Many hyperlinks are disabled.
Use anonymous login
to enable hyperlinks.
Overview
| Comment: | Fix a potential crash that can occur while reading an index from a corrupt database file. The corruption is a record-header-size that is larger than 0x7fffffff. Problem detected by OSSFuzz against GDAL and reported to us (with a suggested fix) by Even Rouault. The test case is in TH3. |
|---|---|
| Downloads: | Tarball | ZIP archive |
| Timelines: | family | ancestors | descendants | both | trunk |
| Files: | files | file ages | folders |
| SHA3-256: |
8ac2cdda68f92b0352bc7f0b4be5fca4 |
| User & Date: | drh 2018-10-01 13:54:30.911 |
Context
|
2018-10-01
| ||
| 17:33 | Speed up xAccess() calls made on an RBU VFS when there are lots of open connections. (check-in: 310b4b65b8 user: dan tags: trunk) | |
| 17:15 | Bring the PRAGMA table_vinfo statement up to date with trunk. (check-in: 6f606f9923 user: drh tags: pragma-table-vinfo) | |
| 14:05 | Fix a potential crash that can occur while reading an index from a corrupt database file. The corruption is a record-header-size that is larger than 0x7fffffff. Problem detected by OSSFuzz against GDAL and reported to us (with a suggested fix) by Even Rouault. The test case is in TH3. (check-in: 5d29165896 user: drh tags: branch-3.25) | |
| 13:54 | Fix a potential crash that can occur while reading an index from a corrupt database file. The corruption is a record-header-size that is larger than 0x7fffffff. Problem detected by OSSFuzz against GDAL and reported to us (with a suggested fix) by Even Rouault. The test case is in TH3. (check-in: 8ac2cdda68 user: drh tags: trunk) | |
| 07:04 | Fix a problem with ALTER TABLE commands when the schema features an INSTEAD of trigger that uses NEW.* or OLD.*. (check-in: c52f457e56 user: dan tags: trunk) | |
Changes
Changes to src/vdbeaux.c.
| ︙ | ︙ | |||
4553 4554 4555 4556 4557 4558 4559 |
return rc;
}
/* The index entry must begin with a header size */
(void)getVarint32((u8*)m.z, szHdr);
testcase( szHdr==3 );
testcase( szHdr==m.n );
| > > | | 4553 4554 4555 4556 4557 4558 4559 4560 4561 4562 4563 4564 4565 4566 4567 4568 4569 |
return rc;
}
/* The index entry must begin with a header size */
(void)getVarint32((u8*)m.z, szHdr);
testcase( szHdr==3 );
testcase( szHdr==m.n );
testcase( szHdr>0x7fffffff );
assert( m.n>=0 );
if( unlikely(szHdr<3 || szHdr>(unsigned)m.n) ){
goto idx_rowid_corruption;
}
/* The last field of the index should be an integer - the ROWID.
** Verify that the last entry really is an integer. */
(void)getVarint32((u8*)&m.z[szHdr-1], typeRowid);
testcase( typeRowid==1 );
|
| ︙ | ︙ |