From 5e8980ddb1394cf09d39ced95e8ce69680289daa Mon Sep 17 00:00:00 2001 From: drh Date: Tue, 25 Mar 2014 20:28:38 +0000 Subject: [PATCH 1/5] Adjust the repeat counts on several tests in speedtest1 so that the relative time spent on the test is roughly the same regardless of --size. FossilOrigin-Name: 7922809ee0d3978ce9221fbb7df63aa0684d0c4d --- manifest | 12 ++++++------ manifest.uuid | 2 +- test/speedtest1.c | 8 ++++---- 3 files changed, 11 insertions(+), 11 deletions(-) diff --git a/manifest b/manifest index d9f3760dc0..c0390453c4 100644 --- a/manifest +++ b/manifest @@ -1,5 +1,5 @@ -C Add\sanother\sperformance\stest\scase\sto\sspeedtest1.\s\sThis\scase\sis\sanother\nORDER\sBY\stest\sbut\sthis\stime\swithout\sLIMIT. -D 2014-03-25T17:45:49.623 +C Adjust\sthe\srepeat\scounts\son\sseveral\stests\sin\sspeedtest1\sso\sthat\sthe\srelative\ntime\sspent\son\sthe\stest\sis\sroughly\sthe\ssame\sregardless\sof\s--size. +D 2014-03-25T20:28:38.512 F Makefile.arm-wince-mingw32ce-gcc d6df77f1f48d690bd73162294bbba7f59507c72f F Makefile.in 2ef13430cd359f7b361bb863504e227b25cc7f81 F Makefile.linux-gcc 91d710bdc4998cb015f39edf3cb314ec4f4d7e23 @@ -825,7 +825,7 @@ F test/speed3.test d32043614c08c53eafdc80f33191d5bd9b920523 F test/speed4.test abc0ad3399dcf9703abed2fff8705e4f8e416715 F test/speed4p.explain 6b5f104ebeb34a038b2f714150f51d01143e59aa F test/speed4p.test 0e51908951677de5a969b723e03a27a1c45db38b -F test/speedtest1.c 2bec93920c6d26adfa781b509b1c9ca0a4d8f39d +F test/speedtest1.c 90446861e566a9965a8d005381a3c964ff333646 F test/spellfix.test 61309f5efbec53603b3f86457d34a504f80abafe F test/sqllimits1.test b1aae27cc98eceb845e7f7adf918561256e31298 F test/stat.test 76fd746b85459e812a0193410fb599f0531f22de @@ -1159,7 +1159,7 @@ F tool/vdbe_profile.tcl 67746953071a9f8f2f668b73fe899074e2c6d8c1 F tool/warnings-clang.sh f6aa929dc20ef1f856af04a730772f59283631d4 F tool/warnings.sh d1a6de74685f360ab718efda6265994b99bbea01 F tool/win/sqlite.vsix 030f3eeaf2cb811a3692ab9c14d021a75ce41fff -P 588122641e57e957813d329ea071e13ccbde5acd -R 6b6fe86503bb240eaed31036f5ef1e04 +P 9ab7ffd59209aef0ffbf384b3902a93fd3b86a6d +R 8ec1b9b9d2439aad92a9a0c48f5fc5b8 U drh -Z 513f3088d16b4a60fe04e39489233db6 +Z 44fa9dae5e4277ca9cc29c89c29e96c1 diff --git a/manifest.uuid b/manifest.uuid index 0289c1d2a0..52ad9d7d36 100644 --- a/manifest.uuid +++ b/manifest.uuid @@ -1 +1 @@ -9ab7ffd59209aef0ffbf384b3902a93fd3b86a6d \ No newline at end of file +7922809ee0d3978ce9221fbb7df63aa0684d0c4d \ No newline at end of file diff --git a/test/speedtest1.c b/test/speedtest1.c index b39493354d..28c24e0885 100644 --- a/test/speedtest1.c +++ b/test/speedtest1.c @@ -474,7 +474,7 @@ void testset_main(void){ speedtest1_end_test(); - n = g.szTest/2; + n = 25; speedtest1_begin_test(130, "%d SELECTS, numeric