From 747cc9425d8a237f727770377620a5e8df0ae8a8 Mon Sep 17 00:00:00 2001 From: drh <> Date: Sat, 6 Mar 2021 13:02:12 +0000 Subject: [PATCH 1/4] Fix a possible NULL pointer dereference when applying a DROP COLUMN to a corrupt database schema. dbsqlfuzz 419aa525df93db6e463772c686ac6da27b46da9e FossilOrigin-Name: 349ccf58ae4bb770805066102fc8e9e478d4da1f7a6a728223bd74eabf7b7843 --- manifest | 14 +++++++------- manifest.uuid | 2 +- src/alter.c | 2 +- test/alterdropcol.test | 21 +++++++++++++++++++++ 4 files changed, 30 insertions(+), 9 deletions(-) diff --git a/manifest b/manifest index e4ce5d3f8d..8699339410 100644 --- a/manifest +++ b/manifest @@ -1,5 +1,5 @@ -C Modify\sthe\sSQLITE_DBCONFIG_ENABLE_VIEW\soption\sso\sthat\sit\salways\spermits\nTEMP\sviews,\sjust\sas\sSQLITE_DBCONFIG_ENABLE_TRIGGER\salways\spermits\sTEMP\ntriggers. -D 2021-03-05T18:33:01.185 +C Fix\sa\spossible\sNULL\spointer\sdereference\swhen\sapplying\sa\sDROP\sCOLUMN\sto\sa\ncorrupt\sdatabase\sschema.\s\sdbsqlfuzz\s419aa525df93db6e463772c686ac6da27b46da9e +D 2021-03-06T13:02:12.531 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea F LICENSE.md df5091916dbb40e6e9686186587125e1b2ff51f022cc334e886c19a0e9982724 @@ -476,7 +476,7 @@ F spec.template 86a4a43b99ebb3e75e6b9a735d5fd293a24e90ca F sqlite.pc.in 42b7bf0d02e08b9e77734a47798d1a55a9e0716b F sqlite3.1 fc7ad8990fc8409983309bb80de8c811a7506786 F sqlite3.pc.in 48fed132e7cb71ab676105d2a4dc77127d8c1f3a -F src/alter.c ba30a3a5678ca1541a5ee743ca065cb288af661105c38f6d7f98ea758a3f86f1 +F src/alter.c 99618c6098c02b5e4ca73f8861895ad94539d37103e5058e00b519d9bdf23b5d F src/analyze.c 01c6c6765cb4d40b473b71d85535093730770bb186f2f473abac25f07fcdee5c F src/attach.c 9cbe761e464025694df8e6f6ee4d9f41432c3a255ca9443ccbb4130eeb87cf72 F src/auth.c 08954fdc4cc2da5264ba5b75cfd90b67a6fc7d1710a02ccf917c38eadec77853 @@ -649,7 +649,7 @@ F test/alterauth.test 63442ba61ceb0c1eeb63aac1f4f5cebfa509d352276059d27106ae256b F test/alterauth2.test 794ac5cef251819fe364b4fe20f12f86e9c5d68070513c7fd26c17cb244c89af F test/altercol.test 65eef562f0eea7a1f5ddd4a140c4274c2bfc5712bb2ab2096f738852b0efce86 F test/altercorrupt.test 584d707a80e106952d6382790c8919bcf9f0db678ed3a1c09fd98b7f9d1d3a10 -F test/alterdropcol.test baad37ff9b07078ea02dcc33dbfb82bde655f3eee5c453e218f69501c36f02ba +F test/alterdropcol.test 596623cb8a72d9570bfb8417b0f302810efe007873796f03c17a9e9ff28dade1 F test/alterdropcol2.test 3948c805ca52f4621051b35968c18c09d107eb117e2b656c78cee3b2870650c0 F test/alterlegacy.test f38c6d06cda39e1f7b955bbce57f2e3ef5b7cb566d3d1234502093e228c15811 F test/altermalloc.test 167a47de41b5c638f5f5c6efb59784002b196fff70f98d9b4ed3cd74a3fb80c9 @@ -1909,7 +1909,7 @@ F vsixtest/vsixtest.tcl 6a9a6ab600c25a91a7acc6293828957a386a8a93 F