OLD | NEW |
(Empty) | |
| 1 # 2009 June 3 |
| 2 # |
| 3 # The author disclaims copyright to this source code. In place of |
| 4 # a legal notice, here is a blessing: |
| 5 # |
| 6 # May you do good and not evil. |
| 7 # May you find forgiveness for yourself and forgive others. |
| 8 # May you share freely, never taking more than you give. |
| 9 # |
| 10 #*********************************************************************** |
| 11 # |
| 12 # $Id: corruptD.test,v 1.2 2009/06/05 17:09:12 drh Exp $ |
| 13 |
| 14 set testdir [file dirname $argv0] |
| 15 source $testdir/tester.tcl |
| 16 |
| 17 # Do not use a codec for tests in this file, as the database file is |
| 18 # manipulated directly using tcl scripts (using the [hexio_write] command). |
| 19 # |
| 20 do_not_use_codec |
| 21 |
| 22 #-------------------------------------------------------------------------- |
| 23 # OVERVIEW |
| 24 # |
| 25 # This test file attempts to verify that SQLite does not read past the |
| 26 # end of any in-memory buffers as a result of corrupted database page |
| 27 # images. Usually this happens because a field within a database page |
| 28 # that contains an offset to some other structure within the same page |
| 29 # is set to too large a value. A database page contains the following |
| 30 # such fields: |
| 31 # |
| 32 # 1. The page header field that contains the offset to the first |
| 33 # free block of space. |
| 34 # |
| 35 # 2. The first two bytes of all but the last free block on the free-block |
| 36 # list (the offset to the next free block). |
| 37 # |
| 38 # 3. The page header field containing the number of cells on the page |
| 39 # (implicitly defines the offset to the final element in the cell offset |
| 40 # array, which could potentially be off the end of the page). |
| 41 # |
| 42 # 4. The page header field containing the offset to the start of the cell |
| 43 # content area. |
| 44 # |
| 45 # 5. The contents of the cell offset array. |
| 46 # |
| 47 # 6. The first few bytes of each cell determine the size of the cell |
| 48 # stored within the page, and hence the offset to the final byte of |
| 49 # the cell. |
| 50 # |
| 51 # If any of the above fields are set to too large a value, then a buffer |
| 52 # overread may occur. This test script creates and operates on various |
| 53 # strategically corrupted database files to attempt to provoke such buffer |
| 54 # overreads. |
| 55 # |
| 56 # Very often, a buffer overread passes unnoticed, particularly in workstation |
| 57 # environments. For this reason, this test script should be run using valgrind |
| 58 # (or similar) in order to verify that no overreads occur. |
| 59 # |
| 60 # TEST PLAN |
| 61 # |
| 62 # Test cases corruptD-1.* are white-box tests. They attempt to corrupt |
| 63 # one of the above fields, then exercise each part of the code in btree.c |
| 64 # that uses said field. |
| 65 # |
| 66 # Offset variables 1, 2, 3 and 4 are all checked to make sure they |
| 67 # will not result in buffer overruns as part of page initialization in |
| 68 # sqlite3BtreeInitPage(). Offsets 5 and 6 cannot be tested as part of |
| 69 # page initialization, as trying to do so causes a performance hit. |
| 70 # |
| 71 |
| 72 do_test corruptD-1.0 { |
| 73 execsql { |
| 74 PRAGMA auto_vacuum = 0; |
| 75 PRAGMA page_size = 1024; |
| 76 CREATE TABLE t1(a, b); |
| 77 CREATE INDEX i1 ON t1(a, b); |
| 78 } |
| 79 for {set ii 1} {$ii < 50} {incr ii} { |
| 80 execsql { INSERT INTO t1 VALUES($ii, $ii * $ii) } |
| 81 } |
| 82 execsql { |
| 83 DELETE FROM t1 WHERE a = 10; |
| 84 DELETE FROM t1 WHERE a = 20; |
| 85 DELETE FROM t1 WHERE a = 30; |
| 86 DELETE FROM t1 WHERE a = 40; |
| 87 } |
| 88 copy_file test.db test.bu |
| 89 } {} |
| 90 |
| 91 proc incr_change_counter {} { |
| 92 hexio_write test.db 24 [ |
| 93 hexio_render_int32 [expr [hexio_get_int [hexio_read test.db 24 4]] + 1] |
| 94 ] |
| 95 } |
| 96 |
| 97 proc restore_file {} { |
| 98 db close |
| 99 copy_file test.bu test.db |
| 100 sqlite3 db test.db |
| 101 } |
| 102 |
| 103 #------------------------------------------------------------------------- |
| 104 # The following tests, corruptD-1.1.*, focus on the page header field |
| 105 # containing the offset of the first free block in a page. |
| 106 # |
| 107 do_test corruptD-1.1.1 { |
| 108 incr_change_counter |
| 109 hexio_write test.db [expr 1024+1] FFFF |
| 110 catchsql { SELECT * FROM t1 } |
| 111 } {1 {database disk image is malformed}} |
| 112 do_test corruptD-1.1.2 { |
| 113 incr_change_counter |
| 114 hexio_write test.db [expr 1024+1] [hexio_render_int32 1021] |
| 115 catchsql { SELECT * FROM t1 } |
| 116 } {1 {database disk image is malformed}} |
| 117 |
| 118 #------------------------------------------------------------------------- |
| 119 # The following tests, corruptD-1.2.*, focus on the offsets contained |
| 120 # in the first 2 byte of each free-block on the free-list. |
| 121 # |
| 122 do_test corruptD-1.2.1 { |
| 123 restore_file |
| 124 } {} |
| 125 do_test corruptD-1.2.2 { |
| 126 } {} |
| 127 |
| 128 #------------------------------------------------------------------------- |
| 129 # The following tests, corruptD-1.4.*, ... |
| 130 # |
| 131 |
| 132 |
| 133 #------------------------------------------------------------------------- |
| 134 # The following tests, corruptD-1.5.*, focus on the offsets contained |
| 135 # in the cell offset array. |
| 136 # |
| 137 # defragmentPage |
| 138 # |
| 139 |
| 140 finish_test |
OLD | NEW |