From 92b243715eea17997ed9707540757d0667ad9eb2 Mon Sep 17 00:00:00 2001

From: Ondrej Dubaj <odubaj@redhat.com>

Date: Thu, 2 Jan 2020 09:54:41 +0100

Subject: [PATCH] Improved detection of corrupt shadow tables in FTS3. Enable

 the debugging special-inserts for FTS3 for both SQLITE_DEBUG and SQLITE_TEST.

Resolves: CVE-2019-13752

---

 ext/fts3/fts3.c       |  2 +-

 ext/fts3/fts3Int.h    |  2 +-

 ext/fts3/fts3_write.c | 42 +++++++++++++++++++++++++++---------------

 3 files changed, 29 insertions(+), 17 deletions(-)

diff --git a/ext/fts3/fts3.c b/ext/fts3/fts3.c

index f6fb931..6d6bd46 100644

--- a/ext/fts3/fts3.c

+++ b/ext/fts3/fts3.c

@@ -4304,7 +4304,7 @@ static int fts3EvalPhraseStart(Fts3Cursor *pCsr, int bOptOk, Fts3Phrase *p){

   int bIncrOk = (bOptOk 

    && pCsr->bDesc==pTab->bDescIdx 

    && p->nToken<=MAX_INCR_PHRASE_TOKENS && p->nToken>0

-#ifdef SQLITE_TEST

+#if defined(SQLITE_DEBUG) || defined(SQLITE_TEST)

    && pTab->bNoIncrDoclist==0

 #endif

   );

diff --git a/ext/fts3/fts3Int.h b/ext/fts3/fts3Int.h

index 077bad7..6f5a7a0 100644

--- a/ext/fts3/fts3Int.h

+++ b/ext/fts3/fts3Int.h

@@ -283,7 +283,7 @@ struct Fts3Table {

   int mxSavepoint;       /* Largest valid xSavepoint integer */

 #endif

-#ifdef SQLITE_TEST

+#if defined(SQLITE_DEBUG) || defined(SQLITE_TEST)

   /* True to disable the incremental doclist optimization. This is controled

   ** by special insert command 'test-no-incr-doclist'.  */

   int bNoIncrDoclist;

diff --git a/ext/fts3/fts3_write.c b/ext/fts3/fts3_write.c

index 8fc6589..ee668aa 100644

--- a/ext/fts3/fts3_write.c

+++ b/ext/fts3/fts3_write.c

@@ -23,7 +23,7 @@

 #include <string.h>

 #include <assert.h>

 #include <stdlib.h>

-

+#include <stdio.h>

 #define FTS_MAX_APPENDABLE_HEIGHT 16

@@ -2021,6 +2021,11 @@ static int fts3NodeAddTerm(

     nPrefix = fts3PrefixCompress(pTree->zTerm, pTree->nTerm, zTerm, nTerm);

     nSuffix = nTerm-nPrefix;

+    /* If nSuffix is zero or less, then zTerm/nTerm must be a prefix of 

+    ** pWriter->zTerm/pWriter->nTerm. i.e. must be equal to or less than when

+    ** compared with BINARY collation. This indicates corruption.  */

+    if( nSuffix<=0 ) return FTS_CORRUPT_VTAB;

+

     nReq += sqlite3Fts3VarintLen(nPrefix)+sqlite3Fts3VarintLen(nSuffix)+nSuffix;

     if( nReq<=p->nNodeSize || !pTree->zTerm ){

@@ -2309,9 +2314,11 @@ static int fts3SegWriterAdd(

   /* Append the prefix-compressed term and doclist to the buffer. */

   nData += sqlite3Fts3PutVarint(&pWriter->aData[nData], nPrefix);

   nData += sqlite3Fts3PutVarint(&pWriter->aData[nData], nSuffix);

+  assert( nSuffix>0 );

   memcpy(&pWriter->aData[nData], &zTerm[nPrefix], nSuffix);

   nData += nSuffix;

   nData += sqlite3Fts3PutVarint(&pWriter->aData[nData], nDoclist);

