/ Check-in [a505e34d]
Login

Many hyperlinks are disabled.
Use anonymous login to enable hyperlinks.

Overview
Comment:Ensure all bytes of the PgHdr1 structure are initialized. This avoids a valgrind error when running corruptI.test.
Downloads: Tarball | ZIP archive | SQL archive
Timelines: family | ancestors | descendants | both | trunk
Files: files | file ages | folders
SHA3-256:a505e34d4ec31159a4508ec827fcffed0cf3bd5ea5ef0ac293016da02367a53a
User & Date: dan 2019-02-06 20:49:49
Context
2019-02-07
00:17
In the fuzzcheck test program, make sure the isspace() and related routines are not given values outside the range of -1 to 255. check-in: f2983287 user: drh tags: trunk
2019-02-06
20:49
Ensure all bytes of the PgHdr1 structure are initialized. This avoids a valgrind error when running corruptI.test. check-in: a505e34d user: dan tags: trunk
20:12
Update an assert() in test_journal.c to take the new "VACUUM INTO" functionality into account. check-in: 0e6249cb user: dan tags: trunk
Changes
Hide Diffs Side-by-Side Diffs Ignore Whitespace Patch

Changes to src/pcache1.c.

    88     88   typedef struct PGroup PGroup;
    89     89   
    90     90   /*
    91     91   ** Each cache entry is represented by an instance of the following 
    92     92   ** structure. Unless SQLITE_PCACHE_SEPARATE_HEADER is defined, a buffer of
    93     93   ** PgHdr1.pCache->szPage bytes is allocated directly before this structure 
    94     94   ** in memory.
           95  +**
           96  +** Note: Variables isBulkLocal and isAnchor were once type "u8". That works,
           97  +** but causes a 2-byte gap in the structure for most architectures (since 
           98  +** pointers must be either 4 or 8-byte aligned). As this structure is located
           99  +** in memory directly after the associated page data, if the database is
          100  +** corrupt, code at the b-tree layer may overread the page buffer and 
          101  +** read part of this structure before the corruption is detected. This
          102  +** can cause a valgrind error if the unitialized gap is accessed. Using u16
          103  +** ensures there is no such gap, and therefore no bytes of unitialized memory
          104  +** in the structure.
    95    105   */
    96    106   struct PgHdr1 {
    97    107     sqlite3_pcache_page page;      /* Base class. Must be first. pBuf & pExtra */
    98    108     unsigned int iKey;             /* Key value (page number) */
    99         -  u8 isBulkLocal;                /* This page from bulk local storage */
   100         -  u8 isAnchor;                   /* This is the PGroup.lru element */
          109  +  u16 isBulkLocal;               /* This page from bulk local storage */
          110  +  u16 isAnchor;                  /* This is the PGroup.lru element */
   101    111     PgHdr1 *pNext;                 /* Next in hash table chain */
   102    112     PCache1 *pCache;               /* Cache that currently owns this page */
   103    113     PgHdr1 *pLruNext;              /* Next in LRU list of unpinned pages */
   104    114     PgHdr1 *pLruPrev;              /* Previous in LRU list of unpinned pages */
   105    115                                    /* NB: pLruPrev is only valid if pLruNext!=0 */
   106    116   };
   107    117   
................................................................................
   299    309       do{
   300    310         PgHdr1 *pX = (PgHdr1*)&zBulk[pCache->szPage];
   301    311         pX->page.pBuf = zBulk;
   302    312         pX->page.pExtra = &pX[1];
   303    313         pX->isBulkLocal = 1;
   304    314         pX->isAnchor = 0;
   305    315         pX->pNext = pCache->pFree;
          316  +      pX->pLruPrev = 0;           /* Initializing this saves a valgrind error */
   306    317         pCache->pFree = pX;
   307    318         zBulk += pCache->szAlloc;
   308    319       }while( --nBulk );
   309    320     }
   310    321     return pCache->pFree!=0;
   311    322   }
   312    323