Many hyperlinks are disabled.
Use anonymous login
to enable hyperlinks.
Overview
Comment: | Begin adding code to explicitly limit the size of strings and blobs. (CVS 3943) |
---|---|
Downloads: | Tarball | ZIP archive |
Timelines: | family | ancestors | descendants | both | trunk |
Files: | files | file ages | folders |
SHA1: |
031a5915b68ec6827fee38b8b9dc74a9 |
User & Date: | drh 2007-05-08 12:12:17.000 |
Context
2007-05-08
| ||
12:37 | Do not crash in the internal functions sqlite_rename_table() or sqlite_rename_trigger() if they are somehow passed unexpected input. (CVS 3944) (check-in: c2f90b465e user: danielk1977 tags: trunk) | |
12:12 | Begin adding code to explicitly limit the size of strings and blobs. (CVS 3943) (check-in: 031a5915b6 user: drh tags: trunk) | |
11:27 | Fix a bug in the test logic introduced by check-in (3928). (CVS 3942) (check-in: 47d1678d2d user: drh tags: trunk) | |
Changes
Changes to src/func.c.
︙ | ︙ | |||
12 13 14 15 16 17 18 | ** This file contains the C functions that implement various SQL ** functions of SQLite. ** ** There is only one exported symbol in this file - the function ** sqliteRegisterBuildinFunctions() found at the bottom of the file. ** All other code has file scope. ** | | | 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 | ** This file contains the C functions that implement various SQL ** functions of SQLite. ** ** There is only one exported symbol in this file - the function ** sqliteRegisterBuildinFunctions() found at the bottom of the file. ** All other code has file scope. ** ** $Id: func.c,v 1.147 2007/05/08 12:12:17 drh Exp $ */ #include "sqliteInt.h" #include <ctype.h> /* #include <math.h> */ #include <stdlib.h> #include <assert.h> #include "vdbeInt.h" |
︙ | ︙ | |||
152 153 154 155 156 157 158 | sqlite3_context *context, int argc, sqlite3_value **argv ){ const unsigned char *z; const unsigned char *z2; int i; | > | | 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 | sqlite3_context *context, int argc, sqlite3_value **argv ){ const unsigned char *z; const unsigned char *z2; int i; int len; i64 p1, p2; assert( argc==3 ); z = sqlite3_value_text(argv[0]); if( z==0 ) return; p1 = sqlite3_value_int(argv[1]); p2 = sqlite3_value_int(argv[2]); for(len=0, z2=z; *z2; z2++){ if( (0xc0&*z2)!=0x80 ) len++; } |
︙ | ︙ | |||
292 293 294 295 296 297 298 | int argc, sqlite3_value **argv ){ int n; unsigned char *p; assert( argc==1 ); n = sqlite3_value_int(argv[0]); | | > > > > > > | 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 | int argc, sqlite3_value **argv ){ int n; unsigned char *p; assert( argc==1 ); n = sqlite3_value_int(argv[0]); if( n<1 ){ n = 1; } if( n>SQLITE_MAX_LENGTH ){ sqlite3_result_error(context, "randomblob() too large", -1); return; } p = sqliteMalloc(n); if( p ){ sqlite3Randomness(n, p); sqlite3_result_blob(context, (char*)p, n, sqlite3FreeX); } } |
︙ | ︙ | |||
612 613 614 615 616 617 618 619 620 621 622 623 624 625 626 627 628 629 630 631 632 633 634 635 636 637 | break; } case SQLITE_BLOB: { char *zText = 0; int nBlob = sqlite3_value_bytes(argv[0]); char const *zBlob = sqlite3_value_blob(argv[0]); zText = (char *)sqliteMalloc((2*nBlob)+4); if( !zText ){ sqlite3_result_error(context, "out of memory", -1); }else{ int i; for(i=0; i<nBlob; i++){ zText[(i*2)+2] = hexdigits[(zBlob[i]>>4)&0x0F]; zText[(i*2)+3] = hexdigits[(zBlob[i])&0x0F]; } zText[(nBlob*2)+2] = '\''; zText[(nBlob*2)+3] = '\0'; zText[0] = 'X'; zText[1] = '\''; sqlite3_result_text(context, zText, -1, SQLITE_TRANSIENT); sqliteFree(zText); } break; } case SQLITE_TEXT: { | > > > > | > | > > > > | 619 620 621 622 623 624 625 626 627 628 629 630 631 632 633 634 635 636 637 638 639 640 641 642 643 644 645 646 647 648 649 650 651 652 653 654 655 656 657 658 659 660 661 662 663 664 665 666 | break; } case SQLITE_BLOB: { char *zText = 0; int nBlob = sqlite3_value_bytes(argv[0]); char const *zBlob = sqlite3_value_blob(argv[0]); if( 2*nBlob+4>SQLITE_MAX_LENGTH ){ sqlite3_result_error(context, "BLOB too big to quote", -1); return; } zText = (char *)sqliteMalloc((2*nBlob)+4); if( !zText ){ sqlite3_result_error(context, "out of memory", -1); }else{ int i; for(i=0; i<nBlob; i++){ zText[(i*2)+2] = hexdigits[(zBlob[i]>>4)&0x0F]; zText[(i*2)+3] = hexdigits[(zBlob[i])&0x0F]; } zText[(nBlob*2)+2] = '\''; zText[(nBlob*2)+3] = '\0'; zText[0] = 'X'; zText[1] = '\''; sqlite3_result_text(context, zText, -1, SQLITE_TRANSIENT); sqliteFree(zText); } break; } case SQLITE_TEXT: { int i,j; u64 n; const unsigned char *zArg = sqlite3_value_text(argv[0]); char *z; if( zArg==0 ) return; for(i=0, n=0; zArg[i]; i++){ if( zArg[i]=='\'' ) n++; } if( i+n+3>SQLITE_MAX_LENGTH ){ sqlite3_result_error(context, "string too big to quote", -1); return; } z = sqliteMalloc( i+n+3 ); if( z==0 ) return; z[0] = '\''; for(i=0, j=1; zArg[i]; i++){ z[j++] = zArg[i]; if( zArg[i]=='\'' ){ z[j++] = '\''; |