+  assert( nDoclist>0 );

   memcpy(&pWriter->aData[nData], aDoclist, nDoclist);

   pWriter->nData = nData + nDoclist;

@@ -2331,6 +2338,7 @@ static int fts3SegWriterAdd(

       pWriter->zTerm = zNew;

     }

     assert( pWriter->zTerm==pWriter->zMalloc );

+    assert( nTerm>0 );

     memcpy(pWriter->zTerm, zTerm, nTerm);

   }else{

     pWriter->zTerm = (char *)zTerm;

@@ -2639,6 +2647,7 @@ static int fts3MsrBufferData(

     pMsr->aBuffer = pNew;

   }

+  assert( nList>0 );

   memcpy(pMsr->aBuffer, pList, nList);

   return SQLITE_OK;

 }

@@ -3821,6 +3830,7 @@ static int fts3IncrmergePush(

     ** be added to.  */

     nPrefix = fts3PrefixCompress(pNode->key.a, pNode->key.n, zTerm, nTerm);

     nSuffix = nTerm - nPrefix;

+    if( NEVER(nSuffix<=0) ) return FTS_CORRUPT_VTAB;

     nSpace  = sqlite3Fts3VarintLen(nPrefix);

     nSpace += sqlite3Fts3VarintLen(nSuffix) + nSuffix;

@@ -5300,7 +5310,7 @@ static int fts3DoIntegrityCheck(

 ** meaningful value to insert is the text 'optimize'.

 */

 static int fts3SpecialInsert(Fts3Table *p, sqlite3_value *pVal){

-  int rc;                         /* Return Code */

+  int rc = SQLITE_ERROR;           /* Return Code */

   const char *zVal = (const char *)sqlite3_value_text(pVal);

   int nVal = sqlite3_value_bytes(pVal);

@@ -5316,21 +5326,23 @@ static int fts3SpecialInsert(Fts3Table *p, sqlite3_value *pVal){

     rc = fts3DoIncrmerge(p, &zVal[6]);

   }else if( nVal>10 && 0==sqlite3_strnicmp(zVal, "automerge=", 10) ){

     rc = fts3DoAutoincrmerge(p, &zVal[10]);

-#ifdef SQLITE_TEST

-  }else if( nVal>9 && 0==sqlite3_strnicmp(zVal, "nodesize=", 9) ){

-    p->nNodeSize = atoi(&zVal[9]);

-    rc = SQLITE_OK;

-  }else if( nVal>11 && 0==sqlite3_strnicmp(zVal, "maxpending=", 9) ){

-    p->nMaxPendingData = atoi(&zVal[11]);

-    rc = SQLITE_OK;

-  }else if( nVal>21 && 0==sqlite3_strnicmp(zVal, "test-no-incr-doclist=", 21) ){

-    p->bNoIncrDoclist = atoi(&zVal[21]);

-    rc = SQLITE_OK;

-#endif

+#if defined(SQLITE_DEBUG) || defined(SQLITE_TEST)

   }else{

-    rc = SQLITE_ERROR;

+        int v;

+    if( nVal>9 && 0==sqlite3_strnicmp(zVal, "nodesize=", 9) ){

+      v = atoi(&zVal[9]);

+      if( v>=24 && v<=p->nPgsz-35 ) p->nNodeSize = v;

+      rc = SQLITE_OK;

+    }else if( nVal>11 && 0==sqlite3_strnicmp(zVal, "maxpending=", 9) ){

+      v = atoi(&zVal[11]);

+      if( v>=64 && v<=FTS3_MAX_PENDING_DATA ) p->nMaxPendingData = v;

+      rc = SQLITE_OK;

+    }else if( nVal>21 && 0==sqlite3_strnicmp(zVal,"test-no-incr-doclist=",21) ){

+      p->bNoIncrDoclist = atoi(&zVal[21]);

+      rc = SQLITE_OK;

+    }

+#endif

   }

-

   return rc;

 }

-- 

2.19.1