BETWEEN, unindexed", n); speedtest1_exec("BEGIN"); speedtest1_prepare( @@ -492,7 +492,7 @@ void testset_main(void){ speedtest1_end_test(); - n = g.szTest/5; + n = 10; speedtest1_begin_test(140, "%d SELECTS, LIKE, unindexed", n); speedtest1_exec("BEGIN"); speedtest1_prepare( @@ -512,7 +512,7 @@ void testset_main(void){ speedtest1_end_test(); - n = g.szTest/5; + n = 10; speedtest1_begin_test(142, "%d SELECTS w/ORDER BY, unindexed", n); speedtest1_exec("BEGIN"); speedtest1_prepare( @@ -531,7 +531,7 @@ void testset_main(void){ speedtest1_exec("COMMIT"); speedtest1_end_test(); - n = g.szTest/5; + n = 10; //g.szTest/5; speedtest1_begin_test(145, "%d SELECTS w/ORDER BY and LIMIT, unindexed", n); speedtest1_exec("BEGIN"); speedtest1_prepare( From e2ac506704e76a26352626788910d62f00dd1f63 Mon Sep 17 00:00:00 2001 From: drh Date: Wed, 26 Mar 2014 12:02:38 +0000 Subject: [PATCH 2/5] Add an assert() and a comment to clarify the operation of the vdbeRecordCompareInt() routine. FossilOrigin-Name: 851abdb8fd9b5a8a6ce21db53d30dbac3c430cc7 --- manifest | 12 ++++++------ manifest.uuid | 2 +- src/vdbeaux.c | 4 ++++ 3 files changed, 11 insertions(+), 7 deletions(-) diff --git a/manifest b/manifest index c0390453c4..ce3e7af4be 100644 --- a/manifest +++ b/manifest @@ -1,5 +1,5 @@ -C Adjust\sthe\srepeat\scounts\son\sseveral\stests\sin\sspeedtest1\sso\sthat\sthe\srelative\ntime\sspent\son\sthe\stest\sis\sroughly\sthe\ssame\sregardless\sof\s--size. -D 2014-03-25T20:28:38.512 +C Add\san\sassert()\sand\sa\scomment\sto\sclarify\sthe\soperation\sof\sthe\nvdbeRecordCompareInt()\sroutine. +D 2014-03-26T12:02:38.907 F Makefile.arm-wince-mingw32ce-gcc d6df77f1f48d690bd73162294bbba7f59507c72f F Makefile.in 2ef13430cd359f7b361bb863504e227b25cc7f81 F Makefile.linux-gcc 91d710bdc4998cb015f39edf3cb314ec4f4d7e23 @@ -282,7 +282,7 @@ F src/vdbe.c 74c7386e83eee56f921a17bb4a0396c9551f5bc7 F src/vdbe.h fb2c48c198300a7c632f09fc940011d2ad2fc2ae F src/vdbeInt.h 2b9a6849166d0014c843ae3fd83a062be4efa325 F src/vdbeapi.c 0ed6053f947edd0b30f64ce5aeb811872a3450a4 -F src/vdbeaux.c 68dbdc77cdc008eeabc088b8b8a60aa743ba8d2a +F src/vdbeaux.c 9898720db88a8e733acce7d72fbd56f4565d6d82 F src/vdbeblob.c 15377abfb59251bccedd5a9c7d014a895f0c04aa F src/vdbemem.c 6fc77594c60f6155404f3f8d71bf36d1fdeb4447 F src/vdbesort.c 4abb7c0f8f19b7d7d82f4558d5da1a30fdf9ea38 @@ -1159,7 +1159,7 @@ F tool/vdbe_profile.tcl 67746953071a9f8f2f668b73fe899074e2c6d8c1 F tool/warnings-clang.sh f6aa929dc20ef1f856af04a730772f59283631d4 F tool/warnings.sh d1a6de74685f360ab718efda6265994b99bbea01 F tool/win/sqlite.vsix 030f3eeaf2cb811a3692ab9c14d021a75ce41fff -P 9ab7ffd59209aef0ffbf384b3902a93fd3b86a6d -R 8ec1b9b9d2439aad92a9a0c48f5fc5b8 +P 7922809ee0d3978ce9221fbb7df63aa0684d0c4d +R 0dc0a56d9b4e58b2ad9ea1b209a9c778 U drh -Z 44fa9dae5e4277ca9cc29c89c29e96c1 +Z d2e0055a9ca933f7d0981ccf44961bc7 