︙ | ︙ | |||
668 669 670 671 672 673 674 675 676 677 678 679 680 681 | sqlite3_value **argv ){ int i, n; const unsigned char *pBlob; char *zHex, *z; assert( argc==1 ); n = sqlite3_value_bytes(argv[0]); pBlob = sqlite3_value_blob(argv[0]); z = zHex = sqlite3_malloc(n*2 + 1); if( zHex==0 ) return; for(i=0; i<n; i++, pBlob++){ unsigned char c = *pBlob; *(z++) = hexdigits[(c>>4)&0xf]; *(z++) = hexdigits[c&0xf]; | > > > > | 684 685 686 687 688 689 690 691 692 693 694 695 696 697 698 699 700 701 | sqlite3_value **argv ){ int i, n; const unsigned char *pBlob; char *zHex, *z; assert( argc==1 ); n = sqlite3_value_bytes(argv[0]); if( n*2+1>SQLITE_MAX_LENGTH ){ sqlite3_result_error(context, "BLOB too big to convert to hex", -1); return; } pBlob = sqlite3_value_blob(argv[0]); z = zHex = sqlite3_malloc(n*2 + 1); if( zHex==0 ) return; for(i=0; i<n; i++, pBlob++){ unsigned char c = *pBlob; *(z++) = hexdigits[(c>>4)&0xf]; *(z++) = hexdigits[c&0xf]; |
︙ | ︙ |
Changes to src/main.c.
︙ | ︙ | |||
10 11 12 13 14 15 16 | ** ************************************************************************* ** Main file for the SQLite library. The routines in this file ** implement the programmer interface to the library. Routines in ** other files are for internal use by SQLite and should not be ** accessed by users of the library. ** | | | 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 | ** ************************************************************************* ** Main file for the SQLite library. The routines in this file ** implement the programmer interface to the library. Routines in ** other files are for internal use by SQLite and should not be ** accessed by users of the library. ** ** $Id: main.c,v 1.375 2007/05/08 12:12:17 drh Exp $ */ #include "sqliteInt.h" #include "os.h" #include <ctype.h> /* ** The version of the library |
︙ | ︙ | |||
266 267 268 269 270 271 272 273 274 275 276 277 278 279 | case SQLITE_INTERRUPT: z = "interrupted"; break; case SQLITE_IOERR: z = "disk I/O error"; break; case SQLITE_CORRUPT: z = "database disk image is malformed"; break; case SQLITE_FULL: z = "database or disk is full"; break; case SQLITE_CANTOPEN: z = "unable to open database file"; break; case SQLITE_EMPTY: z = "table contains no data"; break; case SQLITE_SCHEMA: z = "database schema has changed"; break; case SQLITE_CONSTRAINT: z = "constraint failed"; break; case SQLITE_MISMATCH: z = "datatype mismatch"; break; case SQLITE_MISUSE: z = "library routine called out of sequence";break; case SQLITE_NOLFS: z = "kernel lacks large file support"; break; case SQLITE_AUTH: z = "authorization denied"; break; case SQLITE_FORMAT: z = "auxiliary database format error"; break; case SQLITE_RANGE: z = "bind or column index out of range"; break; | > | 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 | case SQLITE_INTERRUPT: z = "interrupted"; break; case SQLITE_IOERR: z = "disk I/O error"; break; case SQLITE_CORRUPT: z = "database disk image is malformed"; break; case SQLITE_FULL: z = "database or disk is full"; break; case SQLITE_CANTOPEN: z = "unable to open database file"; break; case SQLITE_EMPTY: z = "table contains no data"; break; case SQLITE_SCHEMA: z = "database schema has changed"; break; case SQLITE_TOOBIG: z = "String or BLOB exceeded size limit"; break; case SQLITE_CONSTRAINT: z = "constraint failed"; break; case SQLITE_MISMATCH: z = "datatype mismatch"; break; case SQLITE_MISUSE: z = "library routine called out of sequence";break; case SQLITE_NOLFS: z = "kernel lacks large file support"; break; case SQLITE_AUTH: z = "authorization denied"; break; case SQLITE_FORMAT: z = "auxiliary database format error"; break; case SQLITE_RANGE: z = "bind or column index out of range"; break; |
︙ | ︙ |
Changes to src/vdbe.c.
