Fix an out-of-bounds read in SQL function fts5_decode() that could occur if it

was passed a corrupt record. FossilOrigin-Name: 931278b257b12ac14fc8fbc82c6dc88ce4ac4b8e0d668543e68f0289d825daa1
2019-01-09 21:12:23 +00:00
parent 1757fed87f
commit a47e45f734
4 changed files with 169 additions and 10 deletions
@@ -6409,7 +6409,7 @@ static void fts5DecodeFunction(
    nDoclist = (iTermOff ? iTermOff : szLeaf) - iOff;
    fts5DecodeDoclist(&rc, &s, &a[iOff], nDoclist);

-    while( iPgidxOff<n ){
+    while( iPgidxOff<n && rc==SQLITE_OK ){
      int bFirst = (iPgidxOff==szLeaf);     /* True for first term on page */
      int nByte;                            /* Bytes of data */
      int iEnd;
@@ -6427,6 +6427,10 @@ static void fts5DecodeFunction(

      if( bFirst==0 ){
        iOff += fts5GetVarint32(&a[iOff], nByte);
+        if( nByte>term.n ){
+          rc = FTS5_CORRUPT;
+          goto decode_out;
+        }
        term.n = nByte;
      }
      iOff += fts5GetVarint32(&a[iOff], nByte);