Fix a problem in the ".recover" command allowing a circular loop of b…

…-tree pages in a database file to cause an infinite loop.
sekcheong · May 9, 2019 · bdad71c · bdad71c
1 parent ec7fdef
commit bdad71c
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 2 deletions.
diff --git a/ext/misc/dbdata.c b/ext/misc/dbdata.c
@@ -301,7 +301,10 @@ static unsigned int get_uint16(unsigned char *a){
   return (a[0]<<8)|a[1];
 }
 static unsigned int get_uint32(unsigned char *a){
-  return (a[0]<<24)|(a[1]<<16)|(a[2]<<8)|a[3];
+  return ((unsigned int)a[0]<<24)
+       | ((unsigned int)a[1]<<16)
+       | ((unsigned int)a[2]<<8)
+       | ((unsigned int)a[3]);
 }
 
 /*

diff --git a/src/shell.c.in b/src/shell.c.in
@@ -6633,7 +6633,7 @@ static int recoverDatabaseCmd(ShellState *pState, int nArg, char **azArg){
     "  SELECT i, maxlen, NULL, ("
     "    WITH p(orig, pgno, parent) AS ("
     "      SELECT 0, i, (SELECT pgno FROM recovery.dbptr WHERE child=i)"
-    "        UNION ALL"
+    "        UNION "
     "      SELECT i, p.parent, "
     "        (SELECT pgno FROM recovery.dbptr WHERE child=p.parent) FROM p"
     "    )"