︙ | ︙ | |||
39 40 41 42 43 44 45 | ** ** Various scripts scan this source file in order to generate HTML ** documentation, headers files, or other derived files. The formatting ** of the code in this file is, therefore, important. See other comments ** in this file for details. If in doubt, do not deviate from existing ** commenting and indentation practices when changing or adding code. ** | | | 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 | ** ** Various scripts scan this source file in order to generate HTML ** documentation, headers files, or other derived files. The formatting ** of the code in this file is, therefore, important. See other comments ** in this file for details. If in doubt, do not deviate from existing ** commenting and indentation practices when changing or adding code. ** ** $Id: vdbe.c,v 1.609 2007/05/08 12:12:17 drh Exp $ */ #include "sqliteInt.h" #include "os.h" #include <ctype.h> #include "vdbeInt.h" /* |
︙ | ︙ | |||
733 734 735 736 737 738 739 740 741 742 743 744 745 746 747 748 749 750 751 752 753 754 755 756 757 758 759 760 761 762 763 764 765 766 767 768 769 770 771 772 | ** P3 points to a nul terminated UTF-8 string. This opcode is transformed ** into an OP_String before it is executed for the first time. */ case OP_String8: { /* same as TK_STRING */ assert( pOp->p3!=0 ); pOp->opcode = OP_String; pOp->p1 = strlen(pOp->p3); #ifndef SQLITE_OMIT_UTF16 if( encoding!=SQLITE_UTF8 ){ pTos++; sqlite3VdbeMemSetStr(pTos, pOp->p3, -1, SQLITE_UTF8, SQLITE_STATIC); if( SQLITE_OK!=sqlite3VdbeChangeEncoding(pTos, encoding) ) goto no_mem; if( SQLITE_OK!=sqlite3VdbeMemDynamicify(pTos) ) goto no_mem; pTos->flags &= ~(MEM_Dyn); pTos->flags |= MEM_Static; if( pOp->p3type==P3_DYNAMIC ){ sqliteFree(pOp->p3); } pOp->p3type = P3_DYNAMIC; pOp->p3 = pTos->z; pOp->p1 = pTos->n; break; } #endif /* Otherwise fall through to the next case, OP_String */ } /* Opcode: String P1 * P3 ** ** The string value P3 of length P1 (bytes) is pushed onto the stack. */ case OP_String: { pTos++; assert( pOp->p3!=0 ); pTos->flags = MEM_Str|MEM_Static|MEM_Term; pTos->z = pOp->p3; pTos->n = pOp->p1; pTos->enc = encoding; break; | > > > > | 733 734 735 736 737 738 739 740 741 742 743 744 745 746 747 748 749 750 751 752 753 754 755 756 757 758 759 760 761 762 763 764 765 766 767 768 769 770 771 772 773 774 775 776 | ** P3 points to a nul terminated UTF-8 string. This opcode is transformed ** into an OP_String before it is executed for the first time. */ case OP_String8: { /* same as TK_STRING */ assert( pOp->p3!=0 ); pOp->opcode = OP_String; pOp->p1 = strlen(pOp->p3); assert( SQLITE_MAX_SQL_LENGTH < SQLITE_MAX_LENGTH ); assert( pOp->p1 < SQLITE_MAX_LENGTH ); #ifndef SQLITE_OMIT_UTF16 if( encoding!=SQLITE_UTF8 ){ pTos++; sqlite3VdbeMemSetStr(pTos, pOp->p3, -1, SQLITE_UTF8, SQLITE_STATIC); if( SQLITE_OK!=sqlite3VdbeChangeEncoding(pTos, encoding) ) goto no_mem; if( SQLITE_OK!=sqlite3VdbeMemDynamicify(pTos) ) goto no_mem; pTos->flags &= ~(MEM_Dyn); pTos->flags |= MEM_Static; if( pOp->p3type==P3_DYNAMIC ){ sqliteFree(pOp->p3); } pOp->p3type = P3_DYNAMIC; pOp->p3 = pTos->z; pOp->p1 = pTos->n; assert( pOp->p1 < SQLITE_MAX_LENGTH ); /* Due to SQLITE_MAX_SQL_LENGTH */ break; } #endif /* Otherwise fall through to the next case, OP_String */ } /* Opcode: String P1 * P3 ** ** The string value P3 of length P1 (bytes) is pushed onto the stack. */ case OP_String: { assert( pOp->p1 < SQLITE_MAX_LENGTH ); /* Due to SQLITE_MAX_SQL_LENGTH */ pTos++; assert( pOp->p3!=0 ); pTos->flags = MEM_Str|MEM_Static|MEM_Term; pTos->z = pOp->p3; pTos->n = pOp->p1; pTos->enc = encoding; break; |
︙ | ︙ | |||
