From: Dan Kennedy Date: Sat, 3 Nov 2018 16:51:30 +0000 (+0000) Subject: Add extra defenses against strategically corrupt databases to fts3/4. X-Git-Url: https://repo.or.cz/sqlite.git/commitdiff_plain/19816852d4e82e115338b1997540c26a1b794d18 Add extra defenses against strategically corrupt databases to fts3/4. --- diff --git a/ext/fts3/fts3.c b/ext/fts3/fts3.c index d0e6d9be21..3897054c7c 100644 --- a/ext/fts3/fts3.c +++ b/ext/fts3/fts3.c @@ -1821,7 +1821,7 @@ static int fts3ScanInteriorNode( const char *zCsr = zNode; /* Cursor to iterate through node */ const char *zEnd = &zCsr[nNode];/* End of interior node buffer */ char *zBuffer = 0; /* Buffer to load terms into */ - int nAlloc = 0; /* Size of allocated buffer */ + i64 nAlloc = 0; /* Size of allocated buffer */ int isFirstTerm = 1; /* True when processing first term on page */ sqlite3_int64 iChild; /* Block id of child node to descend to */ @@ -1859,14 +1859,14 @@ static int fts3ScanInteriorNode( zCsr += fts3GetVarint32(zCsr, &nSuffix); assert( nPrefix>=0 && nSuffix>=0 ); - if( &zCsr[nSuffix]>zEnd ){ + if( nPrefix>zCsr-zNode || nSuffix>zEnd-zCsr ){ rc = FTS_CORRUPT_VTAB; goto finish_scan; } - if( nPrefix+nSuffix>nAlloc ){ + if( (i64)nPrefix+nSuffix>nAlloc ){ char *zNew; - nAlloc = (nPrefix+nSuffix) * 2; - zNew = (char *)sqlite3_realloc(zBuffer, nAlloc); + nAlloc = ((i64)nPrefix+nSuffix) * 2; + zNew = (char *)sqlite3_realloc64(zBuffer, nAlloc); if( !zNew ){ rc = SQLITE_NOMEM; goto finish_scan; diff --git a/ext/fts3/fts3_write.c b/ext/fts3/fts3_write.c index 0baf82b76e..8fc6589121 100644 --- a/ext/fts3/fts3_write.c +++ b/ext/fts3/fts3_write.c @@ -1374,15 +1374,19 @@ static int fts3SegReaderNext( ** safe (no risk of overread) even if the node data is corrupted. */ pNext += fts3GetVarint32(pNext, &nPrefix); pNext += fts3GetVarint32(pNext, &nSuffix); - if( nPrefix<0 || nSuffix<=0 - || &pNext[nSuffix]>&pReader->aNode[pReader->nNode] + if( nSuffix<=0 + || (&pReader->aNode[pReader->nNode] - pNext)pReader->nTermAlloc ){ return FTS_CORRUPT_VTAB; } - if( nPrefix+nSuffix>pReader->nTermAlloc ){ - int nNew = (nPrefix+nSuffix)*2; - char *zNew = sqlite3_realloc(pReader->zTerm, nNew); + /* Both nPrefix and nSuffix were read by fts3GetVarint32() and so are + ** between 0 and 0x7FFFFFFF. But the sum of the two may cause integer + ** overflow - hence the (i64) casts. */ + if( (i64)nPrefix+nSuffix>(i64)pReader->nTermAlloc ){ + i64 nNew = ((i64)nPrefix+nSuffix)*2; + char *zNew = sqlite3_realloc64(pReader->zTerm, nNew); if( !zNew ){ return SQLITE_NOMEM; } @@ -1404,7 +1408,7 @@ static int fts3SegReaderNext( ** b-tree node. And that the final byte of the doclist is 0x00. If either ** of these statements is untrue, then the data structure is corrupt. */ - if( &pReader->aDoclist[pReader->nDoclist]>&pReader->aNode[pReader->nNode] + if( (&pReader->aNode[pReader->nNode] - pReader->aDoclist)nDoclist || (pReader->nPopulate==0 && pReader->aDoclist[pReader->nDoclist-1]) ){ return FTS_CORRUPT_VTAB; @@ -3730,6 +3734,9 @@ static int nodeReaderNext(NodeReader *p){ } p->iOff += fts3GetVarint32(&p->aNode[p->iOff], &nSuffix); + if( nPrefix>p->iOff || nSuffix>p->nNode-p->iOff ){ + return SQLITE_CORRUPT_VTAB; + } blobGrowBuffer(&p->term, nPrefix+nSuffix, &rc); if( rc==SQLITE_OK ){ memcpy(&p->term.a[nPrefix], &p->aNode[p->iOff], nSuffix); @@ -3737,6 +3744,9 @@ static int nodeReaderNext(NodeReader *p){ p->iOff += nSuffix; if( p->iChild==0 ){ p->iOff += fts3GetVarint32(&p->aNode[p->iOff], &p->nDoclist); + if( (p->nNode-p->iOff)nDoclist ){ + return SQLITE_CORRUPT_VTAB; + } p->aDoclist = &p->aNode[p->iOff]; p->iOff += p->nDoclist; } @@ -3744,7 +3754,6 @@ static int nodeReaderNext(NodeReader *p){ } assert( p->iOff<=p->nNode ); - return rc; } diff --git a/test/fts3corrupt4.test b/test/fts3corrupt4.test new file mode 100644 index 0000000000..52c3d8caf4 --- /dev/null +++ b/test/fts3corrupt4.test @@ -0,0 +1,147 @@ +# 2006 September 9 +# +# The author disclaims copyright to this source code. In place of +# a legal notice, here is a blessing: +# +# May you do good and not evil. +# May you find forgiveness for yourself and forgive others. +# May