Fix another buffer overrun that could occur when quering a corrupt database using an fts5vocab table.

FossilOrigin-Name: b80119bd6044c0993210115732b6ae7b4b0b29c1471b0723bef24f2052c8e671
2019-01-31 14:37:18 +00:00
parent 6a0db87a2f
commit b92b019fe3
5 changed files with 142 additions and 11 deletions
@@ -1652,7 +1652,7 @@ static void fts5SegIterLoadTerm(Fts5Index *p, Fts5SegIter *pIter, int nKeep){
  int nNew;                       /* Bytes of new data */

  iOff += fts5GetVarint32(&a[iOff], nNew);
-  if( iOff+nNew>pIter->pLeaf->szLeaf || nKeep>pIter->term.n ){
+  if( iOff+nNew>pIter->pLeaf->szLeaf || nKeep>pIter->term.n || nNew==0 ){
    p->rc = FTS5_CORRUPT;
    return;
  }