792 793 794 795 796 797 798 799 800 801 802 803 804 805 | ** ** The first time this instruction executes, in transforms itself into a ** 'Blob' opcode with a binary blob as P3. */ case OP_HexBlob: { /* same as TK_BLOB */ pOp->opcode = OP_Blob; pOp->p1 = strlen(pOp->p3)/2; if( pOp->p1 ){ char *zBlob = sqlite3HexToBlob(pOp->p3); if( !zBlob ) goto no_mem; if( pOp->p3type==P3_DYNAMIC ){ sqliteFree(pOp->p3); } pOp->p3 = zBlob; | > > | 796 797 798 799 800 801 802 803 804 805 806 807 808 809 810 811 | ** ** The first time this instruction executes, in transforms itself into a ** 'Blob' opcode with a binary blob as P3. */ case OP_HexBlob: { /* same as TK_BLOB */ pOp->opcode = OP_Blob; pOp->p1 = strlen(pOp->p3)/2; assert( SQLITE_MAX_SQL_LENGTH < SQLITE_MAX_LENGTH ); assert( pOp->p1 < SQLITE_MAX_LENGTH ); if( pOp->p1 ){ char *zBlob = sqlite3HexToBlob(pOp->p3); if( !zBlob ) goto no_mem; if( pOp->p3type==P3_DYNAMIC ){ sqliteFree(pOp->p3); } pOp->p3 = zBlob; |
︙ | ︙ | |||
822 823 824 825 826 827 828 829 830 831 832 833 834 835 836 837 838 839 840 841 842 843 844 845 846 847 848 849 850 851 852 853 | ** by the compiler. Instead, the compiler layer specifies ** an OP_HexBlob opcode, with the hex string representation of ** the blob as P3. This opcode is transformed to an OP_Blob ** the first time it is executed. */ case OP_Blob: { pTos++; sqlite3VdbeMemSetStr(pTos, pOp->p3, pOp->p1, 0, 0); break; } #endif /* SQLITE_OMIT_BLOB_LITERAL */ /* Opcode: Variable P1 * * ** ** Push the value of variable P1 onto the stack. A variable is ** an unknown in the original SQL string as handed to sqlite3_compile(). ** Any occurance of the '?' character in the original SQL is considered ** a variable. Variables in the SQL string are number from left to ** right beginning with 1. The values of variables are set using the ** sqlite3_bind() API. */ case OP_Variable: { int j = pOp->p1 - 1; assert( j>=0 && j<p->nVar ); pTos++; sqlite3VdbeMemShallowCopy(pTos, &p->aVar[j], MEM_Static); break; } /* Opcode: Pop P1 * * ** | > > > > > > | 828 829 830 831 832 833 834 835 836 837 838 839 840 841 842 843 844 845 846 847 848 849 850 851 852 853 854 855 856 857 858 859 860 861 862 863 864 865 | ** by the compiler. Instead, the compiler layer specifies ** an OP_HexBlob opcode, with the hex string representation of ** the blob as P3. This opcode is transformed to an OP_Blob ** the first time it is executed. */ case OP_Blob: { pTos++; assert( pOp->p1 < SQLITE_MAX_LENGTH ); /* Due to SQLITE_MAX_SQL_LENGTH */ sqlite3VdbeMemSetStr(pTos, pOp->p3, pOp->p1, 0, 0); break; } #endif /* SQLITE_OMIT_BLOB_LITERAL */ /* Opcode: Variable P1 * * ** ** Push the value of variable P1 onto the stack. A variable is ** an unknown in the original SQL string as handed to sqlite3_compile(). ** Any occurance of the '?' character in the original SQL is considered ** a variable. Variables in the SQL string are number from left to ** right beginning with 1. The values of variables are set using the ** sqlite3_bind() API. */ case OP_Variable: { int j = pOp->p1 - 1; Mem *pVar; assert( j>=0 && j<p->nVar ); pVar = &p->aVar[j]; if( sqlite3VdbeMemTooBig(pVar) ){ goto too_big; } pTos++; sqlite3VdbeMemShallowCopy(pTos, &p->aVar[j], MEM_Static); break; } /* Opcode: Pop P1 * * ** |
︙ | ︙ | |||
994 995 996 997 998 999 1000 | ** any element of the stack is NULL, then the result is NULL. ** ** When P1==1, this routine makes a copy of the top stack element ** into memory obtained from sqliteMalloc(). */ case OP_Concat: { /* same as TK_CONCAT */ char *zNew; | | | 1006 1007 1008 1009 1010 1011 1012 1013 1014 1015 1016 1017 1018 1019 1020 | ** any element of the stack is NULL, then the result is NULL. ** ** When P1==1, this routine makes a copy of the top stack element ** into memory obtained from sqliteMalloc(). */ case OP_Concat: { /* same as TK_CONCAT */ char *zNew; i64 nByte; int nField; int i, j; Mem *pTerm; /* Loop through the stack elements to see how long the result will be. */ nField = pOp->p1 + 2; pTerm = &pTos[1-nField]; |
