[backport] Address integer overflow in sqlite3MulInt64.

third_party/sqlite/patches/0014-backport-Address-integer-overflow-in-sqlite3MulInt64.patch

Index: third_party/sqlite/patches/0014-backport-Address-integer-overflow-in-sqlite3MulInt64.patch
diff --git a/third_party/sqlite/patches/0014-backport-Address-integer-overflow-in-sqlite3MulInt64.patch b/third_party/sqlite/patches/0014-backport-Address-integer-overflow-in-sqlite3MulInt64.patch
new file mode 100644
index 0000000000000000000000000000000000000000..19a52103c7dac395f104b97d7b7d8966c0dd0989
--- /dev/null
+++ b/third_party/sqlite/patches/0014-backport-Address-integer-overflow-in-sqlite3MulInt64.patch
@@ -0,0 +1,112 @@
+From 7bcd4f0f17fb5bb6ae11be6ef0b70197195f2d61 Mon Sep 17 00:00:00 2001
+From: Scott Hess <shess@chromium.org>
+Date: Fri, 23 Sep 2016 09:54:14 -0700
+Subject: [PATCH 14/14] [backport] Address integer overflow in sqlite3MulInt64.
+
+SQLite check-in http://www.sqlite.org/src/info/db3ebd7c52cfc5fc
+
+"Improved implementation of 64-bit signed integer multiply that
+correctly detects overflow (and promotes to floating-point) in some
+corner cases. Fix for ticket [1ec41379c9c1e400]"
+
+http://www.sqlite.org/src/info/1ec41379c9c1e400"
+
+BUG=601727
+---
+ third_party/sqlite/src/src/util.c     | 37 +++++++++++------------------------
+ third_party/sqlite/src/test/expr.test | 27 +++++++++++++++++++++++++
+ 2 files changed, 38 insertions(+), 26 deletions(-)
+
+diff --git a/third_party/sqlite/src/src/util.c b/third_party/sqlite/src/src/util.c
+index b4c5e62..7640f1d 100644
+--- a/third_party/sqlite/src/src/util.c
++++ b/third_party/sqlite/src/src/util.c
+@@ -1244,36 +1244,21 @@ int sqlite3SubInt64(i64 *pA, i64 iB){
+     return sqlite3AddInt64(pA, -iB);
+   }
+ }
+-#define TWOPOWER32 (((i64)1)<<32)
+-#define TWOPOWER31 (((i64)1)<<31)
+ int sqlite3MulInt64(i64 *pA, i64 iB){
+   i64 iA = *pA;
+-  i64 iA1, iA0, iB1, iB0, r;
+-
+-  iA1 = iA/TWOPOWER32;
+-  iA0 = iA % TWOPOWER32;
+-  iB1 = iB/TWOPOWER32;
+-  iB0 = iB % TWOPOWER32;
+-  if( iA1==0 ){
+-    if( iB1==0 ){
+-      *pA *= iB;
+-      return 0;
++  if( iB>0 ){
++    if( iA>LARGEST_INT64/iB ) return 1;
++    if( iA<SMALLEST_INT64/iB ) return 1;
++  }else if( iB<0 ){
++    if( iA>0 ){
++      if( iB<SMALLEST_INT64/iA ) return 1;
++    }else if( iA<0 ){
++      if( iB==SMALLEST_INT64 ) return 1;
++      if( iA==SMALLEST_INT64 ) return 1;
++      if( -iA>LARGEST_INT64/-iB ) return 1;
+     }
+-    r = iA0*iB1;
+-  }else if( iB1==0 ){
+-    r = iA1*iB0;
+-  }else{
+-    /* If both iA1 and iB1 are non-zero, overflow will result */
+-    return 1;
+   }
+-  testcase( r==(-TWOPOWER31)-1 );
+-  testcase( r==(-TWOPOWER31) );
+-  testcase( r==TWOPOWER31 );
+-  testcase( r==TWOPOWER31-1 );
+-  if( r<(-TWOPOWER31) || r>=TWOPOWER31 ) return 1;
+-  r *= TWOPOWER32;
+-  if( sqlite3AddInt64(&r, iA0*iB0) ) return 1;
+-  *pA = r;
++  *pA = iA*iB;
+   return 0;
+ }
+ 
+diff --git a/third_party/sqlite/src/test/expr.test b/third_party/sqlite/src/test/expr.test
+index 7d7b8ce..7a6d477 100644
+--- a/third_party/sqlite/src/test/expr.test
++++ b/third_party/sqlite/src/test/expr.test
+@@ -308,6 +308,33 @@ ifcapable floatingpoint {if {[working_64bit_int]} {
+   test_realnum_expr expr-1.257\
+       {i1=-4294967296, i2=-2147483647} {i1*i2}    9223372032559808512
+ 
++  test_realnum_expr expr-1.260\
++      {i1=3037000500, i2=3037000500} {i1*i2}      9.22337203700025e+18
++  test_realnum_expr expr-1.261\
++      {i1=3037000500, i2=-3037000500} {i1*i2}     -9.22337203700025e+18
++  test_realnum_expr expr-1.262\
++      {i1=-3037000500, i2=3037000500} {i1*i2}     -9.22337203700025e+18
++  test_realnum_expr expr-1.263\
++      {i1=-3037000500, i2=-3037000500} {i1*i2}    9.22337203700025e+18
++
++  test_realnum_expr expr-1.264\
++      {i1=3037000500, i2=3037000499} {i1*i2}      9223372033963249500
++  test_realnum_expr expr-1.265\
++      {i1=3037000500, i2=-3037000499} {i1*i2}     -9223372033963249500
++  test_realnum_expr expr-1.266\
++      {i1=-3037000500, i2=3037000499} {i1*i2}     -9223372033963249500
++  test_realnum_expr expr-1.267\
++      {i1=-3037000500, i2=-3037000499} {i1*i2}    9223372033963249500
++
++  test_realnum_expr expr-1.268\
++      {i1=3037000499, i2=3037000500} {i1*i2}      9223372033963249500
++  test_realnum_expr expr-1.269\
++      {i1=3037000499, i2=-3037000500} {i1*i2}     -9223372033963249500
++  test_realnum_expr expr-1.270\
++      {i1=-3037000499, i2=3037000500} {i1*i2}     -9223372033963249500
++  test_realnum_expr expr-1.271\
++      {i1=-3037000499, i2=-3037000500} {i1*i2}    9223372033963249500
++
+ }}
+ 
+ ifcapable floatingpoint {
+-- 
+2.5.0
+