|
308 | 308 | SQLITE_EXTENSION_INIT1 |
309 | 309 | #endif |
310 | 310 |
|
| 311 | +/* |
| 312 | +** The following are copied from sqliteInt.h. |
| 313 | +** |
| 314 | +** Constants for the largest and smallest possible 64-bit signed integers. |
| 315 | +** These macros are designed to work correctly on both 32-bit and 64-bit |
| 316 | +** compilers. |
| 317 | +*/ |
| 318 | +#ifndef SQLITE_AMALGAMATION |
| 319 | +# define LARGEST_INT64 (0xffffffff|(((sqlite3_int64)0x7fffffff)<<32)) |
| 320 | +# define SMALLEST_INT64 (((sqlite3_int64)-1) - LARGEST_INT64) |
| 321 | +#endif |
| 322 | + |
311 | 323 | static int fts3EvalNext(Fts3Cursor *pCsr); |
312 | 324 | static int fts3EvalStart(Fts3Cursor *pCsr); |
313 | 325 | static int fts3TermSegReaderCursor( |
@@ -2086,10 +2098,11 @@ static void fts3ColumnlistCopy(char **pp, char **ppPoslist){ |
2086 | 2098 | } |
2087 | 2099 |
|
2088 | 2100 | /* |
2089 | | -** Value used to signify the end of an position-list. This is safe because |
2090 | | -** it is not possible to have a document with 2^31 terms. |
| 2101 | +** Value used to signify the end of an position-list. This must be |
| 2102 | +** as large or larger than any value that might appear on the |
| 2103 | +** position-list, even a position list that has been corrupted. |
2091 | 2104 | */ |
2092 | | -#define POSITION_LIST_END 0x7fffffff |
| 2105 | +#define POSITION_LIST_END LARGEST_INT64 |
2093 | 2106 |
|
2094 | 2107 | /* |
2095 | 2108 | ** This function is used to help parse position-lists. When this function is |
@@ -2165,14 +2178,14 @@ static int fts3PoslistMerge( |
2165 | 2178 | fts3GetVarint32(&p1[1], &iCol1); |
2166 | 2179 | if( iCol1==0 ) return FTS_CORRUPT_VTAB; |
2167 | 2180 | } |
2168 | | - else if( *p1==POS_END ) iCol1 = POSITION_LIST_END; |
| 2181 | + else if( *p1==POS_END ) iCol1 = 0x7fffffff; |
2169 | 2182 | else iCol1 = 0; |
2170 | 2183 |
|
2171 | 2184 | if( *p2==POS_COLUMN ){ |
2172 | 2185 | fts3GetVarint32(&p2[1], &iCol2); |
2173 | 2186 | if( iCol2==0 ) return FTS_CORRUPT_VTAB; |
2174 | 2187 | } |
2175 | | - else if( *p2==POS_END ) iCol2 = POSITION_LIST_END; |
| 2188 | + else if( *p2==POS_END ) iCol2 = 0x7fffffff; |
2176 | 2189 | else iCol2 = 0; |
2177 | 2190 |
|
2178 | 2191 | if( iCol1==iCol2 ){ |
@@ -2474,7 +2487,8 @@ static void fts3PutDeltaVarint3( |
2474 | 2487 | iWrite = *piPrev - iVal; |
2475 | 2488 | } |
2476 | 2489 | assert( *pbFirst || *piPrev==0 ); |
2477 | | - assert( *pbFirst==0 || iWrite>0 ); |
| 2490 | + assert_fts3_nc( *pbFirst==0 || iWrite>0 ); |
| 2491 | + assert( *pbFirst==0 || iWrite>=0 ); |
2478 | 2492 | *pp += sqlite3Fts3PutVarint(*pp, iWrite); |
2479 | 2493 | *piPrev = iVal; |
2480 | 2494 | *pbFirst = 1; |
@@ -2580,6 +2594,8 @@ static int fts3DoclistOrMerge( |
2580 | 2594 | fts3PoslistCopy(&p, &p2); |
2581 | 2595 | fts3GetDeltaVarint3(&p2, pEnd2, bDescDoclist, &i2); |
2582 | 2596 | } |
| 2597 | + |
| 2598 | + assert( (p-aOut)<=((p1?(p1-a1):n1)+(p2?(p2-a2):n2)+FTS3_VARINT_MAX-1) ); |
2583 | 2599 | } |
2584 | 2600 |
|
2585 | 2601 | if( rc!=SQLITE_OK ){ |
@@ -3179,18 +3195,6 @@ static int fts3NextMethod(sqlite3_vtab_cursor *pCursor){ |
3179 | 3195 | return rc; |
3180 | 3196 | } |
3181 | 3197 |
|
3182 | | -/* |
3183 | | -** The following are copied from sqliteInt.h. |
3184 | | -** |
3185 | | -** Constants for the largest and smallest possible 64-bit signed integers. |
3186 | | -** These macros are designed to work correctly on both 32-bit and 64-bit |
3187 | | -** compilers. |
3188 | | -*/ |
3189 | | -#ifndef SQLITE_AMALGAMATION |
3190 | | -# define LARGEST_INT64 (0xffffffff|(((sqlite3_int64)0x7fffffff)<<32)) |
3191 | | -# define SMALLEST_INT64 (((sqlite3_int64)-1) - LARGEST_INT64) |
3192 | | -#endif |
3193 | | - |
3194 | 3198 | /* |
3195 | 3199 | ** If the numeric type of argument pVal is "integer", then return it |
3196 | 3200 | ** converted to a 64-bit signed integer. Otherwise, return a copy of |
|
0 commit comments