︙ | ︙ | |||
1027 1028 1029 1030 1031 1032 1033 1034 1035 1036 1037 1038 1039 1040 | } pTos++; pTos->flags = MEM_Null; }else{ /* Otherwise malloc() space for the result and concatenate all the ** stack values. */ zNew = sqliteMallocRaw( nByte+2 ); if( zNew==0 ) goto no_mem; j = 0; pTerm = &pTos[1-nField]; for(i=j=0; i<nField; i++, pTerm++){ int n = pTerm->n; assert( pTerm->flags & (MEM_Str|MEM_Blob) ); | > > > | 1039 1040 1041 1042 1043 1044 1045 1046 1047 1048 1049 1050 1051 1052 1053 1054 1055 | } pTos++; pTos->flags = MEM_Null; }else{ /* Otherwise malloc() space for the result and concatenate all the ** stack values. */ if( nByte+2>SQLITE_MAX_LENGTH ){ goto too_big; } zNew = sqliteMallocRaw( nByte+2 ); if( zNew==0 ) goto no_mem; j = 0; pTerm = &pTos[1-nField]; for(i=j=0; i<nField; i++, pTerm++){ int n = pTerm->n; assert( pTerm->flags & (MEM_Str|MEM_Blob) ); |
︙ | ︙ | |||
1270 1271 1272 1273 1274 1275 1276 1277 1278 1279 1280 1281 1282 1283 | } /* Copy the result of the function to the top of the stack */ sqlite3VdbeChangeEncoding(&ctx.s, encoding); pTos++; pTos->flags = 0; sqlite3VdbeMemMove(pTos, &ctx.s); break; } /* Opcode: BitAnd * * * ** ** Pop the top two elements from the stack. Convert both elements ** to integers. Push back onto the stack the bit-wise AND of the | > > > | 1285 1286 1287 1288 1289 1290 1291 1292 1293 1294 1295 1296 1297 1298 1299 1300 1301 | } /* Copy the result of the function to the top of the stack */ sqlite3VdbeChangeEncoding(&ctx.s, encoding); pTos++; pTos->flags = 0; sqlite3VdbeMemMove(pTos, &ctx.s); if( sqlite3VdbeMemTooBig(pTos) ){ goto too_big; } break; } /* Opcode: BitAnd * * * ** ** Pop the top two elements from the stack. Convert both elements ** to integers. Push back onto the stack the bit-wise AND of the |
︙ | ︙ | |||
1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 2011 2012 | } /* If payloadSize is 0, then just push a NULL onto the stack. */ if( payloadSize==0 ){ assert( pTos->flags==MEM_Null ); break; } assert( p2<nField ); /* Read and parse the table header. Store the results of the parse ** into the record header cache fields of the cursor. */ if( pC && pC->cacheStatus==p->cacheCtr ){ | > > > | 2017 2018 2019 2020 2021 2022 2023 2024 2025 2026 2027 2028 2029 2030 2031 2032 2033 | } /* If payloadSize is 0, then just push a NULL onto the stack. */ if( payloadSize==0 ){ assert( pTos->flags==MEM_Null ); break; } if( payloadSize>SQLITE_MAX_LENGTH ){ goto too_big; } assert( p2<nField ); /* Read and parse the table header. Store the results of the parse ** into the record header cache fields of the cursor. */ if( pC && pC->cacheStatus==p->cacheCtr ){ |
︙ | ︙ | |||
2207 2208 2209 2210 2211 2212 2213 | ** corresponding data element (see sqlite3VdbeSerialType()). The ** hdr-size field is also a varint which is the offset from the beginning ** of the record to data0. */ u8 *zNewRecord; /* A buffer to hold the data for the new record */ Mem *pRec; /* The new record */ Mem *pRowid = 0; /* Rowid appended to the new record */ | | | | 2228 2229 2230 2231 2232 2233 2234 2235 2236 2237 2238 2239 2240 2241 2242 2243 2244 | ** corresponding data element (see sqlite3VdbeSerialType()). The ** hdr-size field is also a varint which is the offset from the beginning ** of the record to data0. */ u8 *zNewRecord; /* A buffer to hold the data for the new record */ Mem *pRec; /* The new record */ Mem *pRowid = 0; /* Rowid appended to the new record */ u64 nData = 0; /* Number of bytes of data space */ int nHdr = 0; /* Number of bytes of header space */ u64 nByte = 0; /* Data space required for this record */ int nZero = 0; /* Number of zero bytes at the end of the record */ int nVarint; /* Number of bytes in a varint */ u32 serial_type; /* Type field */ int containsNull = 0; /* True if any of the data fields are NULL */ Mem *pData0; /* Bottom of the stack */ int leaveOnStack; /* If true, leave the entries on the stack */ int nField; /* Number of fields in the record */ |
︙ | ︙ | |||
2280 2281 2282 2283 2284 2285 2286 2287 2288 2289 2290 2291 2292 2293 | /* Add the initial header varint and total the size */ nHdr += nVarint = sqlite3VarintLen(nHdr); if( nVarint<sqlite3VarintLen(nHdr) ){ nHdr++; } nByte = nHdr+nData-nZero; /* Allocate space for the new record. */ if( nByte>sizeof(zTemp) ){ zNewRecord = sqliteMallocRaw(nByte); if( !zNewRecord ){ goto no_mem; } | > > > | 2301 2302 2303 2304 2305 2306 2307 2308 2309 2310 2311 2312 2313 2314 2315 2316 2317 | /* Add the initial header varint and total the size */ nHdr += nVarint = sqlite3VarintLen(nHdr); if( nVarint<sqlite3VarintLen(nHdr) ){ nHdr++; } nByte = nHdr+nData-nZero; if( nByte>SQLITE_MAX_LENGTH ){ goto too_big; } /* Allocate space for the new record. */ if( nByte>sizeof(zTemp) ){ zNewRecord = sqliteMallocRaw(nByte); if( !zNewRecord ){ goto no_mem; } |
︙ | ︙ | |||
3553 3554 3555 3556 3557 3558 3559 3560 3561 3562 3563 3564 3565 3566 3567 3568 3569 3570 3571 3572 3573 3574 3575 3576 3577 3578 3579 3580 3581 3582 3583 3584 3585 3586 3587 3588 | if( pC->nullRow ){ pTos->flags = MEM_Null; break; }else if( pC->isIndex ){ i64 n64; assert( !pC->isTable ); sqlite3BtreeKeySize(pCrsr, &n64); n = n64; }else{ sqlite3BtreeDataSize(pCrsr, &n); } pTos->n = n; if( n<=NBFS ){ pTos->flags = MEM_Blob | MEM_Short; pTos->z = pTos->zShort; }else{ char *z = sqliteMallocRaw( n ); if( z==0 ) goto no_mem; pTos->flags = MEM_Blob | MEM_Dyn; pTos->xDel = 0; pTos->z = z; } if( pC->isIndex ){ rc = sqlite3BtreeKey(pCrsr, 0, n, pTos->z); }else{ rc = sqlite3BtreeData(pCrsr, 0, n, pTos->z); } }else if( pC->pseudoTable ){ pTos->n = pC->nData; pTos->z = pC->pData; pTos->flags = MEM_Blob|MEM_Ephem; }else{ pTos->flags = MEM_Null; } pTos->enc = SQLITE_UTF8; /* In case the blob is ever cast to text */ break; | > > > > > > > | 3577 3578 3579 3580 3581 3582 3583 3584 3585 3586 3587 3588 3589 3590 3591 3592 3593 3594 3595 3596 3597 3598 3599 3600 3601 3602 3603 3604 3605 3606 3607 3608 3609 3610 3611 3612 3613 3614 3615 3616 3617 3618 3619 | if( pC->nullRow ){ pTos->flags = MEM_Null; break; }else if( pC->isIndex ){ i64 n64; assert( !pC->isTable ); sqlite3BtreeKeySize(pCrsr, &n64); if( n64>SQLITE_MAX_LENGTH ){ goto too_big; } n = n64; }else{ sqlite3BtreeDataSize(pCrsr, &n); } if( n>SQLITE_MAX_LENGTH ){ goto too_big; } pTos->n = n; if( n<=NBFS ){ pTos->flags = MEM_Blob | MEM_Short; pTos->z = pTos->zShort; }else{ char *z = sqliteMallocRaw( n ); if( z==0 ) goto no_mem; pTos->flags = MEM_Blob | MEM_Dyn; pTos->xDel = 0; pTos->z = z; } if( pC->isIndex ){ rc = sqlite3BtreeKey(pCrsr, 0, n, pTos->z); }else{ rc = sqlite3BtreeData(pCrsr, 0, n, pTos->z); } }else if( pC->pseudoTable ){ pTos->n = pC->nData; assert( pC->nData<=SQLITE_MAX_LENGTH ); pTos->z = pC->pData; pTos->flags = MEM_Blob|MEM_Ephem; }else{ pTos->flags = MEM_Null; } pTos->enc = SQLITE_UTF8; /* In case the blob is ever cast to text */ break; |
︙ | ︙ | |||
