1 diff --git ext/fts3/fts3.c ext/fts3/fts3.c
2 index 20da051..71e22ae 100644
6 ** deletions and duplications. This would basically be a forced merge
7 ** into a single segment.
9 +#define CHROMIUM_FTS3_CHANGES 1
11 #if !defined(SQLITE_CORE) || defined(SQLITE_ENABLE_FTS3)
13 @@ -1226,7 +1227,13 @@ static int fts3ScanInteriorNode(
15 zCsr += sqlite3Fts3GetVarint32(zCsr, &nSuffix);
17 - if( nPrefix<0 || nSuffix<0 || &zCsr[nSuffix]>zEnd ){
18 + /* NOTE(shess): Previous code checked for negative nPrefix and
19 + ** nSuffix and suffix overrunning zEnd. Additionally corrupt if
20 + ** the prefix is longer than the previous term, or if the suffix
23 + if( nPrefix<0 || nSuffix<0 || nPrefix>nBuffer
24 + || &zCsr[nSuffix]<zCsr || &zCsr[nSuffix]>zEnd ){
28 @@ -3646,7 +3660,11 @@ int sqlite3Fts3Init(sqlite3 *db){
29 ** module with sqlite.
32 +#if CHROMIUM_FTS3_CHANGES && !SQLITE_TEST
33 + /* fts3_tokenizer() disabled for security reasons. */
35 && SQLITE_OK==(rc = sqlite3Fts3InitHashTable(db, pHash, "fts3_tokenizer"))
37 && SQLITE_OK==(rc = sqlite3_overload_function(db, "snippet", -1))
38 && SQLITE_OK==(rc = sqlite3_overload_function(db, "offsets", 1))
39 && SQLITE_OK==(rc = sqlite3_overload_function(db, "matchinfo", 1))
40 @@ -3656,11 +3674,15 @@ int sqlite3Fts3Init(sqlite3 *db){
41 rc = sqlite3_create_module_v2(
42 db, "fts3", &fts3Module, (void *)pHash, hashDestroy
44 +#if CHROMIUM_FTS3_CHANGES && !SQLITE_TEST
45 + /* Disable fts4 pending review. */
48 rc = sqlite3_create_module_v2(
49 db, "fts4", &fts3Module, (void *)pHash, 0
56 diff --git ext/fts3/fts3_icu.c ext/fts3/fts3_icu.c
57 index 85390d3..a75b14a 100644
58 --- ext/fts3/fts3_icu.c
59 +++ ext/fts3/fts3_icu.c
60 @@ -198,7 +198,7 @@ static int icuNext(
64 - U8_NEXT(pCsr->aChar, iWhite, pCsr->nChar, c);
65 + U16_NEXT(pCsr->aChar, iWhite, pCsr->nChar, c);