openkylin
/
db5.3
mirror of https://gitee.com/openkylin/db5.3.git
9
0
Fork 0
Code Issues Projects Releases Wiki Activity

Enhance the rtreenode function in order to avoid a heap out-of-bounds read 

Origin: https://www.sqlite.org/src/info/90acdbfce9c08858
Bug-Debian: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=929775

Gbp-Pq: Name CVE-2019-8457.patch
This commit is contained in:
Ubuntu Developers 2022-05-13 20:11:42 +08:00 committed by openKylinBot
parent 171220c41f
commit ef9adaabae
1 changed files with 22 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

37
lang/sql/sqlite/ext/rtree/rtree.c
View File

@ -3089,38 +3089,45 @@ static void rtreenode(sqlite3_context *ctx, int nArg, sqlite3_value **apArg){
RtreeNode node; RtreeNode node;
Rtree tree; Rtree tree;
int ii; int ii;
int nData;
int errCode;
sqlite3_str *pOut;
UNUSED_PARAMETER(nArg); UNUSED_PARAMETER(nArg);
memset(&node, 0, sizeof(RtreeNode)); memset(&node, 0, sizeof(RtreeNode));
memset(&tree, 0, sizeof(Rtree)); memset(&tree, 0, sizeof(Rtree));
tree.nDim = sqlite3_value_int(apArg[0]); tree.nDim = sqlite3_value_int(apArg[0]);
if( tree.nDim<1 || tree.nDim>5 ) return;
tree.nBytesPerCell = 8 + 8 * tree.nDim; tree.nBytesPerCell = 8 + 8 * tree.nDim;
node.zData = (u8 *)sqlite3_value_blob(apArg[1]); node.zData = (u8 *)sqlite3_value_blob(apArg[1]);
nData = sqlite3_value_bytes(apArg[1]);
if( nData<4 ) return;
if( nData<NCELL(&node)*tree.nBytesPerCell ) return;
pOut = sqlite3_str_new(0);
for(ii=0; ii<NCELL(&node); ii++){ for(ii=0; ii<NCELL(&node); ii++){
char zCell[512];
int nCell = 0;
RtreeCell cell; RtreeCell cell;
int jj; int jj;
nodeGetCell(&tree, &node, ii, &cell); nodeGetCell(&tree, &node, ii, &cell);
sqlite3_snprintf(512-nCell,&zCell[nCell],"%lld", cell.iRowid); if( ii>0 ) sqlite3_str_append(pOut, " ", 1);
nCell = strlen(zCell); sqlite3_str_appendf(pOut, "{%lld", cell.iRowid);
for(jj=0; jj<tree.nDim*2; jj++){ for(jj=0; jj<tree.nDim*2; jj++){
sqlite3_snprintf(512-nCell,&zCell[nCell]," %f",(double)cell.aCoord[jj].f); #ifndef SQLITE_RTREE_INT_ONLY
nCell = strlen(zCell); sqlite3_str_appendf(pOut, " %g", (double)cell.aCoord[jj].f);
#else
sqlite3_str_appendf(pOut, " %d", cell.aCoord[jj].i);
#endif
} }
if( zText ){
char *zTextNew = sqlite3_mprintf("%s {%s}", zText, zCell); sqlite3_str_append(pOut, "}", 1);
sqlite3_free(zText);
zText = zTextNew;
}else{
zText = sqlite3_mprintf("{%s}", zCell);
}
} }
errCode = sqlite3_str_errcode(pOut);
sqlite3_result_text(ctx, zText, -1, sqlite3_free); sqlite3_result_text(ctx, sqlite3_str_finish(pOut), -1, sqlite3_free);
sqlite3_result_error_code(ctx, errCode);
} }
static void rtreedepth(sqlite3_context *ctx, int nArg, sqlite3_value **apArg){ static void rtreedepth(sqlite3_context *ctx, int nArg, sqlite3_value **apArg){