SQLite Forum

integer overflow in pager.c
Login
hello!

it seems like you have an integer overflow in a pager code [right here](https://github.com/sqlite/sqlite/blob/f43fef29bb78dd5194cf39c12e74552f411cd4d0/src/pager.c#L6941)

`pRel->iSubRec` have type `Pgno` (which is an alias to `u32`) and
`pPager->pageSize+4` have type `int`

it may overflow if `pageSize` is maximum (which is 65536 IIRC) and number of subrecords is also somewhere around 65536. also, on [line 3434](https://github.com/sqlite/sqlite/blob/f43fef29bb78dd5194cf39c12e74552f411cd4d0/src/pager.c#L3434) `iSubRec` is casted to `i64` before a similar multiplication, which kinda confirms that it is a bug