Fix the fts3DecodeIntArray() function so that it will not read off the end

of the buffer it is handed. Any unread integers are set to zero. FossilOrigin-Name: 666cf8f6b39ae1f72e82b45e9cacba23caf61370ca0c695b3b14452accbb1a0d
2019-01-10 01:12:43 +00:00
parent a47e45f734
commit c49d43a787
3 changed files with 17 additions and 15 deletions
@@ -3327,14 +3327,16 @@ static void fts3DecodeIntArray(
  const char *zBuf,  /* The BLOB containing the varints */
  int nBuf           /* size of the BLOB */
 ){
-  int i, j;
-  UNUSED_PARAMETER(nBuf);
-  for(i=j=0; i<N; i++){
-    sqlite3_int64 x;
-    j += sqlite3Fts3GetVarint(&zBuf[j], &x);
-    assert(j<=nBuf);
-    a[i] = (u32)(x & 0xffffffff);
+  int i = 0;
+  if( nBuf && (zBuf[nBuf-1]&0x80)==0 ){
+    int j;
+    for(i=j=0; i<N && j<nBuf; i++){
+      sqlite3_int64 x;
+      j += sqlite3Fts3GetVarint(&zBuf[j], &x);
+      a[i] = (u32)(x & 0xffffffff);
+    }
  }
+  while( i<N ) a[i++] = 0;
 }

 /*