| commit | bcbfc9de906a1ab15ea689f9922fe2253e1c1e98 | |
| author | shess@chromium.org <shess@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | |
| Wed, 12 Feb 2014 01:00:04 +0000 (12 01:00 +0000) | ||
| committer | shess@chromium.org <shess@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | |
| Wed, 12 Feb 2014 01:00:04 +0000 (12 01:00 +0000) | ||
| tree | 7a6cd75461dd5cbd11af0393efd10bff0b43cab1 | treesnapshot (tar.gz zip) |
| parent | 15691b4073e449b8ad6eeca889a40b157fe14e94 | commitdiff |
[sql] Prevent nCells overrun decoding cell in recover.c.
leafCursorCellDecode() correctly guards against the meta-data of the
current cell overflowing the page size, but did not protect against
overflow while decoding the meta-data for other cells when checking for
cell overlap.
BUG=338772
Review URL: https://codereview.chromium.org/153913006
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@250583 0039d316-1c4b-4281-b951-d872f2087c98
leafCursorCellDecode() correctly guards against the meta-data of the
current cell overflowing the page size, but did not protect against
overflow while decoding the meta-data for other cells when checking for
cell overlap.
BUG=338772
Review URL: https://codereview.chromium.org/153913006
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@250583 0039d316-1c4b-4281-b951-d872f2087c98
| third_party/sqlite/amalgamation/sqlite3.c | diffblobblamehistory | |
| third_party/sqlite/src/src/recover.c | diffblobblamehistory |