Blame SOURCES/sqlite-3.26.0-CVE-2019-13734.patch

094f44
From 5f4ce30babee8085fc36680c6103d9a06be49ef7 Mon Sep 17 00:00:00 2001
b8c90d
From: Ondrej Dubaj <odubaj@redhat.com>
094f44
Date: Thu, 2 Jan 2020 11:58:39 +0100
b8c90d
Subject: [PATCH] More improvements to shadow table corruption detection in
b8c90d
 FTS3.
b8c90d
b8c90d
---
b8c90d
 ext/fts3/fts3.c       |  4 ++++
b8c90d
 ext/fts3/fts3Int.h    | 10 ++++++++++
b8c90d
 ext/fts3/fts3_write.c | 14 +++++++++++---
b8c90d
 3 files changed, 25 insertions(+), 3 deletions(-)
b8c90d
b8c90d
diff --git a/ext/fts3/fts3.c b/ext/fts3/fts3.c
094f44
index 6d6bd46..84fc8a5 100644
b8c90d
--- a/ext/fts3/fts3.c
b8c90d
+++ b/ext/fts3/fts3.c
b8c90d
@@ -1460,6 +1460,10 @@ static int fts3InitVtab(
b8c90d
   fts3DatabasePageSize(&rc, p);
b8c90d
   p->nNodeSize = p->nPgsz-35;
b8c90d
 
b8c90d
+#if defined(SQLITE_DEBUG)||defined(SQLITE_TEST)
b8c90d
+  p->nMergeCount = FTS3_MERGE_COUNT;
b8c90d
+#endif
b8c90d
+
b8c90d
   /* Declare the table schema to SQLite. */
b8c90d
   fts3DeclareVtab(&rc, p);
b8c90d
 
b8c90d
diff --git a/ext/fts3/fts3Int.h b/ext/fts3/fts3Int.h
094f44
index 6f5a7a0..0d1b491 100644
b8c90d
--- a/ext/fts3/fts3Int.h
b8c90d
+++ b/ext/fts3/fts3Int.h
b8c90d
@@ -287,9 +287,19 @@ struct Fts3Table {
b8c90d
   /* True to disable the incremental doclist optimization. This is controled
b8c90d
   ** by special insert command 'test-no-incr-doclist'.  */
b8c90d
   int bNoIncrDoclist;
b8c90d
+
b8c90d
+  /* Number of segments in a level */
b8c90d
+  int nMergeCount;
b8c90d
 #endif
b8c90d
 };
b8c90d
 
b8c90d
+/* Macro to find the number of segments to merge */
b8c90d
+#if defined(SQLITE_DEBUG) || defined(SQLITE_TEST)
b8c90d
+# define MergeCount(P) ((P)->nMergeCount)
b8c90d
+#else
b8c90d
+# define MergeCount(P) FTS3_MERGE_COUNT
b8c90d
+#endif
b8c90d
+
b8c90d
 /*
b8c90d
 ** When the core wants to read from the virtual table, it creates a
b8c90d
 ** virtual table cursor (an instance of the following structure) using
b8c90d
diff --git a/ext/fts3/fts3_write.c b/ext/fts3/fts3_write.c
094f44
index 8624329..d57d265 100644
b8c90d
--- a/ext/fts3/fts3_write.c
b8c90d
+++ b/ext/fts3/fts3_write.c
b8c90d
@@ -1152,7 +1152,7 @@ static int fts3AllocateSegdirIdx(
b8c90d
     ** segment and allocate (newly freed) index 0 at level iLevel. Otherwise,
b8c90d
     ** if iNext is less than FTS3_MERGE_COUNT, allocate index iNext.
b8c90d
     */
b8c90d
-    if( iNext>=FTS3_MERGE_COUNT ){
b8c90d
+    if( iNext>=MergeCount(p) ){
b8c90d
       fts3LogMerge(16, getAbsoluteLevel(p, iLangid, iIndex, iLevel));
b8c90d
       rc = fts3SegmentMerge(p, iLangid, iIndex, iLevel);
b8c90d
       *piIdx = 0;
094f44
@@ -4259,6 +4259,10 @@ static int fts3IncrmergeLoad(
b8c90d
       int i;
b8c90d
       int nHeight = (int)aRoot[0];
b8c90d
       NodeWriter *pNode;
b8c90d
+      if( nHeight<1 || nHeight>FTS_MAX_APPENDABLE_HEIGHT ){
b8c90d
+        sqlite3_reset(pSelect);
b8c90d
+        return FTS_CORRUPT_VTAB;
b8c90d
+      }
b8c90d
 
b8c90d
       pWriter->nLeafEst = (int)((iEnd - iStart) + 1)/FTS_MAX_APPENDABLE_HEIGHT;
b8c90d
       pWriter->iStart = iStart;
094f44
@@ -5007,7 +5011,7 @@ static int fts3DoIncrmerge(
b8c90d
   const char *zParam              /* Nul-terminated string containing "A,B" */
b8c90d
 ){
b8c90d
   int rc;
b8c90d
-  int nMin = (FTS3_MERGE_COUNT / 2);
b8c90d
+  int nMin = (MergeCount(p) / 2);
b8c90d
   int nMerge = 0;
b8c90d
   const char *z = zParam;
b8c90d
 
094f44
@@ -5052,7 +5056,7 @@ static int fts3DoAutoincrmerge(
b8c90d
   int rc = SQLITE_OK;
b8c90d
   sqlite3_stmt *pStmt = 0;
b8c90d
   p->nAutoincrmerge = fts3Getint(&zParam);
b8c90d
-  if( p->nAutoincrmerge==1 || p->nAutoincrmerge>FTS3_MERGE_COUNT ){
b8c90d
+  if( p->nAutoincrmerge==1 || p->nAutoincrmerge>MergeCount(p) ){
b8c90d
     p->nAutoincrmerge = 8;
b8c90d
   }
b8c90d
   if( !p->bHasStat ){
094f44
@@ -5340,6 +5344,10 @@ static int fts3SpecialInsert(Fts3Table *p, sqlite3_value *pVal){
094f44
     }else if( nVal>21 && 0==sqlite3_strnicmp(zVal,"test-no-incr-doclist=",21) ){
094f44
       p->bNoIncrDoclist = atoi(&zVal[21]);
094f44
       rc = SQLITE_OK;
094f44
+    }else if( nVal>11 && 0==sqlite3_strnicmp(zVal,"mergecount=",11) ){
094f44
+      v = atoi(&zVal[11]);
094f44
+      if( v>=4 && v<=FTS3_MERGE_COUNT && (v&1)==0 ) p->nMergeCount = v;
094f44
+      rc = SQLITE_OK;
094f44
     }
b8c90d
 #endif
094f44
   }
b8c90d
-- 
b8c90d
2.19.1
b8c90d