4576 4577 4578 4579 4580 4581 4582 4583 4584 4585 4586 4587 4588 4589 | assert( pOp->p1>=0 && pOp->p1<p->nMem ); pMem = &p->aMem[pOp->p1]; assert( (pMem->flags & ~(MEM_Null|MEM_Agg))==0 ); rc = sqlite3VdbeMemFinalize(pMem, (FuncDef*)pOp->p3); if( rc==SQLITE_ERROR ){ sqlite3SetString(&p->zErrMsg, sqlite3_value_text(pMem), (char*)0); } break; } #if !defined(SQLITE_OMIT_VACUUM) && !defined(SQLITE_OMIT_ATTACH) /* Opcode: Vacuum * * * ** | > > > | 4607 4608 4609 4610 4611 4612 4613 4614 4615 4616 4617 4618 4619 4620 4621 4622 4623 | assert( pOp->p1>=0 && pOp->p1<p->nMem ); pMem = &p->aMem[pOp->p1]; assert( (pMem->flags & ~(MEM_Null|MEM_Agg))==0 ); rc = sqlite3VdbeMemFinalize(pMem, (FuncDef*)pOp->p3); if( rc==SQLITE_ERROR ){ sqlite3SetString(&p->zErrMsg, sqlite3_value_text(pMem), (char*)0); } if( sqlite3VdbeMemTooBig(pMem) ){ goto too_big; } break; } #if !defined(SQLITE_OMIT_VACUUM) && !defined(SQLITE_OMIT_ATTACH) /* Opcode: Vacuum * * * ** |
︙ | ︙ | |||
4868 4869 4870 4871 4872 4873 4874 | ** dynamic allocation in sContext.s (a Mem struct) is released. */ sqlite3VdbeChangeEncoding(&sContext.s, encoding); pTos++; pTos->flags = 0; sqlite3VdbeMemMove(pTos, &sContext.s); | | > > > > > | 4902 4903 4904 4905 4906 4907 4908 4909 4910 4911 4912 4913 4914 4915 4916 4917 4918 4919 4920 4921 | ** dynamic allocation in sContext.s (a Mem struct) is released. */ sqlite3VdbeChangeEncoding(&sContext.s, encoding); pTos++; pTos->flags = 0; sqlite3VdbeMemMove(pTos, &sContext.s); if( sqlite3SafetyOn(db) ){ goto abort_due_to_misuse; } if( sqlite3VdbeMemTooBig(pTos) ){ goto too_big; } } break; } #endif /* SQLITE_OMIT_VIRTUALTABLE */ #ifndef SQLITE_OMIT_VIRTUALTABLE |
︙ | ︙ | |||
5028 5029 5030 5031 5032 5033 5034 5035 5036 5037 5038 5039 5040 5041 | /* Sanity checking on the top element of the stack. If the previous ** instruction was VNoChange, then the flags field of the top ** of the stack is set to 0. This is technically invalid for a memory ** cell, so avoid calling MemSanity() in this case. */ if( pTos>=p->aStack && pTos->flags ){ sqlite3VdbeMemSanity(pTos); } assert( pc>=-1 && pc<p->nOp ); #ifdef SQLITE_DEBUG /* Code for tracing the vdbe stack. */ if( p->trace && pTos>=p->aStack ){ int i; | > | 5067 5068 5069 5070 5071 5072 5073 5074 5075 5076 5077 5078 5079 5080 5081 | /* Sanity checking on the top element of the stack. If the previous ** instruction was VNoChange, then the flags field of the top ** of the stack is set to 0. This is technically invalid for a memory ** cell, so avoid calling MemSanity() in this case. */ if( pTos>=p->aStack && pTos->flags ){ sqlite3VdbeMemSanity(pTos); assert( !sqlite3VdbeMemTooBig(pTos) ); } assert( pc>=-1 && pc<p->nOp ); #ifdef SQLITE_DEBUG /* Code for tracing the vdbe stack. */ if( p->trace && pTos>=p->aStack ){ int i; |
︙ | ︙ | |||
5071 5072 5073 5074 5075 5076 5077 5078 5079 5080 5081 5082 5083 5084 | rc = SQLITE_ERROR; }else{ rc = SQLITE_DONE; } sqlite3VdbeHalt(p); p->pTos = pTos; return rc; /* Jump to here if a malloc() fails. It's hard to get a malloc() ** to fail on a modern VM computer, so this code is untested. */ no_mem: sqlite3SetString(&p->zErrMsg, "out of memory", (char*)0); rc = SQLITE_NOMEM; | > > > > > > > > | 5111 5112 5113 5114 5115 5116 5117 5118 5119 5120 5121 5122 5123 5124 5125 5126 5127 5128 5129 5130 5131 5132 | rc = SQLITE_ERROR; }else{ rc = SQLITE_DONE; } sqlite3VdbeHalt(p); p->pTos = pTos; return rc; /* Jump to here if a string or blob larger than SQLITE_MAX_LENGTH ** is encountered. */ too_big: sqlite3SetString(&p->zErrMsg, "string or blob too big", (char*)0); rc = SQLITE_TOOBIG; goto vdbe_halt; /* Jump to here if a malloc() fails. It's hard to get a malloc() ** to fail on a modern VM computer, so this code is untested. */ no_mem: sqlite3SetString(&p->zErrMsg, "out of memory", (char*)0); rc = SQLITE_NOMEM; |
︙ | ︙ |
Changes to src/vdbeInt.h.
