0b9f4ee89c
Fix harmless compiler warnings.
...
FossilOrigin-Name: dd0c161fcd1619518cd4671d64afb6afeec44c140ec176ccb8616d381a88f42f
2026-06-11 22:48:16 +00:00
d688d1551a
Improved detection of corrupt node IDs in RTree shadow tables.
...
Test case in TH3.
FossilOrigin-Name: e01a185a699d0c4ad2341ce2114bc826f02768735cef67179a1127229a073d03
2026-06-11 01:31:19 +00:00
2bd7ac6716
Fix a signed-integer overflow in fts5 that might occur when dealing with strategicly corrupted records. Bug [bugs:/info/2026-06-10T03:56:42Z | 2026-06-10T03:56:42Z].
...
FossilOrigin-Name: fc6442ee54795fbeb746539193716238aa653d80170523bc327ae3ce0d945ebf
2026-06-10 16:51:20 +00:00
49edbe2150
Detect an OOM condition in the realpath() function of the fileio.c extension
...
and cause that function to return NULL. To Do: we should go back in and
fix realpath() to raise an SQLITE_NOMEM error on OOM rather than returning
NULL. But we will delay that, in as much as OOMs are all but impossible
on modern OSes.
[bug:/info/2026-06-10T07:46:32Z|Bug 2026-06-10T07:46:32Z].
FossilOrigin-Name: 8b961dc3d27c5aa62a5dc7c2e44f8b505817e184f8499f3bb903e06b5aec1b72
2026-06-10 10:40:29 +00:00
062016c2fd
Fix a possible signed integer overflow in the RBU extension given a
...
maliciously crafted delta.
[bugs:/info/2026-06-10T06:41:54Z|Bug 2026-06-10T06:41:54Z].
FossilOrigin-Name: 8531c0c3b61771592b055b0c22e903b8301a4161c7bcb7f9fc54d730b080d095
2026-06-10 10:13:11 +00:00
84ead09d94
Harden code that processes Fossil Deltas against OOM and maliciously
...
malformed delta blobs.
[bugs:/info/2026-06-10T07:01:00Z|Bug 2026-06-10T07:01:00Z] and
[bugs:/info/2026-06-10T07:06:43Z|Bug 2026-06-10T07:06:43Z].
FossilOrigin-Name: 67271c31292bc1bddbb5e144c881c85c9f91b3963a1db4bae1f738adab50f7c0
2026-06-10 09:51:33 +00:00
2cb57d9d4a
Avoid a possible integer overflow when fts5 tokenizes a very large document. Only possible with non-standard builds that use large values of SQLITE_MAX_LENGTH. Bug [bugs:/info/2026-06-09T05:27:16Z | 2026-06-09T05:27:16Z].
...
FossilOrigin-Name: d562e91374e2bebcf75a00776b4def532bb71914a07e37c8507f7a5918db1d3b
2026-06-09 10:43:37 +00:00
082e41f17b
Fix another buffer overread in fts5 when processing corrupt records. Bug [bugs:/info/2026-06-08T16:03:39Z | 2026-06-08T16:03:39Z ].
...
FossilOrigin-Name: 8ba5acabf9a0273ffbc2ba0bacc7f0b000690db91081858e4e563d6cbeeb4e7a
2026-06-08 17:48:00 +00:00
19a2ba1f5b
Fix a buffer overread that could occur in fts5 when processing corrupt records. Bug [bugs:/info/2026-06-08T11:15:52Z | 2026-06-08T11:15:52Z]
...
FossilOrigin-Name: b07441cfc06b8e6b47a4f4a6e0f5c261da580d5afe82444cc7f42a9f39ea7026
2026-06-08 15:20:49 +00:00
b677c5afd4
Avoid a potential use-after-free in fts5. Report [bugs:/info/2026-06-08T08:45:27Z | 2026-06-08T08:45:27Z].
...
FossilOrigin-Name: 9c018b02dbfb071c748d540ad679a4dbdc0fb88a62988e02cb51a3403509febe
2026-06-08 12:03:52 +00:00
7340b032d1
Clamp the nToken parameter to the fts5 snippet() function between 0 and 64. It has always been documented this way, but not previously implemented. Report [bugs:/info/2026-06-08T08:29:00Z | 2026-06-08T08:29:00Z].
...
FossilOrigin-Name: 4af1d9b3e54a7c42552e61284456bbd7089e525d4aa55e580f7518956d8521bb
2026-06-08 11:24:05 +00:00
076db92d85
Fix a possible NULL pointer derefence in the (experimental and untested)
...
uuid.c extension.
[bugs:/info/2026-06-04T09:50:59Z|Bug 2026-06-04T09:50:59Z].
