Fix another buffer overread in fts5 that may occur when accessing a corrupt database.

FossilOrigin-Name: 760d14374d40bcd9ce3a89771c18dc236c9728553c4747c9b7452ee7b24f4140
2019-01-30 12:15:27 +00:00
parent 3f4f6823ac
commit dd579233e8
4 changed files with 229 additions and 10 deletions
@@ -3104,7 +3104,8 @@ static void fts5SegiterPoslist(
  Fts5Colset *pColset,
  Fts5Buffer *pBuf
 ){
-  if( 0==fts5BufferGrow(&p->rc, pBuf, pSeg->nPos) ){
+  if( 0==fts5BufferGrow(&p->rc, pBuf, pSeg->nPos+FTS5_DATA_ZERO_PADDING) ){
+    memset(&pBuf->p[pBuf->n+pSeg->nPos], 0, FTS5_DATA_ZERO_PADDING);
    if( pColset==0 ){
      fts5ChunkIterate(p, pSeg, (void*)pBuf, fts5PoslistCallback);
    }else{