vsixtest/vsixtest.vcxproj.data 2ed517e100c66dc455b492e1a33350c1b20fbcdc F vsixtest/vsixtest.vcxproj.filters 37e51ffedcdb064aad6ff33b6148725226cd608e F vsixtest/vsixtest_TemporaryKey.pfx e5b1b036facdb453873e7084e1cae9102ccc67a0 -P 6b41b136fbfc0b56a6948f2306b69fb1d69306adb86674a15a87fe3b52062512 -R 2b8fdfb64aa0287e9dad9e4deafc2264 +P 83dab8b358b6832a221a58e74dd5e99b9cdea4eee65124bb6799881e867d989c +R 2ab2b4158df160ad1d5d72fc4ecf15ba U drh -Z 2672fe284ccfad8e2f3910b2a1b2092c +Z 305267156f6c2c6b812a01b9b3e78e2e diff --git a/manifest.uuid b/manifest.uuid index 4153e89ec6..005ec9e754 100644 --- a/manifest.uuid +++ b/manifest.uuid @@ -1 +1 @@ -83dab8b358b6832a221a58e74dd5e99b9cdea4eee65124bb6799881e867d989c \ No newline at end of file +349ccf58ae4bb770805066102fc8e9e478d4da1f7a6a728223bd74eabf7b7843 \ No newline at end of file diff --git a/src/alter.c b/src/alter.c index 74f4128a47..e5a3f3b71c 100644 --- a/src/alter.c +++ b/src/alter.c @@ -1807,7 +1807,7 @@ static void dropColumnFunc( rc = renameParseSql(&sParse, zDb, db, zSql, iSchema==1); if( rc!=SQLITE_OK ) goto drop_column_done; pTab = sParse.pNewTable; - if( pTab->nCol==1 || iCol>=pTab->nCol ){ + if( pTab==0 || pTab->nCol==1 || iCol>=pTab->nCol ){ /* This can happen if the sqlite_schema table is corrupt */ rc = SQLITE_CORRUPT_BKPT; goto drop_column_done; diff --git a/test/alterdropcol.test b/test/alterdropcol.test index 1087f66328..3cca664151 100644 --- a/test/alterdropcol.test +++ b/test/alterdropcol.test @@ -255,4 +255,25 @@ do_catchsql_test 5.5.2 { ALTER TABLE c1 DROP COLUMN y } {1 {error in trigger tr: no such column: new.z}} +# 2021-03-06 dbsqlfuzz crash-419aa525df93db6e463772c686ac6da27b46da9e +reset_db +do_catchsql_test 6.0 { + CREATE TABLE t1(a,b,c); + CREATE TABLE t2(x,y,z); + PRAGMA writable_schema=ON; + UPDATE sqlite_schema SET sql='CREATE INDEX t1b ON t1(b)' WHERE name='t2'; + PRAGMA writable_schema=OFF; + ALTER TABLE t2 DROP COLUMN z; +} {1 {database disk image is malformed}} +reset_db +do_catchsql_test 6.1 { + CREATE TABLE t1(a,b,c); + CREATE TABLE t2(x,y,z); + PRAGMA writable_schema=ON; + UPDATE sqlite_schema SET sql='CREATE VIEW t2(x,y,z) AS SELECT b,a,c FROM t1' + WHERE name='t2'; + PRAGMA writable_schema=OFF; + ALTER TABLE t2 DROP COLUMN z; +} {1 {database disk image is malformed}} + finish_test From fa9011ec70ca6f2be38942c996d78d936cca644e Mon Sep 17 00:00:00 2001 From: dan Date: Sat, 6 Mar 2021 13:28:07 +0000 Subject: [PATCH 2/4] Fix a crash in fts3 that could occur when running a NEAR query on a corrupt database. FossilOrigin-Name: 609d94996324f3d3c12bb8cc04a2527d1d86c35cdb2267b5b34053c961158986 --- ext/fts3/fts3.c | 4 ++-- manifest | 16 ++++++++-------- manifest.uuid | 2 +- test/fts3corrupt6.test | 12 ++++++++++-- 4 files