diff --git a/manifest.uuid b/manifest.uuid index 52ad9d7d36..7ab08ac131 100644 --- a/manifest.uuid +++ b/manifest.uuid @@ -1 +1 @@ -7922809ee0d3978ce9221fbb7df63aa0684d0c4d \ No newline at end of file +851abdb8fd9b5a8a6ce21db53d30dbac3c430cc7 \ No newline at end of file diff --git a/src/vdbeaux.c b/src/vdbeaux.c index 0d2299bab1..18862028e4 100644 --- a/src/vdbeaux.c +++ b/src/vdbeaux.c @@ -3589,6 +3589,9 @@ int sqlite3VdbeRecordCompare( ** that (a) the first field of pPKey2 is an integer, and (b) the ** size-of-header varint at the start of (pKey1/nKey1) fits in a single ** byte (i.e. is less than 128). +** +** To avoid concerns about buffer overreads, this routine is only used +** on schemas where the maximum valid header size is 63 bytes or less. */ static int vdbeRecordCompareInt( int nKey1, const void *pKey1, /* Left key */ @@ -3605,6 +3608,7 @@ static int vdbeRecordCompareInt( UNUSED_PARAMETER(bSkip); assert( bSkip==0 ); + assert( (*(u8*)pKey1)<=0x3F || CORRUPT_DB ); switch( serial_type ){ case 1: { /* 1-byte signed integer */ lhs = ONE_BYTE_INT(aKey); From 182ea4e3246fce6a468625812f1bf603b9690a30 Mon Sep 17 00:00:00 2001 From: drh Date: Wed, 26 Mar 2014 14:51:07 +0000 Subject: [PATCH 3/5] Earlier detection of corruption in sqlite3VdbeRecordCompare() in order to avoid a potential buffer overread. FossilOrigin-Name: 28ddecff044dbc2dff50a7d8406ab67dfe06587f --- manifest | 14 +++++++------- manifest.uuid | 2 +- src/vdbeaux.c | 1 + test/corruptI.test | 6 +----- 4 files changed, 10 insertions(+), 13 deletions(-) diff --git a/manifest b/manifest index ce3e7af4be..b9c9cba60c 100644 --- a/manifest +++ b/manifest @@ -1,5 +1,5 @@ -C Add\san\sassert()\sand\sa\scomment\sto\sclarify\sthe\soperation\sof\sthe\nvdbeRecordCompareInt()\sroutine. -D 2014-03-26T12:02:38.907 +C Earlier\sdetection\sof\scorruption\sin\ssqlite3VdbeRecordCompare()\sin\sorder\sto\navoid\sa\spotential\sbuffer\soverread. +D 2014-03-26T14:51:07.017 F Makefile.arm-wince-mingw32ce-gcc d6df77f1f48d690bd73162294bbba7f59507c72f F Makefile.in 2ef13430cd359f7b361bb863504e227b25cc7f81 F Makefile.linux-gcc 91d710bdc4998cb015f39edf3cb314ec4f4d7e23 @@ -282,7 +282,7 @@ F src/vdbe.c 74c7386e83eee56f921a17bb4a0396c9551f5bc7 F src/vdbe.h fb2c48c198300a7c632f09fc940011d2ad2fc2ae F src/vdbeInt.h 2b9a6849166d0014c843ae3fd83a062be4efa325 F src/vdbeapi.c 0ed6053f947edd0b30f64ce5aeb811872a3450a4 -F src/vdbeaux.c 9898720db88a8e733acce7d72fbd56f4565d6d82 +F src/vdbeaux.c f81ef920dcf76aceaa1ce77081e9fc5d7a0993dd F src/vdbeblob.c 15377abfb59251bccedd5a9c7d014a895f0c04aa F src/vdbemem.c 6fc77594c60f6155404f3f8d71bf36d1fdeb4447 F src/vdbesort.c 4abb7c0f8f19b7d7d82f4558d5da1a30fdf9ea38 @@ -405,7 +405,7 @@ F test/corruptE.test 193b4ca4e927e77c1d5f4f56203ddc998432a7ee F test/corruptF.test be9fde98e4c93648f1ba52b74e5318edc8f59fe4 F