Detect an attempt to drop a btree that is not within the bounds of the

database file and abort early with an SQLITE_CORRUPT error, to avoid problems later on in the process.
shiyezheng · Mar 8, 2019 · d8ad99e · d8ad99e
1 parent c6b4d8d
commit d8ad99e
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/src/btree.c b/src/btree.c
@@ -9268,6 +9268,9 @@ static int btreeDropTable(Btree *p, Pgno iTable, int *piMoved){
   assert( sqlite3BtreeHoldsMutex(p) );
   assert( p->inTrans==TRANS_WRITE );
   assert( iTable>=2 );
+  if( iTable>btreePagecount(pBt) ){
+    return SQLITE_CORRUPT_BKPT;
+  }
 
   rc = btreeGetPage(pBt, (Pgno)iTable, &pPage, 0);
   if( rc ) return rc;