changed, 21 insertions(+), 13 deletions(-) diff --git a/ext/fts3/fts3.c b/ext/fts3/fts3.c index 79dc5c88ce..50fa88db8a 100644 --- a/ext/fts3/fts3.c +++ b/ext/fts3/fts3.c @@ -5212,9 +5212,9 @@ static int fts3EvalNearTrim( ); if( res ){ nNew = (int)(pOut - pPhrase->doclist.pList) - 1; - if( nNew>=0 ){ + assert_fts3_nc( nNew<=pPhrase->doclist.nList && nNew>0 ); + if( nNew>=0 && nNew<=pPhrase->doclist.nList ){ assert( pPhrase->doclist.pList[nNew]=='\0' ); - assert( nNew<=pPhrase->doclist.nList && nNew>0 ); memset(&pPhrase->doclist.pList[nNew], 0, pPhrase->doclist.nList - nNew); pPhrase->doclist.nList = nNew; } diff --git a/manifest b/manifest index 8699339410..63af06588f 100644 --- a/manifest +++ b/manifest @@ -1,5 +1,5 @@ -C Fix\sa\spossible\sNULL\spointer\sdereference\swhen\sapplying\sa\sDROP\sCOLUMN\sto\sa\ncorrupt\sdatabase\sschema.\s\sdbsqlfuzz\s419aa525df93db6e463772c686ac6da27b46da9e -D 2021-03-06T13:02:12.531 +C Fix\sa\scrash\sin\sfts3\sthat\scould\soccur\swhen\srunning\sa\sNEAR\squery\son\sa\scorrupt\sdatabase. +D 2021-03-06T13:28:07.450 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea F LICENSE.md df5091916dbb40e6e9686186587125e1b2ff51f022cc334e886c19a0e9982724 @@ -84,7 +84,7 @@ F ext/fts3/README.content b9078d0843a094d86af0d48dffbff13c906702b4c3558012e67b9c F ext/fts3/README.syntax a19711dc5458c20734b8e485e75fb1981ec2427a F ext/fts3/README.tokenizers b92bdeb8b46503f0dd301d364efc5ef59ef9fa8e2758b8e742f39fa93a2e422d F ext/fts3/README.txt 8c18f41574404623b76917b9da66fcb0ab38328d -F ext/fts3/fts3.c 4809e0b05af4519ad8bfa13d684f7ad635d1390a758299d2302f7e85c48ec160 +F ext/fts3/fts3.c 7b449348226a91cc851fe969f5c1932d4f00c359a32fd17f2afea92bf875147b F ext/fts3/fts3.h 3a10a0af180d502cecc50df77b1b22df142817fe F ext/fts3/fts3Int.h 045179f538c478ced266ca14327269cde8ad8d573c5be902230a5ebaa5636c59 F ext/fts3/fts3_aux.c 96708c8b3a7d9b8ca1b68ea2b7e503e283f20e95f145becadedfad096dbd0f34 @@ -970,7 +970,7 @@ F test/fts3corrupt2.test e318f0676e5e78d5a4b702637e2bb25265954c08a1b1e4aaf93c788 F test/fts3corrupt3.test 0d5b69a0998b4adf868cc301fc78f3d0707745f1d984ce044c205cdb764b491f F test/fts3corrupt4.test b71512ec391d39da96d60d01959e4e9f20d4237a964a94abcf5f5a2ad28378c1 F test/fts3corrupt5.test 0549f85ec4bd22e992f645f13c59b99d652f2f5e643dac75568bfd23a6db7ed5 -F test/fts3corrupt6.test b6c55218b704b0cef224b284c756f9c55d0afd0b3c3837618bffeaa8c31e0d8e +F test/fts3corrupt6.test d5896a8d389bd824457772dc1e2d2023cd5c5cf8e42733607b5d632103018d8b F test/fts3cov.test 7eacdbefd756cfa4dc2241974e3db2834e9b372ca215880e00032222f32194cf F test/fts3d.test 2bd8c97bcb9975f2334147173b4872505b6a41359a4f9068960a36afe07a679f F test/fts3defer.test f4c20e4c7153d20a98ee49ee5f3faef624fefc9a067f8d8d629db380c4d9f1de @@ -1909,7 +1909,7 @@ F vsixtest/vsixtest.tcl 6a9a6ab600c25a91a7acc6293828957a386a8a93 F vsixtest/vsixtest.vcxproj.data 2ed517e100c66dc455b492e1a33350c1b20fbcdc F vsixtest/vsixtest.vcxproj.filters 37e51ffedcdb064aad6ff33b6148725226cd608e F vsixtest/vsixtest_TemporaryKey.pfx e5b1b036facdb453873e7084e1cae9102ccc67a0 -P 83dab8b358b6832a221a58e74dd5e99b9cdea4eee65124bb6799881e867d989c -R 2ab2b4158df160ad1d5d72fc4ecf15ba -U drh -Z 305267156f6c2c6b812a01b9b3e78e2e +P 349ccf58ae4bb770805066102fc8e9e478d4da1f7a6a728223bd74eabf7b7843 +R 99ad288e4e2d388ef99aaf6ec992bb26 +U dan +Z f50a5e194b36647a536837a623a15642 diff --git a/manifest.uuid b/manifest.uuid index 005ec9e754..f669f77291 100644 --- a/manifest.uuid +++ b/manifest.uuid @@ -1 +1 @@ -349ccf58ae4bb770805066102fc8e9e478d4da1f7a6a728223bd74eabf7b7843 \ No newline at end of file +609d94996324f3d3c12bb8cc04a2527d1d86c35cdb2267b5b34053c961158986 \ No newline at end of file diff --git a/test/fts3corrupt6.test b/test/fts3corrupt6.test index 9e22bdf68a..5cb0a18691 100644 --- a/test/fts3corrupt6.test +++ b/test/fts3corrupt6.test @@ -11,8 +11,6 @@ # This file implements regression tests for SQLite library. The # focus of this script is testing the FTS3 module. # -# $Id: fts3aa.test,v 1.1 2007/08/20 17:38:42 shess Exp $ -# set testdir [file dirname $argv0] source $testdir/tester.tcl @@ -54,6 +52,16 @@ do_execsql_test 1.3 { SELECT 42+matchinfo(t1,'yxyyxy') FROM t1 WHERE t1 MATCH x'2b0a312b0a312a312a2a0b5d0a0b0b0a312a0a0b0b0a312a0b310a392a0b0a27312a2a0b5d0a312a0b310a31315d0b310a312a316d2a0b313b15bceaa50a312a0b0a27312a2a0b5d0a312a0b310a312b0b2a310a312a0b2a0b2a0b2e5d0a0bff313336e34a2a312a0b0a3c310b0a0b4b4b0b4b2a4bec40322b2a0b310a0a312a0a0a0a0a0a0a0a0a0b310a312a2a2a0b5d0a0b0b0a312a0b310a312a0b0a4e4541530b310a5df5ced70a0a0a0a0a4f520a0a0a0a0a0a0a312a0b0a4e4541520b310a5d616161610a0a0a0a4f520a0a0a0a0a0a312b0a312a312a0a0a0a0a0a0a004a0b0a310b220a0b0a310a4a22310a0b0a7e6fe0e0e030e0e0e0e0e01176e02000e0e0e0e0e01131320226310a0b0a310a4a22310a0b0a310a766f8b8b4ee0e0300ae0090909090909090909090909090909090909090909090909090909090909090947aaaa540b09090909090909090909090909090909090909090909090909090909090909fae0e0f2f22164e0e0f273e07fefefef7d6dfafafafa6d6d6d6d'; } {42} +#------------------------------------------------------------------------- +reset_db +do_execsql_test 2.0 { + CREATE VIRTUAL TABLE t0 USING fts3(a); + INSERT INTO t0_segdir VALUES(0,0,0,0,'0 42',X'000131030782000103323334050100fff200010461616161050101020200000462626262050101030200'); +} +do_execsql_test 2.1 { + SELECT count(*) FROM t0 WHERE t0 MATCH '(1 NEAR 1) AND (aaaa OR 1)'; +} 1 + set sqlite_fts3_enable_parentheses $saved_sqlite_fts3_enable_parentheses finish_test From 7f8653a2576e5f9381dba0ebc385be62627cc977 Mon Sep 17 00:00:00 