Fix a buffer overwrite in fts3 that could occur while processing NEAR queries against corrupt records. Bug [bugs:/info/2026-06-11T23:11:26Z | 2026-06-11T23:11:26Z].

FossilOrigin-Name: b0f773e99eb45cde0953e4870a0a7436c35277c95146fdab3aa06ebbc076c79e
2026-06-12 15:36:26 +00:00
parent 124f449319
commit 865a8f3072
4 changed files with 31 additions and 11 deletions
@@ -2073,8 +2073,13 @@ static void fts3PutDeltaVarint(
  sqlite3_int64 iVal              /* Write this value to the list */
 ){
  assert_fts3_nc( iVal-*piPrev > 0 || (*piPrev==0 && iVal==0) );
-  *pp += sqlite3Fts3PutVarint(*pp, iVal-*piPrev);
-  *piPrev = iVal;
+  if( iVal-(*piPrev)>=0 ){
+    /* Refuse to write a negative delta integer. This only happens with a 
+    ** corrupt db (see the assert above) and can cause buffer overwrites
+    ** in some cases.  */
+    *pp += sqlite3Fts3PutVarint(*pp, iVal-*piPrev);
+    *piPrev = iVal;
+  }
 }

 /*