| OLD | NEW |
|---|
| (Empty) | |
| 1 From 7bcd4f0f17fb5bb6ae11be6ef0b70197195f2d61 Mon Sep 17 00:00:00 2001 |
| 2 From: Scott Hess <shess@chromium.org> |
| 3 Date: Fri, 23 Sep 2016 09:54:14 -0700 |
| 4 Subject: [PATCH 14/14] [backport] Address integer overflow in sqlite3MulInt64. |
| 5 |
| 6 SQLite check-in http://www.sqlite.org/src/info/db3ebd7c52cfc5fc |
| 7 |
| 8 "Improved implementation of 64-bit signed integer multiply that |
| 9 correctly detects overflow (and promotes to floating-point) in some |
| 10 corner cases. Fix for ticket [1ec41379c9c1e400]" |
| 11 |
| 12 http://www.sqlite.org/src/info/1ec41379c9c1e400" |
| 13 |
| 14 BUG=601727 |
| 15 --- |
| 16 third_party/sqlite/src/src/util.c | 37 +++++++++++------------------------ |
| 17 third_party/sqlite/src/test/expr.test | 27 +++++++++++++++++++++++++ |
| 18 2 files changed, 38 insertions(+), 26 deletions(-) |
| 19 |
| 20 diff --git a/third_party/sqlite/src/src/util.c b/third_party/sqlite/src/src/util
.c |
| 21 index b4c5e62..7640f1d 100644 |
| 22 --- a/third_party/sqlite/src/src/util.c |
| 23 +++ b/third_party/sqlite/src/src/util.c |
| 24 @@ -1244,36 +1244,21 @@ int sqlite3SubInt64(i64 *pA, i64 iB){ |
| 25 return sqlite3AddInt64(pA, -iB); |
| 26 } |
| 27 } |
| 28 -#define TWOPOWER32 (((i64)1)<<32) |
| 29 -#define TWOPOWER31 (((i64)1)<<31) |
| 30 int sqlite3MulInt64(i64 *pA, i64 iB){ |
| 31 i64 iA = *pA; |
| 32 - i64 iA1, iA0, iB1, iB0, r; |
| 33 - |
| 34 - iA1 = iA/TWOPOWER32; |
| 35 - iA0 = iA % TWOPOWER32; |
| 36 - iB1 = iB/TWOPOWER32; |
| 37 - iB0 = iB % TWOPOWER32; |
| 38 - if( iA1==0 ){ |
| 39 - if( iB1==0 ){ |
| 40 - *pA *= iB; |
| 41 - return 0; |
| 42 + if( iB>0 ){ |
| 43 + if( iA>LARGEST_INT64/iB ) return 1; |
| 44 + if( iA<SMALLEST_INT64/iB ) return 1; |
| 45 + }else if( iB<0 ){ |
| 46 + if( iA>0 ){ |
| 47 + if( iB<SMALLEST_INT64/iA ) return 1; |
| 48 + }else if( iA<0 ){ |
| 49 + if( iB==SMALLEST_INT64 ) return 1; |
| 50 + if( iA==SMALLEST_INT64 ) return 1; |
| 51 + if( -iA>LARGEST_INT64/-iB ) return 1; |
| 52 } |
| 53 - r = iA0*iB1; |
| 54 - }else if( iB1==0 ){ |
| 55 - r = iA1*iB0; |
| 56 - }else{ |
| 57 - /* If both iA1 and iB1 are non-zero, overflow will result */ |
| 58 - return 1; |
| 59 } |
| 60 - testcase( r==(-TWOPOWER31)-1 ); |
| 61 - testcase( r==(-TWOPOWER31) ); |
| 62 - testcase( r==TWOPOWER31 ); |
| 63 - testcase( r==TWOPOWER31-1 ); |
| 64 - if( r<(-TWOPOWER31) || r>=TWOPOWER31 ) return 1; |
| 65 - r *= TWOPOWER32; |
| 66 - if( sqlite3AddInt64(&r, iA0*iB0) ) return 1; |
| 67 - *pA = r; |
| 68 + *pA = iA*iB; |
| 69 return 0; |
| 70 } |
| 71 |
| 72 diff --git a/third_party/sqlite/src/test/expr.test b/third_party/sqlite/src/test
/expr.test |
| 73 index 7d7b8ce..7a6d477 100644 |
| 74 --- a/third_party/sqlite/src/test/expr.test |
| 75 +++ b/third_party/sqlite/src/test/expr.test |
| 76 @@ -308,6 +308,33 @@ ifcapable floatingpoint {if {[working_64bit_int]} { |
| 77 test_realnum_expr expr-1.257\ |
| 78 {i1=-4294967296, i2=-2147483647} {i1*i2} 9223372032559808512 |
| 79 |
| 80 + test_realnum_expr expr-1.260\ |
| 81 + {i1=3037000500, i2=3037000500} {i1*i2} 9.22337203700025e+18 |
| 82 + test_realnum_expr expr-1.261\ |
| 83 + {i1=3037000500, i2=-3037000500} {i1*i2} -9.22337203700025e+18 |
| 84 + test_realnum_expr expr-1.262\ |
| 85 + {i1=-3037000500, i2=3037000500} {i1*i2} -9.22337203700025e+18 |
| 86 + test_realnum_expr expr-1.263\ |
| 87 + {i1=-3037000500, i2=-3037000500} {i1*i2} 9.22337203700025e+18 |
| 88 + |
| 89 + test_realnum_expr expr-1.264\ |
| 90 + {i1=3037000500, i2=3037000499} {i1*i2} 9223372033963249500 |
| 91 + test_realnum_expr expr-1.265\ |
| 92 + {i1=3037000500, i2=-3037000499} {i1*i2} -9223372033963249500 |
| 93 + test_realnum_expr expr-1.266\ |
| 94 + {i1=-3037000500, i2=3037000499} {i1*i2} -9223372033963249500 |
| 95 + test_realnum_expr expr-1.267\ |
| 96 + {i1=-3037000500, i2=-3037000499} {i1*i2} 9223372033963249500 |
| 97 + |
| 98 + test_realnum_expr expr-1.268\ |
| 99 + {i1=3037000499, i2=3037000500} {i1*i2} 9223372033963249500 |
| 100 + test_realnum_expr expr-1.269\ |
| 101 + {i1=3037000499, i2=-3037000500} {i1*i2} -9223372033963249500 |
| 102 + test_realnum_expr expr-1.270\ |
| 103 + {i1=-3037000499, i2=3037000500} {i1*i2} -9223372033963249500 |
| 104 + test_realnum_expr expr-1.271\ |
| 105 + {i1=-3037000499, i2=-3037000500} {i1*i2} 9223372033963249500 |
| 106 + |
| 107 }} |
| 108 |
| 109 ifcapable floatingpoint { |
| 110 -- |
| 111 2.5.0 |
| 112 |
| OLD | NEW |
|---|
Chromium Code Reviews
Issue 2370463002:
[backport] Address integer overflow in sqlite3MulInt64. (Closed)