you share freely, never taking more than you give. +# +#************************************************************************* +# This file implements regression tests for SQLite library. The +# focus of this script is testing the FTS3 module. +# +# $Id: fts3aa.test,v 1.1 2007/08/20 17:38:42 shess Exp $ +# + +set testdir [file dirname $argv0] +source $testdir/tester.tcl +set testprefix fts3corrupt4 + +# If SQLITE_ENABLE_FTS3 is defined, omit this file. +ifcapable !fts3 { + finish_test + return +} + +do_execsql_test 1.0 { + BEGIN; + CREATE VIRTUAL TABLE ft USING fts3; + INSERT INTO ft VALUES('aback'); + INSERT INTO ft VALUES('abaft'); + INSERT INTO ft VALUES('abandon'); + COMMIT; +} + +proc blob {a} { binary decode hex $a } +db func blob blob + +do_execsql_test 1.1 { + SELECT quote(root) FROM ft_segdir; +} {X'0005616261636B03010200030266740302020003046E646F6E03030200'} + +do_execsql_test 1.2 { + UPDATE ft_segdir SET root = blob( + '0005616261636B03010200 FFFFFFFF0702 66740302020003046E646F6E03030200' + ); +} + +do_catchsql_test 1.3 { + SELECT * FROM ft WHERE ft MATCH 'abandon'; +} {1 {database disk image is malformed}} + +#------------------------------------------------------------------------- +reset_db +do_execsql_test 2.0.0 { + CREATE VIRTUAL TABLE ft USING fts3; + INSERT INTO ft(ft) VALUES('nodesize=32'); +} +do_test 2.0.1 { + for {set i 0} {$i < 12} {incr i} { + execsql { + BEGIN; + INSERT INTO ft VALUES('abc' || $i); + INSERT INTO ft VALUES('abc' || $i || 'x' ); + INSERT INTO ft VALUES('abc' || $i || 'xx' ); + COMMIT + } + } + execsql { + SELECT count(*) FROM ft_segdir; + SELECT count(*) FROM ft_segments; + } +} {12 0} + +do_execsql_test 2.1 { + INSERT INTO ft(ft) VALUES('merge=1,4'); + SELECT count(*) FROM ft_segdir; + SELECT count(*) FROM ft_segments; +} {12 3} + +do_execsql_test 2.2 { + SELECT quote(block) FROM ft_segments WHERE blockid=2 +} {X'00056162633130031F0200'} + +db func blob blob +do_execsql_test 2.3.1 { + UPDATE ft_segments SET block = + blob('00056162633130031F0200 FFFFFFFF07FF55 66740302020003046E646F6E03030200') + WHERE blockid=2; +} {} +do_catchsql_test 2.3.2 { + INSERT INTO ft(ft) VALUES('merge=1,4'); +} {1 {database disk image is malformed}} + +do_execsql_test 2.4.1 { + UPDATE ft_segments SET block = + blob('00056162633130031F0200 02FFFFFFFF07 66740302020003046E646F6E03030200') + WHERE blockid=2; +} {} +do_catchsql_test 2.4.2 { + INSERT INTO ft(ft) VALUES('merge=1,4'); +} {1 {database disk image is malformed}} + +do_execsql_test 2.5.1 { + UPDATE ft_segments SET block = + blob('00056162633130031F0200 0202 6674 FFFFFF070302020003046E646F6E030200') + WHERE blockid=2; +} {} +do_catchsql_test 2.5.2 { + INSERT INTO ft(ft) VALUES('merge=1,4'); +} {1 {database disk image is malformed}} + +#------------------------------------------------------------------------- +reset_db +do_execsql_test 3.0.0 { + CREATE VIRTUAL TABLE ft USING fts3; + INSERT INTO ft(ft) VALUES('nodesize=32'); +} +do_test 3.0.1 { + execsql BEGIN + for {set i 0} {$i < 20} {incr i} { + execsql { INSERT INTO ft VALUES('abc' || $i) } + } + execsql { + COMMIT; + SELECT count(*) FROM ft_segdir; + SELECT count(*) FROM ft_segments; + } +} {1 5} + +do_execsql_test 3.1 { + SELECT quote(root) FROM ft_segdir +} {X'0101056162633132040136030132030136'} + +db func blob blob +do_execsql_test 3.2 { + UPDATE ft_segdir + SET root = blob('0101056162633132FFFFFFFF070236030132030136'); +} + +do_catchsql_test 3.1 { + SELECT * FROM ft WHERE ft MATCH 'abc20' +} {1 {database disk image is malformed}} + +finish_test + + diff --git a/test/permutations.test b/test/permutations.test index 4940e34899..059ac86b15 100644 --- a/test/permutations.test +++ b/test/permutations.test @@ -262,6 +262,7 @@ test_suite "fts3" -prefix "" -description { fts3am.test fts3an.test fts3ao.test fts3atoken.test fts3auto.test fts3aux1.test fts3aux2.test fts3b.test fts3comp1.test fts3conf.test fts3corrupt2.test fts3corrupt.test + fts3corrupt4.test fts3cov.test fts3c.test fts3defer2.test fts3defer3.test fts3defer.test fts3drop.test fts3d.test fts3e.test fts3expr2.test fts3expr3.test fts3expr4.test fts3expr5.test