diff options
| author | Andy Shaw <andy.shaw@qt.io> | 2019-09-25 09:17:01 +0200 |
|---|---|---|
| committer | Andy Shaw <andy.shaw@qt.io> | 2019-09-25 10:09:50 +0200 |
| commit | c3faeb852866a2fc8ae9cd6f8cf91947bd42b538 (patch) | |
| tree | 3a74308ddc3f9c2c70309c12d67e326d70fc81b6 /src/3rdparty/sqlite/sqlite3.c | |
| parent | f88476569a8608d0f8257fcf3c426cbc68de6d7c (diff) | |
Fix CVE-2019-16168 in SQLite
v3.29.0 is the latest and there is no indication as to when the next
release is so we will apply this separately for now and it can be
reverted once it is in a release that we ship with.
This patch is taken from https://www.sqlite.org/src/info/98357d8c1263920b
Change-Id: I82d398b093b67842a4369e3220c01e7eea30763a
Reviewed-by: Simon Hausmann <simon.hausmann@qt.io>
Diffstat (limited to 'src/3rdparty/sqlite/sqlite3.c')
| -rw-r--r-- | src/3rdparty/sqlite/sqlite3.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/src/3rdparty/sqlite/sqlite3.c b/src/3rdparty/sqlite/sqlite3.c index 61bfdeb766..b3e6ae27b6 100644 --- a/src/3rdparty/sqlite/sqlite3.c +++ b/src/3rdparty/sqlite/sqlite3.c @@ -105933,7 +105933,9 @@ static void decodeIntArray( if( sqlite3_strglob("unordered*", z)==0 ){ pIndex->bUnordered = 1; }else if( sqlite3_strglob("sz=[0-9]*", z)==0 ){ - pIndex->szIdxRow = sqlite3LogEst(sqlite3Atoi(z+3)); + int sz = sqlite3Atoi(z+3); + if( sz<2 ) sz = 2; + pIndex->szIdxRow = sqlite3LogEst(sz); }else if( sqlite3_strglob("noskipscan*", z)==0 ){ pIndex->noSkipScan = 1; } @@ -143260,6 +143262,7 @@ static int whereLoopAddBtreeIndex( ** it to pNew->rRun, which is currently set to the cost of the index ** seek only. Then, if this is a non-covering index, add the cost of ** visiting the rows in the main table. */ + assert( pSrc->pTab->szTabRow>0 ); rCostIdx = pNew->nOut + 1 + (15*pProbe->szIdxRow)/pSrc->pTab->szTabRow; pNew->rRun = sqlite3LogEstAdd(rLogSize, rCostIdx); if( (pNew->wsFlags & (WHERE_IDX_ONLY|WHERE_IPK))==0 ){ |