test/corruptG.test 58ec333a01997fe655e34e5bea52b7a2a6b9704d F test/corruptH.test 88ed71a086e13591c917aac6de32750e7c7281cb -F test/corruptI.test 88886ec9cd1bdba835263566bbf60ee009c6ea09 +F test/corruptI.test 645794bfc0bbcb962df34302a52118b0ed6a21fb F test/count.test 42a251178e32f617eda33f76236a7f79825a50b5 F test/coveridxscan.test cdb47d01acc4a634a34fd25abe85189e0d0f1e62 F test/crash.test fb9dc4a02dcba30d4aa5c2c226f98b220b2b959f @@ -1159,7 +1159,7 @@ F tool/vdbe_profile.tcl 67746953071a9f8f2f668b73fe899074e2c6d8c1 F tool/warnings-clang.sh f6aa929dc20ef1f856af04a730772f59283631d4 F tool/warnings.sh d1a6de74685f360ab718efda6265994b99bbea01 F tool/win/sqlite.vsix 030f3eeaf2cb811a3692ab9c14d021a75ce41fff -P 7922809ee0d3978ce9221fbb7df63aa0684d0c4d -R 0dc0a56d9b4e58b2ad9ea1b209a9c778 +P 851abdb8fd9b5a8a6ce21db53d30dbac3c430cc7 +R 08734d76a115f4a142a4825f21f3cdab U drh -Z d2e0055a9ca933f7d0981ccf44961bc7 +Z 2973842cba6cb939f8ad2063fb07de64 diff --git a/manifest.uuid b/manifest.uuid index 7ab08ac131..8e8ee672b5 100644 --- a/manifest.uuid +++ b/manifest.uuid @@ -1 +1 @@ -851abdb8fd9b5a8a6ce21db53d30dbac3c430cc7 \ No newline at end of file +28ddecff044dbc2dff50a7d8406ab67dfe06587f \ No newline at end of file diff --git a/src/vdbeaux.c b/src/vdbeaux.c index 18862028e4..f5e4b0a9fc 100644 --- a/src/vdbeaux.c +++ b/src/vdbeaux.c @@ -3434,6 +3434,7 @@ int sqlite3VdbeRecordCompare( }else{ idx1 = getVarint32(aKey1, szHdr1); d1 = szHdr1; + if( d1>(unsigned)nKey1 ) return 1; /* Corruption */ i = 0; } diff --git a/test/corruptI.test b/test/corruptI.test index 51cf64c9be..c2eec8ba70 100644 --- a/test/corruptI.test +++ b/test/corruptI.test @@ -40,13 +40,9 @@ do_test 1.2 { set offset [hexio_get_int [hexio_read test.db [expr 2*1024 + 8] 2]] set off [expr 2*1024 + $offset + 1] hexio_write test.db $off FF06 - - breakpoint - sqlite3 db test.db catchsql { SELECT * FROM t1 WHERE a = 10 } -} {1 {database disk image is malformed}} +} {0 {}} finish_test - From d9c131c3664b224dc7be2f30149bc73b6c2b47c5 Mon Sep 17 00:00:00 2001 From: drh Date: Wed, 26 Mar 2014 15:05:56 +0000 Subject: [PATCH 4/5] Add a test case to verify that the previous change avoids excess buffer overread in sqlite3VdbeRecordCompare(). FossilOrigin-Name: 2b28e8d582cf10936fa1faca04a16ca2eeead66f --- manifest | 12 ++++++------ manifest.uuid | 2 +- test/corruptI.test | 13 +++++++++++-- 3 files changed, 18 insertions(+), 9 deletions(-) diff --git a/manifest b/manifest index b9c9cba60c..be675fdb5a 100644 --- a/manifest +++ b/manifest @@ -1,5 +1,5 @@ -C Earlier\sdetection\sof\scorruption\sin\ssqlite3VdbeRecordCompare()\sin\sorder\sto\navoid\sa\spotential\sbuffer\soverread. -D 2014-03-26T14:51:07.017 +C Add\sa\stest\scase\sto\sverify\sthat\sthe\sprevious\schange\savoids\sexcess\sbuffer\noverread\sin\ssqlite3VdbeRecordCompare(). +D 