FossilOrigin-Name: fa6374fe3ae1530f0b5ba10b7e6fb703ffe5dd592c532a965e7d50b7d2d70a5f
2026-06-04 11:42:23 +00:00
95d072cc81
Clearly mark the ext/misc/wholenumber.c extension as "testing and
...
debugging use only". Fix a potential integer overflow that can occur
if the above warning is ignored.
[bugs:/info/2026-06-04T09:40:28Z|Bug 2026-06-04T09:40:28Z].
FossilOrigin-Name: 44154ea9ae99d532d5c7268d70bd8b32751f7a82c367c7bd1ec0e6948d71d1b8
2026-06-04 11:18:11 +00:00
0120735de1
Update the utf-8 decoder in the ICU extension to treat invalid sequences as codepoint 0xFFFD, matching the core. Report [bugs:/info/2026-06-03T04:04:46Z | 2026-06-03T04:04:46Z].
...
FossilOrigin-Name: 840be0ee62c0ba34f4916c382e2d07071bebd8ce7bca31deb1616869722bfa4d
2026-06-03 17:21:12 +00:00
d80528ad4d
Fix a faulty assert() in rtree that could fire when processing an unusually large record. Bug [bugs:/info/2026-06-03T14:44:46Z | 2026-06-03T14:44:46Z].
...
FossilOrigin-Name: e7335dd377a73fc2b913076ee659ed2b0c4a131b16e04b1b55fae677d6b56e8a
2026-06-03 16:46:15 +00:00
c2d29194a8
Use tail recursion on the larger of the two partitions when doing a
...
quicksort as part of the implementation of the median() function,
to avoid excess stack usage on pathological inputs.
[bugs:/info/2026-06-03T07:26:42Z|Bug 2026-06-03T07:26:42Z].
FossilOrigin-Name: 7dc987165c030c260ba90a8878291b5ceb037c48c2f437a8fb3f05b6c4f84fde
2026-06-03 16:21:17 +00:00
61523e22f9
Fix an integer overflow problem in fts3 that could lead to a buffer overwrite on platforms where size_t is 32-bits. Bug [bugs:/info/2026-06-03T04:28:51Z | 2026-06-03T04:28:51Z].
...
FossilOrigin-Name: ef0c66d2a2e0b8f523633efca66a97236bb5a502525eb6a00a28a350ec7c76e6
2026-06-03 15:29:59 +00:00
51b2c3863b
Fix another buffer overread in fts5 that could occur when processing corrupt records. Bug [bugs:/info/2026-06-03T03:54:40Z | 2026-06-03T03:54:40Z].
...
FossilOrigin-Name: b5337c87cc314e6830615e4efe2d4723fa7cedf87ce404f60d6e520aeab77cbc
2026-06-03 14:58:13 +00:00
6feeafc7de
Fix another potential buffer overrun that could occur in fts5 when processing corrupt records.
...
FossilOrigin-Name: 6ee44b199512b8cac604bf062f893a9047af4b5bfc881bb7cb69ae42d0a0adb4
2026-06-03 13:49:33 +00:00
a735462db6
Fix a potential UAF bug in the zipfile extension.
...
[bugs:/info/2026-06-03T10:58:51Z|Bug 2026-06-03T10:58:51Z].
FossilOrigin-Name: 1fb5e9169ace6bea2bdf9013f39002c1ce5dc9ce51d6007bec22d91f456c15f0
2026-06-03 13:12:20 +00:00
d2240cc988
Fix negative array index in "testing and debugging uses only" extension
...
qpvtab.c.
[bugs:/info/2026-06-03T07:26:26Z|Bug 2026-06-03T07:26:26Z].
FossilOrigin-Name: d066699fcacd87496645f3aa3c4049935410ae2451879a033102304c80273deb
2026-06-03 12:43:50 +00:00
942b7c555a
Avoid excessive recursion and stack overflow in fts3 when processing a corrupt
...
database.
FossilOrigin-Name: 21369378769195f20f839231f625582552eaa3f79044ca3e3efb7f9476b515a8
2026-06-03 11:37:45 +00:00
069e5acd63
The prefix_length() function should stop at the first NUL terminator.
...
[bugs:/info/2026-06-03T07:42:00Z|Bug 2026-06-03T07:42:00Z].
FossilOrigin-Name: a9b8bdea0683bb03015ea1ee38f75636c80c189eed4b786b6d3d654a831cfdfb
2026-06-03 11:07:47 +00:00
1c0a370472
Make the (unused, untested, and unsupported) ext/misc/compress.c routines
...
responsive to OOM conditions.
[bugs:/info/2026-06-03T08:28:36Z|Bug 2026-06-03T08:28:36Z].
