Index: third_party/sqlite/patches/0015-fts2-Fix-a-crasher-in-full-text-search-sqlite.patch |
diff --git a/third_party/sqlite/patches/0015-fts2-Fix-a-crasher-in-full-text-search-sqlite.patch b/third_party/sqlite/patches/0015-fts2-Fix-a-crasher-in-full-text-search-sqlite.patch |
new file mode 100644 |
index 0000000000000000000000000000000000000000..f5a6c67d09050542ce730a456be1c565c438e00a |
--- /dev/null |
+++ b/third_party/sqlite/patches/0015-fts2-Fix-a-crasher-in-full-text-search-sqlite.patch |
@@ -0,0 +1,89 @@ |
+From ab29deaf1d9911e7dfc5f12e1fb131f800c9d4fd Mon Sep 17 00:00:00 2001 |
+From: cpu <cpu@chromium.org> |
+Date: Mon, 14 Sep 2009 17:37:35 +0000 |
+Subject: [PATCH 15/16] [fts2] Fix a crasher in full text search (sqlite) |
+ |
+- If the xxx_segdir table gets corrupted, you can have non-contiguous indexes (idx). |
+- This causes an assertion in debug, and a crash later on on release |
+ |
+With this change it will return 'corrupted db' |
+ |
+We shall wait to get a couple more fixes to upstream to sqlite org. |
+ |
+BUG=21377 |
+TEST=see bug |
+ |
+Original review URL: https://codereview.chromium.org/203046 |
+ |
+=== |
+ |
+Also slipstreams: |
+ |
+fixup [open][fts2] Tweak Carlos' change to cater for the additional cases: |
+- More (ordered) segments than we expect - would previously cause stack-based |
+buffer overflow. |
+- Less segments than we expect, where the missing segments are a strict |
+truncation rather than missing in the middle. |
+ |
+BUG=NONE |
+TEST=NONE |
+ |
+Original review URL: https://codereview.chromium.org/209001/ |
+--- |
+ third_party/sqlite/src/ext/fts2/fts2.c | 15 +++++++++++---- |
+ 1 file changed, 11 insertions(+), 4 deletions(-) |
+ |
+diff --git a/third_party/sqlite/src/ext/fts2/fts2.c b/third_party/sqlite/src/ext/fts2/fts2.c |
+index 5cb3fc6..a78e3d3 100644 |
+--- a/third_party/sqlite/src/ext/fts2/fts2.c |
++++ b/third_party/sqlite/src/ext/fts2/fts2.c |
+@@ -1838,7 +1838,7 @@ static const char *const fulltext_zStatement[MAX_STMT] = { |
+ /* SEGDIR_MAX_INDEX */ "select max(idx) from %_segdir where level = ?", |
+ /* SEGDIR_SET */ "insert into %_segdir values (?, ?, ?, ?, ?, ?)", |
+ /* SEGDIR_SELECT_LEVEL */ |
+- "select start_block, leaves_end_block, root from %_segdir " |
++ "select start_block, leaves_end_block, root, idx from %_segdir " |
+ " where level = ? order by idx", |
+ /* SEGDIR_SPAN */ |
+ "select min(start_block), max(end_block) from %_segdir " |
+@@ -5287,16 +5287,19 @@ static int leavesReadersInit(fulltext_vtab *v, int iLevel, |
+ sqlite_int64 iEnd = sqlite3_column_int64(s, 1); |
+ const char *pRootData = sqlite3_column_blob(s, 2); |
+ int nRootData = sqlite3_column_bytes(s, 2); |
++ sqlite_int64 iIndex = sqlite3_column_int64(s, 3); |
+ |
+ /* Corrupt if we get back different types than we stored. */ |
++ /* Also corrupt if the index is not sequential starting at 0. */ |
+ if( sqlite3_column_type(s, 0)!=SQLITE_INTEGER || |
+ sqlite3_column_type(s, 1)!=SQLITE_INTEGER || |
+- sqlite3_column_type(s, 2)!=SQLITE_BLOB ){ |
++ sqlite3_column_type(s, 2)!=SQLITE_BLOB || |
++ i!=iIndex || |
++ i>=MERGE_COUNT ){ |
+ rc = SQLITE_CORRUPT_BKPT; |
+ break; |
+ } |
+ |
+- assert( i<MERGE_COUNT ); |
+ rc = leavesReaderInit(v, i, iStart, iEnd, pRootData, nRootData, |
+ &pReaders[i]); |
+ if( rc!=SQLITE_OK ) break; |
+@@ -5391,10 +5394,14 @@ static int segmentMerge(fulltext_vtab *v, int iLevel){ |
+ memset(&lrs, '\0', sizeof(lrs)); |
+ rc = leavesReadersInit(v, iLevel, lrs, &i); |
+ if( rc!=SQLITE_OK ) return rc; |
+- assert( i==MERGE_COUNT ); |
+ |
+ leafWriterInit(iLevel+1, idx, &writer); |
+ |
++ if( i!=MERGE_COUNT ){ |
++ rc = SQLITE_CORRUPT_BKPT; |
++ goto err; |
++ } |
++ |
+ /* Since leavesReaderReorder() pushes readers at eof to the end, |
+ ** when the first reader is empty, all will be empty. |
+ */ |
+-- |
+2.2.1 |
+ |