2014-03-26T15:05:56.169 F Makefile.arm-wince-mingw32ce-gcc d6df77f1f48d690bd73162294bbba7f59507c72f F Makefile.in 2ef13430cd359f7b361bb863504e227b25cc7f81 F Makefile.linux-gcc 91d710bdc4998cb015f39edf3cb314ec4f4d7e23 @@ -405,7 +405,7 @@ F test/corruptE.test 193b4ca4e927e77c1d5f4f56203ddc998432a7ee F test/corruptF.test be9fde98e4c93648f1ba52b74e5318edc8f59fe4 F test/corruptG.test 58ec333a01997fe655e34e5bea52b7a2a6b9704d F test/corruptH.test 88ed71a086e13591c917aac6de32750e7c7281cb -F test/corruptI.test 645794bfc0bbcb962df34302a52118b0ed6a21fb +F test/corruptI.test 487e9e5eac227fca974eed0a0bd5791cccc9eb86 F test/count.test 42a251178e32f617eda33f76236a7f79825a50b5 F test/coveridxscan.test cdb47d01acc4a634a34fd25abe85189e0d0f1e62 F test/crash.test fb9dc4a02dcba30d4aa5c2c226f98b220b2b959f @@ -1159,7 +1159,7 @@ F tool/vdbe_profile.tcl 67746953071a9f8f2f668b73fe899074e2c6d8c1 F tool/warnings-clang.sh f6aa929dc20ef1f856af04a730772f59283631d4 F tool/warnings.sh d1a6de74685f360ab718efda6265994b99bbea01 F tool/win/sqlite.vsix 030f3eeaf2cb811a3692ab9c14d021a75ce41fff -P 851abdb8fd9b5a8a6ce21db53d30dbac3c430cc7 -R 08734d76a115f4a142a4825f21f3cdab +P 28ddecff044dbc2dff50a7d8406ab67dfe06587f +R 6b54752b8296f7dffb679821462bd1b5 U drh -Z 2973842cba6cb939f8ad2063fb07de64 +Z 7c53e6dad71c7413b3950e5c5e55a2eb diff --git a/manifest.uuid b/manifest.uuid index 8e8ee672b5..bdd003989c 100644 --- a/manifest.uuid +++ b/manifest.uuid @@ -1 +1 @@ -28ddecff044dbc2dff50a7d8406ab67dfe06587f \ No newline at end of file +2b28e8d582cf10936fa1faca04a16ca2eeead66f \ No newline at end of file diff --git a/test/corruptI.test b/test/corruptI.test index c2eec8ba70..bb8d984938 100644 --- a/test/corruptI.test +++ b/test/corruptI.test @@ -32,14 +32,23 @@ do_execsql_test 1.1 { PRAGMA auto_vacuum=0; CREATE TABLE t1(a); CREATE INDEX i1 ON t1(a); - INSERT INTO t1 VALUES('a'); + INSERT INTO t1 VALUES('abcdefghijklmnop'); } {} db close do_test 1.2 { set offset [hexio_get_int [hexio_read test.db [expr 2*1024 + 8] 2]] set off [expr 2*1024 + $offset + 1] - hexio_write test.db $off FF06 + hexio_write test.db $off 7f06 + sqlite3 db test.db + catchsql { SELECT * FROM t1 WHERE a = 10 } +} {0 {}} + +do_test 1.3 { + db close + set offset [hexio_get_int [hexio_read test.db [expr 2*1024 + 8] 2]] + set off [expr 2*1024 + $offset + 1] + hexio_write test.db $off FFFF7f02 sqlite3 db test.db catchsql { SELECT * FROM t1 WHERE a = 10 } } {0 {}} From 68916c9fd3d9829a462a993ded1e58fca82637d2 Mon Sep 17 00:00:00 2001 From: dan Date: Wed, 26 Mar 2014 15:14:59 +0000 Subject: [PATCH 5/5] Add an extra test case for the potential buffer overread patched by [28ddecff04]. FossilOrigin-Name: f585f5d7a0f9bf8c590388654a3638231eba8892 --- manifest | 14 +++++++------- manifest.uuid | 2 +- test/corruptI.test | 22 ++++++++++++++++++++++ 3 files changed, 30 