Merge 26118 - Fix a crasher in full text search (sqlite)...

third_party/sqlite/ext/fts2/fts2.c

 /* fts2 has a design flaw which can lead to database corruption (see
 ** below).  It is recommended not to use it any longer, instead use
 ** fts3 (or higher).  If you believe that your use of fts2 is safe,
 ** add -DSQLITE_ENABLE_BROKEN_FTS2=1 to your CFLAGS.
 */
 #if (!defined(SQLITE_CORE) || defined(SQLITE_ENABLE_FTS2)) \
         && !defined(SQLITE_ENABLE_BROKEN_FTS2)
 #error fts2 has a design flaw and has been deprecated.
 #endif
 /* The flaw is that fts2 uses the content table's unaliased rowid as
@@ skipping 1820 matching lines @@
   /* CONTENT_EXISTS */ "select rowid from %_content limit 1",
 
   /* BLOCK_INSERT */ "insert into %_segments values (?)",
   /* BLOCK_SELECT */ "select block from %_segments where rowid = ?",
   /* BLOCK_DELETE */ "delete from %_segments where rowid between ? and ?",
   /* BLOCK_DELETE_ALL */ "delete from %_segments",
 
   /* SEGDIR_MAX_INDEX */ "select max(idx) from %_segdir where level = ?",
   /* SEGDIR_SET */ "insert into %_segdir values (?, ?, ?, ?, ?, ?)",
   /* SEGDIR_SELECT_LEVEL */
-  "select start_block, leaves_end_block, root from %_segdir "
+  "select start_block, leaves_end_block, root, idx from %_segdir "
   " where level = ? order by idx",
   /* SEGDIR_SPAN */
   "select min(start_block), max(end_block) from %_segdir "
   " where level = ? and start_block <> 0",
   /* SEGDIR_DELETE */ "delete from %_segdir where level = ?",
 
   /* NOTE(shess): The first three results of the following two
   ** statements must match.
   */
   /* SEGDIR_SELECT_SEGMENT */
@@ skipping 3428 matching lines @@
 
   rc = sqlite3_bind_int(s, 1, iLevel);
   if( rc!=SQLITE_OK ) return rc;
 
   i = 0;
   while( (rc = sqlite3_step(s))==SQLITE_ROW ){
     sqlite_int64 iStart = sqlite3_column_int64(s, 0);
     sqlite_int64 iEnd = sqlite3_column_int64(s, 1);
     const char *pRootData = sqlite3_column_blob(s, 2);
     int nRootData = sqlite3_column_bytes(s, 2);
+    sqlite_int64 iIndex = sqlite3_column_int64(s, 3);
 
     /* Corrupt if we get back different types than we stored. */
+    /* Also corrupt if the index is not sequential starting at 0. */
     if( sqlite3_column_type(s, 0)!=SQLITE_INTEGER ||
         sqlite3_column_type(s, 1)!=SQLITE_INTEGER ||
-        sqlite3_column_type(s, 2)!=SQLITE_BLOB ){
+        sqlite3_column_type(s, 2)!=SQLITE_BLOB ||
+        i != iIndex){
       rc = SQLITE_CORRUPT_BKPT;
       break;
     }
 
     assert( i<MERGE_COUNT );
     rc = leavesReaderInit(v, i, iStart, iEnd, pRootData, nRootData,
                           &pReaders[i]);
     if( rc!=SQLITE_OK ) break;
 
     i++;
@@ skipping 1690 matching lines @@
   sqlite3 *db, 
   char **pzErrMsg,
   const sqlite3_api_routines *pApi
 ){
   SQLITE_EXTENSION_INIT2(pApi)
   return sqlite3Fts2Init(db);
 }
 #endif
 
 #endif /* !defined(SQLITE_CORE) || defined(SQLITE_ENABLE_FTS2) */