FossilOrigin-Name: e3120e2a4339d51210645b14d075abba27dd97bd6bd6d42f445dd5baf3d337e3
2026-06-03 10:55:08 +00:00
2acb57c1be
Fix a case where sqlite3expert could be tricked into executing arbitrary SQL by a corrupt database schema.
...
FossilOrigin-Name: 8a633070e62bdc83a7cf895fd1a22c04b13579659df7cee9584d95096bfffab1
2026-06-02 15:20:37 +00:00
62d17739bc
Better handle a (possibly) potential buffer overrun in fts5. Based on the report in [bugs:/info/38e75aa4f9 | 2026-05-31T09:06:13Z].
...
FossilOrigin-Name: 9d0e39408075f22dd56ad5fb50ef458c0cd6a4ec234dd43b3a5f5e0ac4447b61
2026-06-01 15:03:53 +00:00
5481274912
Fix an integer overflow that could lead to a buffer overrun in the zipfile extension. Bug [bugs:/info/2026-06-01T10:16:47Z | 2026-06-01T10:16:47Z].
...
FossilOrigin-Name: 7c740d2cfd22a89258be2221860ca10985f0fc16dc7a17a99fc282d7105dc38e
2026-06-01 10:56:11 +00:00
6c218ba0ad
Extra defenses against integer overflows in the untested, unused, and
...
unsupported transliterate() SQL extension function found in the
ext/misc/spellfix.c extension.
[bugs:/info/2026-06-01T10:34:57Z|Bug 2026-06-01T10:34:57Z].
FossilOrigin-Name: 2b073519b6080abc8872b0728c64827cc088d1b43f132cd2aeb396f06de3d36f
2026-06-01 10:53:28 +00:00
1cd9eb3811
Fix the zipfile extension so that ZIP archives containing files whose names
...
contain embedded \000 bytes do not cause problems.
[bugs:/info/2026-05-31T11:43:05Z|Bug 2026-05-31T11:43:05Z].
FossilOrigin-Name: c12ff342a90c61a0a82c8e63d2d94fecec10dff498da666873ff6aaa15c23dfd
2026-05-31 15:49:57 +00:00
72f0bd609c
Add a test to ensure an application does not try to create a geopoly
...
virtual table with too many columns.
[bugs:/info/2026-05-30T12:47:27Z|Bug 2026-05-30T12:47:27Z].
FossilOrigin-Name: 2c605bfb1562d7a3609ad6ffd7446def12f1ac7084e41b9c6723e998c156501d
2026-05-30 13:23:25 +00:00
7aad2942c2
Harden the diskused.c extension against NULL pointer deferences that
...
might have previously occurred when given a corrupt database file.
[bug:/info/2026-05-30T07:08:55Z|Bug 2026-05-30T07:08:55Z].
FossilOrigin-Name: 7487a1c59d3aaea9f8b2569dca76bbccf21948b1e7bd8a1d841e04382db696f4
2026-05-30 10:24:03 +00:00
07ded24fbb
Remove the untested and undocumented "scrub" utility program. It was written
...
in 2016, but made obsolete by the [VACUUM INTO] command in 2019.
FossilOrigin-Name: 27d67fb175e839f6e7450f54166b52e0a6137c075758511da32fd82c57c310c4
2026-05-30 10:09:33 +00:00
3d006d0d00
Rename the ext/misc/analyze.c extension to ext/misc/diskused.c, to avoid
...
confusion with the src/analyze.c file. The function is now called
"diskused(X)" instead of "analyze(X)". The CLI command is renamed
from ".dbstat" to ".diskused".
FossilOrigin-Name: c7839f7a1749b38f8a36c06d93a7b59095e91ce753e8dd020de273ca8f73a239
2026-05-29 14:57:38 +00:00
6a8e887a64
Avoid a resource leak in an error path in the icu extension.
...
FossilOrigin-Name: 87c37dab7e53d1bd891f3fed624963b35ab15a785706d0964b5d07ab70421c10
2026-05-28 11:29:05 +00:00
43ab3c2a84
Fix an infinite loop that can occur in the unused, untested, and
...
unsupported ext/misc/btreeinfo.c extension if it is presented with
a corrupt database file.
[bugs:/forumpost/b43c44cc1c|Bug 2026-05-28T05:41:01Z].
FossilOrigin-Name: 646e9b49153ebd7e09e3ef72cc4f64fb685d0cfd8b158ef7d11d37c50c3f0b7e
2026-05-28 11:16:55 +00:00
9b7ea5700b
Fix a problem with shell tool function analyze() and schema objects with name containing "%" characters.
...