insertions(+), 8 deletions(-) diff --git a/manifest b/manifest index be675fdb5a..fed419c7cf 100644 --- a/manifest +++ b/manifest @@ -1,5 +1,5 @@ -C Add\sa\stest\scase\sto\sverify\sthat\sthe\sprevious\schange\savoids\sexcess\sbuffer\noverread\sin\ssqlite3VdbeRecordCompare(). -D 2014-03-26T15:05:56.169 +C Add\san\sextra\stest\scase\sfor\sthe\spotential\sbuffer\soverread\spatched\sby\s[28ddecff04]. +D 2014-03-26T15:14:59.762 F Makefile.arm-wince-mingw32ce-gcc d6df77f1f48d690bd73162294bbba7f59507c72f F Makefile.in 2ef13430cd359f7b361bb863504e227b25cc7f81 F Makefile.linux-gcc 91d710bdc4998cb015f39edf3cb314ec4f4d7e23 @@ -405,7 +405,7 @@ F test/corruptE.test 193b4ca4e927e77c1d5f4f56203ddc998432a7ee F test/corruptF.test be9fde98e4c93648f1ba52b74e5318edc8f59fe4 F test/corruptG.test 58ec333a01997fe655e34e5bea52b7a2a6b9704d F test/corruptH.test 88ed71a086e13591c917aac6de32750e7c7281cb -F test/corruptI.test 487e9e5eac227fca974eed0a0bd5791cccc9eb86 +F test/corruptI.test 1b796461e5b635e0a74e3c4ecb1121c82d319dff F test/count.test 42a251178e32f617eda33f76236a7f79825a50b5 F test/coveridxscan.test cdb47d01acc4a634a34fd25abe85189e0d0f1e62 F test/crash.test fb9dc4a02dcba30d4aa5c2c226f98b220b2b959f @@ -1159,7 +1159,7 @@ F tool/vdbe_profile.tcl 67746953071a9f8f2f668b73fe899074e2c6d8c1 F tool/warnings-clang.sh f6aa929dc20ef1f856af04a730772f59283631d4 F tool/warnings.sh d1a6de74685f360ab718efda6265994b99bbea01 F tool/win/sqlite.vsix 030f3eeaf2cb811a3692ab9c14d021a75ce41fff -P 28ddecff044dbc2dff50a7d8406ab67dfe06587f -R 6b54752b8296f7dffb679821462bd1b5 -U drh -Z 7c53e6dad71c7413b3950e5c5e55a2eb +P 2b28e8d582cf10936fa1faca04a16ca2eeead66f +R 76c12b0a4284d7654cb2771b2fc9c8eb +U dan +Z 22c3e1f8cdae5a20dae420dc313d8edd diff --git a/manifest.uuid b/manifest.uuid index bdd003989c..bdc4496d4e 100644 --- a/manifest.uuid +++ b/manifest.uuid @@ -1 +1 @@ -2b28e8d582cf10936fa1faca04a16ca2eeead66f \ No newline at end of file +f585f5d7a0f9bf8c590388654a3638231eba8892 \ No newline at end of file diff --git a/test/corruptI.test b/test/corruptI.test index bb8d984938..087a0f3b01 100644 --- a/test/corruptI.test +++ b/test/corruptI.test @@ -53,5 +53,27 @@ do_test 1.3 { catchsql { SELECT * FROM t1 WHERE a = 10 } } {0 {}} +do_test 2.0 { + execsql { + CREATE TABLE r(x); + INSERT INTO r VALUES('ABCDEFGHIJK'); + CREATE INDEX r1 ON r(x); + } + set pg [db one {SELECT rootpage FROM sqlite_master WHERE name = 'r1'}] +} {5} + +do_test 2.1 { + db close + set offset [hexio_get_int [hexio_read test.db [expr (5-1)*1024 + 8] 2]] + set off [expr (5-1)*1024 + $offset + 1] + hexio_write test.db $off FFFF0004 + sqlite3 db test.db + catchsql { SELECT * FROM r WHERE x >= 10.0 } +} {1 {database disk image is malformed}} + +do_test 2.2 { + catchsql { SELECT * FROM r WHERE x >= 10 } +} {1 {database disk image is malformed}} + finish_test