|
 |
11c328 |
From eca47c8481b0c2f09a7818ed2bce0ad27b1dae27 Mon Sep 17 00:00:00 2001
|
|
|
11c328 |
From: Ondrej Dubaj <odubaj@redhat.com>
|
|
|
11c328 |
Date: Wed, 26 Jun 2019 12:25:10 +0200
|
|
|
11c328 |
Subject: [PATCH] Fixed out of bounds heap read in function rtreenode()
|
|
|
11c328 |
|
|
|
11c328 |
Enhance the rtreenode() function of rtree (used for
|
|
|
11c328 |
testing) so that it uses the newer sqlite3_str object
|
|
|
11c328 |
for better performance and improved error reporting.
|
|
|
11c328 |
Test cases added to TH3.
|
|
|
11c328 |
|
|
|
11c328 |
Resolves: #1723338
|
|
|
11c328 |
Version: 3.26.0-4
|
|
|
11c328 |
---
|
|
|
11c328 |
ext/rtree/rtree.c | 35 ++++++++++++++++-------------------
|
|
|
11c328 |
1 file changed, 16 insertions(+), 19 deletions(-)
|
|
|
11c328 |
|
|
|
11c328 |
diff --git a/ext/rtree/rtree.c b/ext/rtree/rtree.c
|
|
|
11c328 |
index 4b044cb..87d0de0 100644
|
|
|
11c328 |
--- a/ext/rtree/rtree.c
|
|
|
11c328 |
+++ b/ext/rtree/rtree.c
|
|
|
11c328 |
@@ -3711,49 +3711,46 @@ rtreeInit_fail:
|
|
|
11c328 |
** <num-dimension>*2 coordinates.
|
|
|
11c328 |
*/
|
|
|
11c328 |
static void rtreenode(sqlite3_context *ctx, int nArg, sqlite3_value **apArg){
|
|
|
11c328 |
- char *zText = 0;
|
|
|
11c328 |
RtreeNode node;
|
|
|
11c328 |
Rtree tree;
|
|
|
11c328 |
int ii;
|
|
|
11c328 |
+ int nData;
|
|
|
11c328 |
+ int errCode;
|
|
|
11c328 |
+ sqlite3_str *pOut;
|
|
|
11c328 |
|
|
|
11c328 |
UNUSED_PARAMETER(nArg);
|
|
|
11c328 |
memset(&node, 0, sizeof(RtreeNode));
|
|
|
11c328 |
memset(&tree, 0, sizeof(Rtree));
|
|
|
11c328 |
tree.nDim = (u8)sqlite3_value_int(apArg[0]);
|
|
|
11c328 |
+ if( tree.nDim<1 || tree.nDim>5 ) return;
|
|
|
11c328 |
tree.nDim2 = tree.nDim*2;
|
|
|
11c328 |
tree.nBytesPerCell = 8 + 8 * tree.nDim;
|
|
|
11c328 |
node.zData = (u8 *)sqlite3_value_blob(apArg[1]);
|
|
|
11c328 |
+ nData = sqlite3_value_bytes(apArg[1]);
|
|
|
11c328 |
+ if( nData<4 ) return;
|
|
|
11c328 |
+ if( nData
|
|
|
11c328 |
|
|
|
11c328 |
+ pOut = sqlite3_str_new(0);
|
|
|
11c328 |
for(ii=0; ii
|
|
|
11c328 |
- char zCell[512];
|
|
|
11c328 |
- int nCell = 0;
|
|
|
11c328 |
RtreeCell cell;
|
|
|
11c328 |
int jj;
|
|
|
11c328 |
|
|
|
11c328 |
nodeGetCell(&tree, &node, ii, &cell);
|
|
|
11c328 |
- sqlite3_snprintf(512-nCell,&zCell[nCell],"%lld", cell.iRowid);
|
|
|
11c328 |
- nCell = (int)strlen(zCell);
|
|
|
11c328 |
+ if( ii>0 ) sqlite3_str_append(pOut, " ", 1);
|
|
|
11c328 |
+ sqlite3_str_appendf(pOut, "{%lld", cell.iRowid);
|
|
|
11c328 |
for(jj=0; jj
|
|
|
11c328 |
#ifndef SQLITE_RTREE_INT_ONLY
|
|
|
11c328 |
- sqlite3_snprintf(512-nCell,&zCell[nCell], " %g",
|
|
|
11c328 |
- (double)cell.aCoord[jj].f);
|
|
|
11c328 |
+ sqlite3_str_appendf(pOut, " %g", (double)cell.aCoord[jj].f);
|
|
|
11c328 |
#else
|
|
|
11c328 |
- sqlite3_snprintf(512-nCell,&zCell[nCell], " %d",
|
|
|
11c328 |
- cell.aCoord[jj].i);
|
|
|
11c328 |
+ sqlite3_str_appendf(pOut, " %d", cell.aCoord[jj].i);
|
|
|
11c328 |
#endif
|
|
|
11c328 |
- nCell = (int)strlen(zCell);
|
|
|
11c328 |
- }
|
|
|
11c328 |
-
|
|
|
11c328 |
- if( zText ){
|
|
|
11c328 |
- char *zTextNew = sqlite3_mprintf("%s {%s}", zText, zCell);
|
|
|
11c328 |
- sqlite3_free(zText);
|
|
|
11c328 |
- zText = zTextNew;
|
|
|
11c328 |
- }else{
|
|
|
11c328 |
- zText = sqlite3_mprintf("{%s}", zCell);
|
|
|
11c328 |
}
|
|
|
11c328 |
+ sqlite3_str_append(pOut, "}", 1);
|
|
|
11c328 |
}
|
|
|
11c328 |
|
|
|
11c328 |
- sqlite3_result_text(ctx, zText, -1, sqlite3_free);
|
|
|
11c328 |
+ errCode = sqlite3_str_errcode(pOut);
|
|
|
11c328 |
+ sqlite3_result_text(ctx, sqlite3_str_finish(pOut), -1, sqlite3_free);
|
|
|
11c328 |
+ sqlite3_result_error_code(ctx, errCode);
|
|
|
11c328 |
}
|
|
|
11c328 |
|
|
|
11c328 |
/* This routine implements an SQL function that returns the "depth" parameter
|
|
|
11c328 |
--
|
|
|
11c328 |
2.19.1
|
|
|
11c328 |
|