Fossil SCM
Fix a possible one-byte OOB read when processing a corrupt delta. [https://sqlite.org/bugs/info/2026-07-04T04:53:59Z|SQLite Bug 2026-07-04T04:53:59Z]
Commit
146cdcd9cb5bf8faf496ad8b439e1f9e090a2f038e9a5c8256b8ea69831540eb
Parent
b2d347eaa05f5fc…
1 file changed
+1
-1
+1
-1
| --- src/delta.c | ||
| +++ src/delta.c | ||
| @@ -684,11 +684,11 @@ | ||
| 684 | 684 | if( lenDelta<=0 || *zDelta!='\n' ){ |
| 685 | 685 | /* ERROR: size integer not terminated by "\n" */ |
| 686 | 686 | return -1; |
| 687 | 687 | } |
| 688 | 688 | zDelta++; lenDelta--; |
| 689 | - while( *zDelta && lenDelta>0 ){ | |
| 689 | + while( lenDelta>0 && *zDelta ){ | |
| 690 | 690 | unsigned int cnt; |
| 691 | 691 | cnt = getInt(&zDelta, &lenDelta); |
| 692 | 692 | if( lenDelta<=0 ) break; |
| 693 | 693 | switch( zDelta[0] ){ |
| 694 | 694 | case '@': { |
| 695 | 695 |
| --- src/delta.c | |
| +++ src/delta.c | |
| @@ -684,11 +684,11 @@ | |
| 684 | if( lenDelta<=0 || *zDelta!='\n' ){ |
| 685 | /* ERROR: size integer not terminated by "\n" */ |
| 686 | return -1; |
| 687 | } |
| 688 | zDelta++; lenDelta--; |
| 689 | while( *zDelta && lenDelta>0 ){ |
| 690 | unsigned int cnt; |
| 691 | cnt = getInt(&zDelta, &lenDelta); |
| 692 | if( lenDelta<=0 ) break; |
| 693 | switch( zDelta[0] ){ |
| 694 | case '@': { |
| 695 |
| --- src/delta.c | |
| +++ src/delta.c | |
| @@ -684,11 +684,11 @@ | |
| 684 | if( lenDelta<=0 || *zDelta!='\n' ){ |
| 685 | /* ERROR: size integer not terminated by "\n" */ |
| 686 | return -1; |
| 687 | } |
| 688 | zDelta++; lenDelta--; |
| 689 | while( lenDelta>0 && *zDelta ){ |
| 690 | unsigned int cnt; |
| 691 | cnt = getInt(&zDelta, &lenDelta); |
| 692 | if( lenDelta<=0 ) break; |
| 693 | switch( zDelta[0] ){ |
| 694 | case '@': { |
| 695 |