# Fix for stack buffer overflow in src/printf.c, backpotred from upstream

# Bugzilla: rhbz#1212357

# Original fix: https://www.sqlite.org/src/info/aeca95ac77f6f320

diff -up sqlite-src-3071700/src/printf.c.old sqlite-src-3071700/src/printf.c

--- sqlite-src-3071700/src/printf.c.old	2015-07-03 10:54:17.644940587 +0200

+++ sqlite-src-3071700/src/printf.c	2015-07-03 11:52:50.704122467 +0200

@@ -233,14 +233,17 @@ void sqlite3VXPrintf(

       width = va_arg(ap,int);

       if( width<0 ){

         flag_leftjustify = 1;

-        width = -width;

+        width = width >= -2147483647 ? -width : 0;

       }

       c = *++fmt;

     }else{

+      unsigned wx = 0;

       while( c>='0' && c<='9' ){

-        width = width*10 + c - '0';

+        wx = wx*10 + c - '0';

         c = *++fmt;

       }

+      testcase( wx>0x7fffffff );

+      width = wx & 0x7fffffff;

     }

     /* Get the precision */

     if( c=='.' ){

@@ -248,13 +251,18 @@ void sqlite3VXPrintf(

       c = *++fmt;

       if( c=='*' ){

         precision = va_arg(ap,int);

-        if( precision<0 ) precision = -precision;

         c = *++fmt;

+        if( precision<0 ) {

+          precision = precision >= -2147483647 ? -precision : -1;

+        }

       }else{

+        unsigned px = 0;

         while( c>='0' && c<='9' ){

-          precision = precision*10 + c - '0';

+          px = px*10 + c - '0';

           c = *++fmt;

         }

+        testcase( px>0x7fffffff );

+        precision = px & 0x7fffffff;

       }

     }else{

       precision = -1;

@@ -418,7 +426,8 @@ void sqlite3VXPrintf(

         for(idx=precision, rounder=0.4999; idx>0; idx--, rounder*=0.1);

 #else

         /* It makes more sense to use 0.5 */

-        for(idx=precision, rounder=0.5; idx>0; idx--, rounder*=0.1){}

+        testcase( precision>0xfff );

+        for(idx=precision&0xfff, rounder=0.5; idx>0; idx--, rounder*=0.1){}

 #endif

         if( xtype==etFLOAT ) realvalue += rounder;

         /* Normalize realvalue to within 10.0 > realvalue >= 1.0 */

@@ -474,8 +483,10 @@ void sqlite3VXPrintf(

         }else{

           e2 = exp;

         }

-        if( e2+precision+width > etBUFSIZE - 15 ){

-          bufpt = zExtra = sqlite3Malloc( e2+precision+width+15 );

+        if( e2+(i64)precision+(i64)width > etBUFSIZE - 15 ){

+          bufpt = zExtra = sqlite3Malloc(

+              e2+(i64)precision+(i64)width+15

+              );

           if( bufpt==0 ){

             pAccum->mallocFailed = 1;

             return;

diff -up sqlite-src-3071700/test/printf.test.old sqlite-src-3071700/test/printf.test

--- sqlite-src-3071700/test/printf.test.old	2015-07-03 10:32:28.552140602 +0200

+++ sqlite-src-3071700/test/printf.test	2015-07-03 10:35:15.858079592 +0200

@@ -472,6 +472,18 @@ do_test printf-1.16.7 {

   sqlite3_mprintf_int {abc: (%#6d) (%#6x) (%#6o) :xyz}\

        0xff676981 0xff676981 0xff676981

 } {abc: (-9999999) (0xff676981) (037731664601) :xyz}

+do_test printf-1.17.1 {

+  sqlite3_mprintf_int {abd: %2147483647d %2147483647x %2147483647o} 1 1 1

+} {}

+do_test printf-1.17.2 {

+  sqlite3_mprintf_int {abd: %*d %x} 2147483647 1 1

+} {}

+do_test printf-1.17.3 {

+  sqlite3_mprintf_int {abd: %*d %x} -2147483648 1 1

+} {abd: 1 1}

+do_test printf-1.17.4 {

+  sqlite3_mprintf_int {abd: %.2147483648d %x %x} 1 1 1

+} {/.*/}

 do_test printf-2.1.1.1 {

   sqlite3_mprintf_double {abc: (%*.*f) :xyz} 1 1 0.001

 } {abc: (0.0) :xyz}

@@ -526,6 +538,9 @@ do_test printf-2.1.2.8 {

 do_test printf-2.1.2.9 {

   sqlite3_mprintf_double {abc: %d %d (%1.1g) :xyz} 1 1 1.0e-20

 } {abc: 1 1 (1e-20) :xyz}

+do_test printf-2.1.2.10 {

+  sqlite3_mprintf_double {abc: %*.*f}  2000000000 1000000000 1.0e-20

+} {abc: }

 do_test printf-2.1.3.1 {

   sqlite3_mprintf_double {abc: (%*.*f) :xyz} 1 1 1.0

 } {abc: (1.0) :xyz}

@@ -3466,6 +3481,15 @@ do_test printf-3.5 {

 do_test printf-3.6 {

   sqlite3_mprintf_str {%d %d A String: (%-30s)} 1 2 {This is the string}

 } [format {%d %d A String: (%-30s)} 1 2 {This is the string}]

+do_test printf-3.7 {

+  sqlite3_mprintf_str {%d A String: (%*s)} 1 2147483647 {This is the string}

+} []

+do_test printf-3.8 {

+  sqlite3_mprintf_str {%d A String: (%*s)} 1 -2147483648 {This is the string}

+} {1 A String: (This is the string)}

+do_test printf-3.9 {

+  sqlite3_mprintf_str {%d A String: (%.*s)} 1 -2147483648 {This is the string}

+} {1 A String: (This is the string)}

 do_test snprintf-3.11 {

   sqlite3_snprintf_str 2 {x%d %d %s} 10 10 {This is the string}

 } {x}

@@ -3685,6 +3709,9 @@ do_test printf-13.5 {

 do_test printf-13.6 {

   sqlite3_mprintf_hexdouble %.20f fff8000000000000

 } {NaN}

+do_test printf-13.7 {

+  sqlite3_mprintf_hexdouble %2147483648.10000f 4693b8b5b5056e17

+} {/100000000000000000000000000000000.00/}

 do_test printf-14.1 {

   sqlite3_mprintf_str {abc-%y-123} 0 0 {not used}