| Index: third_party/sqlite/patches/0007-fts3-Interior-node-corruption-detection.patch
|
| diff --git a/third_party/sqlite/patches/0008-fts3-Interior-node-corruption-detection.patch b/third_party/sqlite/patches/0007-fts3-Interior-node-corruption-detection.patch
|
| similarity index 74%
|
| rename from third_party/sqlite/patches/0008-fts3-Interior-node-corruption-detection.patch
|
| rename to third_party/sqlite/patches/0007-fts3-Interior-node-corruption-detection.patch
|
| index 69a628211b94e82bdc6e320ad79214393ac254b4..e520fdbbe9da1c7d2bbc922389806275f4937c3d 100644
|
| --- a/third_party/sqlite/patches/0008-fts3-Interior-node-corruption-detection.patch
|
| +++ b/third_party/sqlite/patches/0007-fts3-Interior-node-corruption-detection.patch
|
| @@ -1,7 +1,7 @@
|
| -From 3141c2a626c531ba20ec54397a09fb6b88d07c4a Mon Sep 17 00:00:00 2001
|
| +From 03fa0b12103886a82be1093fd147406133c33795 Mon Sep 17 00:00:00 2001
|
| From: Scott Hess <shess@chromium.org>
|
| Date: Thu, 26 May 2011 18:44:46 +0000
|
| -Subject: [PATCH 08/10] [fts3] Interior node corruption detection.
|
| +Subject: [PATCH 07/10] [fts3] Interior node corruption detection.
|
|
|
| In auditing as part of a previous import, I noticed this case which
|
| seemed to allow for buffer overrun. The nPrefix check was commented out
|
| @@ -17,19 +17,18 @@ Original review URLs:
|
| http://codereview.chromium.org/7075014
|
| http://codereview.chromium.org/6990047 (3.7.6.3 SQLite import)
|
| ---
|
| - third_party/sqlite/src/ext/fts3/fts3.c | 10 ++++++++--
|
| - 1 file changed, 8 insertions(+), 2 deletions(-)
|
| + third_party/sqlite/src/ext/fts3/fts3.c | 8 +++++++-
|
| + 1 file changed, 7 insertions(+), 1 deletion(-)
|
|
|
| diff --git a/third_party/sqlite/src/ext/fts3/fts3.c b/third_party/sqlite/src/ext/fts3/fts3.c
|
| -index 4f2ebb8..8f15099 100644
|
| +index 9659815da93a..4b032271148e 100644
|
| --- a/third_party/sqlite/src/ext/fts3/fts3.c
|
| +++ b/third_party/sqlite/src/ext/fts3/fts3.c
|
| -@@ -1822,8 +1822,14 @@ static int fts3ScanInteriorNode(
|
| +@@ -1844,7 +1844,13 @@ static int fts3ScanInteriorNode(
|
| isFirstTerm = 0;
|
| zCsr += fts3GetVarint32(zCsr, &nSuffix);
|
|
|
| - if( nPrefix<0 || nSuffix<0 || &zCsr[nSuffix]>zEnd ){
|
| -- rc = FTS_CORRUPT_VTAB;
|
| + /* NOTE(shess): Previous code checked for negative nPrefix and
|
| + ** nSuffix and suffix overrunning zEnd. Additionally corrupt if
|
| + ** the prefix is longer than the previous term, or if the suffix
|
| @@ -37,10 +36,9 @@ index 4f2ebb8..8f15099 100644
|
| + */
|
| + if( nPrefix<0 || nSuffix<0 /* || nPrefix>nBuffer */
|
| + || &zCsr[nSuffix]<zCsr || &zCsr[nSuffix]>zEnd ){
|
| -+ rc = SQLITE_CORRUPT;
|
| + rc = FTS_CORRUPT_VTAB;
|
| goto finish_scan;
|
| }
|
| - if( nPrefix+nSuffix>nAlloc ){
|
| --
|
| -2.7.0
|
| +2.11.0
|
|
|
|
|