FossilOrigin-Name: c6d5793d5d2212c979e2fe5eb12c3844bfc1f2029bd8d076fec030a04f6d4bb5
2026-05-28 11:12:29 +00:00
6e3e557c81
Fix a potential 1-byte overread in sqlite3changeset_invert() when processing a corrupt buffer.
...
FossilOrigin-Name: 78eaa605cb6c14e5bd49a898b4c737957bd60c8714913cc2341f4ffe3bfe81fe
2026-05-26 15:03:30 +00:00
18bee1617f
Fix a 32-bit integer overflow in sqlite3changegroup_change_blob() that could lead to a buffer overwrite.
...
FossilOrigin-Name: 8a289158e2baeee8aa5e601bde46b0482361064ede09e4108f519270efdd5f69
2026-05-26 14:18:50 +00:00
2315f282be
Fix QRF so that it works sensibly with "--wrap 1"
...
FossilOrigin-Name: 48f950b2a1ef841d915ca733baf324a1af98e644b660f238dd5018015340a6c6
2026-05-26 13:54:57 +00:00
5554aa27e6
Fix HTML ">" quoting in QRF.
...
[bugs:/forumpost/f72dfbdeff|Bug f72dfbdeff].
FossilOrigin-Name: 5cee1097b47d850989ebecdb9d2c814e6968240fe3bacb5598ca85067cb95692
2026-05-25 23:44:37 +00:00
00ba6a6635
Fix a potential buffer overwrite that could occur when in fts5 when handling corrupt records.
...
FossilOrigin-Name: de009593f692251c4a033742b1e79c4ddb5ddcb174209d58c4d1bea19ceb360c
2026-05-25 17:09:37 +00:00
f380599476
Add the SQLITE_CHANGESETAPPLY_NOUPDATELOOP option to the sqlite3_changeset_apply_v2/3() method. To disable the extra processing to commit changesets that swap two or more values subject to a UNIQUE constraint between rows.
...
FossilOrigin-Name: eba02092bcf1713a646ecf8febd53a83bc803cf1b17e2e4fc590c14d886a8d27
2026-05-22 14:22:14 +00:00
de739c3450
Merge latest trunk changes with this branch.
...
FossilOrigin-Name: c6226d508d6af28fcd42fecd482014c3e284923871d3d8f5177f728cbf3457c5
2026-05-21 15:13:17 +00:00
c597ed79d1
Fix a buffer overread in the session module that could occur when processing a corrupt changeset.
...
FossilOrigin-Name: 869a51ae84dfaaf824c872e4b3024f35eea7fa67bb584759a2d42ebf8404ef6e
2026-05-21 14:58:36 +00:00
da18b56b25
Limit the length of inputs to the spellfix1_editdist() extension
...
function (not part of the standard SQLite build and rarely used)
to 99999 characters, to avoid any possibility of integer overflow.
[bugs:/forumpost/5da728247a|Bug 5da728247a].
FossilOrigin-Name: 51ebf0e04efcbe982e62f2228553700b8c1147a37c70fdfaa0e377184b3ac936
2026-05-21 13:37:15 +00:00
b869ed6b06
Fix a bug causing the session module to dereference a NULL pointer when applying a corrupt changeset.
...
FossilOrigin-Name: e807d4e3798efd532b3d78d1dfe513ed4fbd3cb793dd0ae5c30cae6031422b10
2026-05-20 15:06:34 +00:00
ccf23dadea
Check-in [7cf841f3613c8302] was incomplete in that it did not remove
...
the incorrect assert() statement. Fixed here.
FossilOrigin-Name: c19bacca13f699953bbf50afb867035a94080b8a48111cf3d87bced880a3e620
2026-05-20 11:53:15 +00:00
d3dc8e5ae5
Avoid returning an SQLITE_SCHEMA error from within sqlite3session_diff() if the schema has been recently modified. First <a href= https://sqlite.org/bugs/forumpost/269f1e9cef >reported here</a>.
...
FossilOrigin-Name: 20110547a117912be68d91bc006e92c45beffde16c6bcdf062bf8971c9a9a864
2026-05-20 11:41:24 +00:00
8154476ff8
Fix a potential buffer overread in fts5 that could occur when handling corrupt records.
...
FossilOrigin-Name: 70021c3291b38192832c99fa4d8155249dd39f5b26334595c71f5cee66d13ebb
2026-05-19 20:27:54 +00:00
d258b93356
Silently ignore nested porter tokenizers in FTS5. Having nested porter
...
tokenizers is pointless, but it does use stack space unnecessarily.
[bugs:/forumpost/a7766198f1|Bug report a7766198f1].
FossilOrigin-Name: 0bdeedf56c9d7209d1ea8f950d0ef03c78cbf677528d9d30c5f4ec48c4e1a571
2026-05-19 19:33:49 +00:00
drh