Improved detection of shadow table corruption in the fts5_decode() SQL function.

FossilOrigin-Name: b74e5f3f3057ee7a98ebcb14ca0751048eacbec8fca3e11e241883029a57ecdf
2019-01-12 00:45:20 +00:00
parent 3e534eac19
commit 5d4589014a
3 changed files with 15 additions and 7 deletions
@@ -6398,6 +6398,10 @@ static void fts5DecodeFunction(
    }else{
      iOff = szLeaf;
    }
+    if( iOff>n ){
+      rc = FTS5_CORRUPT;
+      goto decode_out;
+    }
    fts5DecodePoslist(&rc, &s, &a[4], iOff-4);

    /* Decode any more doclist data that appears on the page before the
@@ -6434,6 +6438,10 @@ static void fts5DecodeFunction(
        term.n = nByte;
      }
      iOff += fts5GetVarint32(&a[iOff], nByte);
+      if( iOff+nByte>n ){
+        rc = FTS5_CORRUPT;
+        break;
+      }
      fts5BufferAppendBlob(&rc, &term, nByte, &a[iOff]);
      iOff += nByte;