︙ | ︙ | |||
374 375 376 377 378 379 380 381 382 383 384 385 386 387 | int sqlite3MemCompare(const Mem*, const Mem*, const CollSeq*); int sqlite3VdbeRecordCompare(void*,int,const void*,int, const void*); int sqlite3VdbeIdxRowidLen(const u8*); int sqlite3VdbeExec(Vdbe*); int sqlite3VdbeList(Vdbe*); int sqlite3VdbeHalt(Vdbe*); int sqlite3VdbeChangeEncoding(Mem *, int); int sqlite3VdbeMemCopy(Mem*, const Mem*); void sqlite3VdbeMemShallowCopy(Mem*, const Mem*, int); int sqlite3VdbeMemMove(Mem*, Mem*); int sqlite3VdbeMemNulTerminate(Mem*); int sqlite3VdbeMemSetStr(Mem*, const char*, int, u8, void(*)(void*)); void sqlite3VdbeMemSetInt64(Mem*, i64); void sqlite3VdbeMemSetDouble(Mem*, double); | > | 374 375 376 377 378 379 380 381 382 383 384 385 386 387 388 | int sqlite3MemCompare(const Mem*, const Mem*, const CollSeq*); int sqlite3VdbeRecordCompare(void*,int,const void*,int, const void*); int sqlite3VdbeIdxRowidLen(const u8*); int sqlite3VdbeExec(Vdbe*); int sqlite3VdbeList(Vdbe*); int sqlite3VdbeHalt(Vdbe*); int sqlite3VdbeChangeEncoding(Mem *, int); int sqlite3VdbeMemTooBig(Mem*); int sqlite3VdbeMemCopy(Mem*, const Mem*); void sqlite3VdbeMemShallowCopy(Mem*, const Mem*, int); int sqlite3VdbeMemMove(Mem*, Mem*); int sqlite3VdbeMemNulTerminate(Mem*); int sqlite3VdbeMemSetStr(Mem*, const char*, int, u8, void(*)(void*)); void sqlite3VdbeMemSetInt64(Mem*, i64); void sqlite3VdbeMemSetDouble(Mem*, double); |
︙ | ︙ |
Changes to src/vdbemem.c.
︙ | ︙ | |||
405 406 407 408 409 410 411 412 413 414 415 416 417 418 | */ void sqlite3VdbeMemSetDouble(Mem *pMem, double val){ sqlite3VdbeMemRelease(pMem); pMem->r = val; pMem->flags = MEM_Real; pMem->type = SQLITE_FLOAT; } /* ** Make an shallow copy of pFrom into pTo. Prior contents of ** pTo are overwritten. The pFrom->z field is not duplicated. If ** pFrom->z is used, then pTo->z points to the same thing as pFrom->z ** and flags gets srcType (either MEM_Ephem or MEM_Static). */ | > > > > > > > > > > > > > > > | 405 406 407 408 409 410 411 412 413 414 415 416 417 418 419 420 421 422 423 424 425 426 427 428 429 430 431 432 433 | */ void sqlite3VdbeMemSetDouble(Mem *pMem, double val){ sqlite3VdbeMemRelease(pMem); pMem->r = val; pMem->flags = MEM_Real; pMem->type = SQLITE_FLOAT; } /* ** Return true if the Mem object contains a TEXT or BLOB that is ** too large - whose size exceeds SQLITE_MAX_LENGTH. */ int sqlite3VdbeMemTooBig(Mem *p){ if( p->flags & (MEM_Str|MEM_Blob) ){ int n = p->n; if( p->flags & MEM_Zero ){ n += p->u.i; } return n>SQLITE_MAX_LENGTH; } return 0; } /* ** Make an shallow copy of pFrom into pTo. Prior contents of ** pTo are overwritten. The pFrom->z field is not duplicated. If ** pFrom->z is used, then pTo->z points to the same thing as pFrom->z ** and flags gets srcType (either MEM_Ephem or MEM_Static). */ |
︙ | ︙ |