2001 From: dan Date: Sat, 6 Mar 2021 14:46:24 +0000 Subject: [PATCH 3/4] Ensure the correct collation sequence is used for comparisons when delimiting a RANGE window. FossilOrigin-Name: 01eae68e85b31b7a9f08733459765bbd9bf9dad592bf64f10fc2fa32e02a89c2 --- manifest | 14 +++++++------- manifest.uuid | 2 +- src/window.c | 3 +++ test/windowB.test | 21 +++++++++++++++++++++ 4 files changed, 32 insertions(+), 8 deletions(-) diff --git a/manifest b/manifest index 63af06588f..fad8bea36b 100644 --- a/manifest +++ b/manifest @@ -1,5 +1,5 @@ -C Fix\sa\scrash\sin\sfts3\sthat\scould\soccur\swhen\srunning\sa\sNEAR\squery\son\sa\scorrupt\sdatabase. -D 2021-03-06T13:28:07.450 +C Ensure\sthe\scorrect\scollation\ssequence\sis\sused\sfor\scomparisons\swhen\sdelimiting\sa\sRANGE\swindow. +D 2021-03-06T14:46:24.660 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea F LICENSE.md df5091916dbb40e6e9686186587125e1b2ff51f022cc334e886c19a0e9982724 @@ -633,7 +633,7 @@ F src/where.c 10d06b16670a1d2a992d52a9f08e49426d38a08fb0a7ae5f7f62fd023d560e1e F src/whereInt.h 446e5e8018f83358ef917cf32d8e6a86dc8430113d0b17e720f1839d3faa44c4 F src/wherecode.c e57a8690311a75d06e723e8d379f9831de04aba300e07174d236e32a7f9c7a13 F src/whereexpr.c 53452fe2fb07be2f4cb17f55cc721416fae0092c00717f106faf289c990b6494 -F src/window.c fdf01316f6cecf060378aa1713a29e527ab683823ba7d15b8978ec70165e8bdb +F src/window.c 7e89ac4b6cd6bb9b7772234a625d19c39b530f4ac06e43688a8b7e6a1ab512a2 F test/8_3_names.test ebbb5cd36741350040fd28b432ceadf495be25b2 F test/affinity2.test ce1aafc86e110685b324e9a763eab4f2a73f737842ec3b687bd965867de90627 F test/affinity3.test eecb0dabee4b7765a8465439d5e99429279ffba23ca74a7eae270a452799f9e7 @@ -1781,7 +1781,7 @@ F test/window8.tcl f2711aa3571e4e6b0dad98db8d95fd6cb8d9db0c92bbdf535f153b07606a1 F test/window8.test c4331b27a6f66d69fa8f8bab10cc731db1a81d293ae108a68f7c3487fa94e65b F test/window9.test 4d8c875b73febdbac9b8f2b52ec132b98f48261cdafd6b08db62bc6d8ff913fc F test/windowA.test 6d63dc1260daa17141a55007600581778523a8b420629f1282d2acfc36af23be -F test/windowB.test 7a983ea1cc1cf72be7f378e4b32f6cb2d73014c5cd8b25aaee825164cd4269e5 +F test/windowB.test 6e601f8178ba8ba28b2f19e74fe613815084bb4a8d2ad942defc7d42e191e521 F test/windowerr.tcl f5acd6fbc210d7b5546c0e879d157888455cd4a17a1d3f28f07c1c8a387019e0 F test/windowerr.test a8b752402109c15aa1c5efe1b93ccb0ce1ef84fa964ae1cd6684dd0b3cc1819b F test/windowfault.test d543d46571b32d19f198cb04b6505747fabf3cc369970daae47074ee793612be @@ -1909,7 +1909,7 @@ F vsixtest/vsixtest.tcl 6a9a6ab600c25a91a7acc6293828957a386a8a93 F vsixtest/vsixtest.vcxproj.data 2ed517e100c66dc455b492e1a33350c1b20fbcdc F vsixtest/vsixtest.vcxproj.filters 37e51ffedcdb064aad6ff33b6148725226cd608e F vsixtest/vsixtest_TemporaryKey.pfx