Blame sqlite-3.28.0-fts5-buffer-overread.patch
|
 |
678cd3d |
Index: ext/fts5/fts5_hash.c
|
|
|
678cd3d |
==================================================================
|
|
|
678cd3d |
--- ext/fts5/fts5_hash.c
|
|
|
678cd3d |
+++ ext/fts5/fts5_hash.c
|
|
|
678cd3d |
@@ -454,11 +454,13 @@
|
|
|
678cd3d |
memset(ap, 0, sizeof(Fts5HashEntry*) * nMergeSlot);
|
|
|
678cd3d |
|
|
|
678cd3d |
for(iSlot=0; iSlot<pHash->nSlot; iSlot++){
|
|
|
678cd3d |
Fts5HashEntry *pIter;
|
|
|
678cd3d |
for(pIter=pHash->aSlot[iSlot]; pIter; pIter=pIter->pHashNext){
|
|
|
678cd3d |
- if( pTerm==0 || 0==memcmp(fts5EntryKey(pIter), pTerm, nTerm) ){
|
|
|
678cd3d |
+ if( pTerm==0
|
|
|
678cd3d |
+ || (pIter->nKey+1>=nTerm && 0==memcmp(fts5EntryKey(pIter), pTerm, nTerm))
|
|
|
678cd3d |
+ ){
|
|
|
678cd3d |
Fts5HashEntry *pEntry = pIter;
|
|
|
678cd3d |
pEntry->pScanNext = 0;
|
|
|
678cd3d |
for(i=0; ap[i]; i++){
|
|
|
678cd3d |
pEntry = fts5HashEntryMerge(pEntry, ap[i]);
|
|
|
678cd3d |
ap[i] = 0;
|
|
|
678cd3d |
|
|
|
678cd3d |
Index: ext/fts5/test/fts5aa.test
|
|
|
678cd3d |
==================================================================
|
|
|
678cd3d |
--- ext/fts5/test/fts5aa.test
|
|
|
678cd3d |
+++ ext/fts5/test/fts5aa.test
|
|
|
678cd3d |
@@ -619,10 +619,23 @@
|
|
|
678cd3d |
INSERT INTO t12(t12) VALUES('integrity-check');
|
|
|
678cd3d |
}
|
|
|
678cd3d |
do_execsql_test 24.3 {
|
|
|
678cd3d |
SELECT * FROM t12('aaaa');
|
|
|
678cd3d |
} {aaaa}
|
|
|
678cd3d |
+
|
|
|
678cd3d |
+#-------------------------------------------------------------------------
|
|
|
678cd3d |
+do_execsql_test 25.0 {
|
|
|
678cd3d |
+ CREATE VIRTUAL TABLE t13 USING fts5(x, detail=%DETAIL%);
|
|
|
678cd3d |
+}
|
|
|
678cd3d |
+do_execsql_test 25.1 {
|
|
|
678cd3d |
+ BEGIN;
|
|
|
678cd3d |
+ INSERT INTO t13 VALUES('AAAA');
|
|
|
678cd3d |
+SELECT * FROM t13('BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB*');
|
|
|
678cd3d |
+
|
|
|
678cd3d |
+ END;
|
|
|
678cd3d |
+}
|
|
|
678cd3d |
+
|
|
|
678cd3d |
|
|
|
678cd3d |
}
|
|
|
678cd3d |
|
|
|
678cd3d |
expand_all_sql db
|
|
|
678cd3d |
finish_test
|