[-1]) ) continue;
+    if( n>3 && IdChar(zIn[-1]) ) continue;
     if( strncmp(zIn, "in(select",9)==0 && !IdChar(zIn[9]) ) continue;
     if( strncmp(zIn, "in(with",7)==0 && !IdChar(zIn[7]) ) continue;
     for(nParen=1, k=0; z[n+k]; k++){
diff --git a/manifest b/manifest
index 862bf22d93..403d0bc46b 100644
--- a/manifest
+++ b/manifest
@@ -1,5 +1,5 @@
-C Return\san\serror\sif\sa\spatchset\sis\spassed\sto\ssqlite3rebaser_configure().\sThis\swas\scausing\sa\sbuffer\soverread.
-D 2026-07-06T11:58:21.031
+C Avoid\sa\s(harmless)\s1-byte\sOOB\sread\sdue\sto\smalformed\sinputs\sin\sthe\nnormalize.c\sextension.\n[bugs:/info/2026-07-06T13:02:37Z|Bug\s2026-07-06T13:02:37Z]
+D 2026-07-06T13:43:42.286
 F .fossil-settings/binary-glob 61195414528fb3ea9693577e1980230d78a1f8b0a54c78cf1b9b24d0a409ed6a x
 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
@@ -387,7 +387,7 @@ F ext/misc/memtrace.c 7c0d115d2ef716ad0ba632c91e05bd119cb16c1aedf3bec9f06196ead2
 F ext/misc/mmapwarm.c a81af4aaec00f24f308e2f4c19bf1d88f3ac3ce848c36daa7a4cd38145c4080d
 F ext/misc/nextchar.c bb5bc64780c9ef4aa903b510249d0d37ec05a2f8faa5420bca71a6552cc1bd59
 F ext/misc/noop.c f1a21cc9b7a4e667e5c8458d80ba680b8bd4315a003f256006046879f679c5a0
-F ext/misc/normalize.c fbb144a861809686ff2b5b6eee8bb2e1207f9bf13ce7376e5273c700a1eafbd5
+F ext/misc/normalize.c 7f526ccf91b05f47c05eac6c147f0f9033d6c625f0260039518e582dc9c3cb7c
 F ext/misc/pcachetrace.c f4227ce03fb16aa8d6f321b72dd051097419d7a028a9853af048bee7645cb405
 F ext/misc/percentile.c b6b9c740f0dc42838efd776eec0f68a93bc5ac86524c71337a70950860bf6c4d
 F ext/misc/prefixes.c e7d3e7a39174db412c5f77c266fa221c2dc3cb2621a9422835a607ad08805eb2
@@ -2212,8 +2212,8 @@ F tool/warnings-clang.sh bbf6a1e685e534c92ec2bfba5b1745f34fb6f0bc2a362850723a9ee
 F tool/warnings.sh a554d13f6e5cf3760f041b87939e3d616ec6961859c3245e8ef701d1eafc2ca2
 F tool/win/sqlite.vsix deb315d026cc8400325c5863eef847784a219a2f
 F tool/winmain.c 00c8fb88e365c9017db14c73d3c78af62194d9644feaf60e220ab0f411f3604c
-P c56da4bba175cac55ea3f159520a583a8e4739dae77365ffe19e9ffcc5841804
-R d25b86b8076b580de02d8a6f70c15c11
-U dan
-Z 669a6641871f4bac158018ab7302b6de
+P 887a29a8373bc3a5405df2288840c4918c045560a3a1de5303a4984eb4b40b50
+R e4653407d0fe222d43bad82b5d39fd2c
+U drh
+Z 31bdf81708959ebdee36f8a70d682ac3
 # Remove this line to create a well-formed Fossil manifest.
diff --git a/manifest.uuid b/manifest.uuid
index 77e017d400..0c3f974736 100644
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-887a29a8373bc3a5405df2288840c4918c045560a3a1de5303a4984eb4b40b50
+b1d7123bc619e3cb9dffa8dd52ba31cc18329b14557d8f2d9e547b729016548c