e5b1b036facdb453873e7084e1cae9102ccc67a0 -P 349ccf58ae4bb770805066102fc8e9e478d4da1f7a6a728223bd74eabf7b7843 -R 99ad288e4e2d388ef99aaf6ec992bb26 +P 609d94996324f3d3c12bb8cc04a2527d1d86c35cdb2267b5b34053c961158986 +R db89e2b7d3c5e3a81e5723194d4b07e1 U dan -Z f50a5e194b36647a536837a623a15642 +Z b79cc13d3c50fae401db3bee2bc7108c diff --git a/manifest.uuid b/manifest.uuid index f669f77291..e7de147c6e 100644 --- a/manifest.uuid +++ b/manifest.uuid @@ -1 +1 @@ -609d94996324f3d3c12bb8cc04a2527d1d86c35cdb2267b5b34053c961158986 \ No newline at end of file +01eae68e85b31b7a9f08733459765bbd9bf9dad592bf64f10fc2fa32e02a89c2 \ No newline at end of file diff --git a/src/window.c b/src/window.c index 09572ec033..26a82a9e33 100644 --- a/src/window.c +++ b/src/window.c @@ -2065,6 +2065,7 @@ static void windowCodeRangeTest( int regString = ++pParse->nMem; /* Reg. for constant value '' */ int arith = OP_Add; /* OP_Add or OP_Subtract */ int addrGe; /* Jump destination */ + CollSeq *pColl; assert( op==OP_Ge || op==OP_Gt || op==OP_Le ); assert( pOrderBy && pOrderBy->nExpr==1 ); @@ -2155,6 +2156,8 @@ static void windowCodeRangeTest( ** control skips over this test if the BIGNULL flag is set and either ** reg1 or reg2 contain a NULL value. */ sqlite3VdbeAddOp3(v, op, reg2, lbl, reg1); VdbeCoverage(v); + pColl = sqlite3ExprNNCollSeq(pParse, pOrderBy->a[0].pExpr); + sqlite3VdbeAppendP4(v, (void*)pColl, P4_COLLSEQ); sqlite3VdbeChangeP5(v, SQLITE_NULLEQ); assert( op==OP_Ge || op==OP_Gt || op==OP_Lt || op==OP_Le ); diff --git a/test/windowB.test b/test/windowB.test index 321c481406..30380aee20 100644 --- a/test/windowB.test +++ b/test/windowB.test @@ -336,4 +336,25 @@ do_execsql_test 7.4 { ) FROM t1; } {{} 45 {} 45 7 {} 7 {} 8 {} 8 {} abc 1001 abc 1001 xyz 3333} +#------------------------------------------------------------------------- +reset_db +do_execsql_test 8.0 { + BEGIN TRANSACTION; + CREATE TABLE t1(a, c); + INSERT INTO t1 VALUES('aa', 111); + INSERT INTO t1 VALUES('BB', 660); + INSERT INTO t1 VALUES('CC', 938); + INSERT INTO t1 VALUES('dd', 979); + COMMIT; + + CREATE INDEX i1 ON t1(a COLLATE nocase); +} + +do_execsql_test 8.1 { + SELECT sum(c) OVER + (ORDER BY a COLLATE nocase RANGE BETWEEN 10.0 PRECEDING AND 5.0 PRECEDING) + FROM t1; +} {111 660 938 979} + + finish_test From 4bb4293b2ad683689281eb93ed5f38c106dba8e8 Mon Sep 17 00:00:00 2001 From: drh <> Date: Sat, 6 Mar 2021 15:13:26 +0000 Subject: [PATCH 4/4] Limit parenthesis nesting depth in FTS3 expressions to SQLITE_MAX_EXPR_DEPTH. FossilOrigin-Name: 5ddd8032ef9ecd5b53909d304c8f1375a72f270fd7810964cb4e385e25bedd4f --- ext/fts3/fts3_expr.c | 5 +++++ manifest | 14 +++++++------- manifest.uuid | 2 +- 3 files changed, 13 insertions(+), 8 deletions(-) diff --git a/ext/fts3/fts3_expr.c b/ext/fts3/fts3_expr.c index e19137a03d..7a69a935f0 100644 --- a/ext/fts3/fts3_expr.c +++ b/ext/fts3/fts3_expr.c @@ -493,6 +493,11 @@ static int getNextNode( if( *zInput=='(' ){ int nConsumed = 0; pParse->nNest++; +#if !defined(SQLITE_MAX_EXPR_DEPTH) + if( pParse->nNest>1000 ) return SQLITE_ERROR; +#elif SQLITE_MAX_EXPR_DEPTH>0 + if( pParse->nNest>SQLITE_MAX_EXPR_DEPTH ) return SQLITE_ERROR; +#endif rc = fts3ExprParse(pParse, zInput+1, nInput-1, ppExpr, &nConsumed); *pnConsumed = (int)(zInput - z) + 1 + nConsumed; return rc; diff --git a/manifest b/manifest index fad8bea36b..20d179021a 100644 --- a/manifest +++ b/manifest @@ -1,5 +1,5 @@ -C Ensure\sthe\scorrect\scollation\ssequence\sis\sused\sfor\scomparisons\swhen\sdelimiting\sa\sRANGE\swindow. -D 2021-03-06T14:46:24.660 +C Limit\sparenthesis\snesting\sdepth\sin\sFTS3\sexpressions\sto\nSQLITE_MAX_EXPR_DEPTH. +D 2021-03-06T15:13:26.136 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea F LICENSE.md df5091916dbb40e6e9686186587125e1b2ff51f022cc334e886c19a0e9982724 @@ -88,7 +88,7 @@ F ext/fts3/fts3.c 7b449348226a91cc851fe969f5c1932d4f00c359a32fd17f2afea92bf87514 F ext/fts3/fts3.h 3a10a0af180d502cecc50df77b1b22df142817fe F ext/fts3/fts3Int.h 045179f538c478ced266ca14327269cde8ad8d573c5be902230a5ebaa5636c59 F ext/fts3/fts3_aux.c 96708c8b3a7d9b8ca1b68ea2b7e503e283f20e95f145becadedfad096dbd0f34 -F ext/fts3/fts3_expr.c f081e38da641724cd72c20e23b71db2bf4d0c9517c14637442f6910259f11a34 +F ext/fts3/fts3_expr.c 5853cd7a35a79d193614add9b4c461b2d56f465d90899ca4309f05d9d1536558 F ext/fts3/fts3_hash.c 8b6e31bfb0844c27dc6092c2620bdb1fca17ed613072db057d96952c6bdb48b7 F ext/fts3/fts3_hash.h 39cf6874dc239d6b4e30479b1975fe5b22a3caaf F ext/fts3/fts3_icu.c 305ce7fb6036484085b5556a9c8e62acdc7763f0f4cdf5fd538212a9f3720116 @@ -1909,7 +1909,7 @@ F vsixtest/vsixtest.tcl 6a9a6ab600c25a91a7acc6293828957a386a8a93 F vsixtest/vsixtest.vcxproj.data 2ed517e100c66dc455b492e1a33350c1b20fbcdc F vsixtest/vsixtest.vcxproj.filters 37e51ffedcdb064aad6ff33b6148725226cd608e F vsixtest/vsixtest_TemporaryKey.pfx e5b1b036facdb453873e7084e1cae9102ccc67a0 -P 609d94996324f3d3c12bb8cc04a2527d1d86c35cdb2267b5b34053c961158986 -R db89e2b7d3c5e3a81e5723194d4b07e1 -U dan -Z b79cc13d3c50fae401db3bee2bc7108c +P 01eae68e85b31b7a9f08733459765bbd9bf9dad592bf64f10fc2fa32e02a89c2 +R 02b7be7b0db655498be572d780795257 +U drh +Z 8b3ef9b5e97e19a6fa18878f5257830d diff --git a/manifest.uuid b/manifest.uuid index e7de147c6e..e9ca6e7784 100644 --- a/manifest.uuid +++ b/manifest.uuid @@ -1 +1 @@ -01eae68e85b31b7a9f08733459765bbd9bf9dad592bf64f10fc2fa32e02a89c2 \ No newline at end of file +5ddd8032ef9ecd5b53909d304c8f1375a72f270fd7810964cb4e385e25bedd4f \ No newline at end of file