mirror of
https://github.com/openwrt/packages.git
synced 2026-06-17 14:50:07 +04:00
Rosen Penev
e7badaa6cb
There's no need to maintain an old version. Removed all patches as they are all upstream. Import new ones from Arch, Debian, and OpenEmbedded. Signed-off-by: Rosen Penev <rosenp@gmail.com>
68 lines
2.1 KiB
Diff
68 lines
2.1 KiB
Diff
Description: Enhance the rtreenode function in order to avoid a heap out-of-bounds read
|
|
Origin: https://www.sqlite.org/src/info/90acdbfce9c08858
|
|
Bug-Debian: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=929775
|
|
|
|
--- a/lang/sql/sqlite/ext/rtree/rtree.c
|
|
+++ b/lang/sql/sqlite/ext/rtree/rtree.c
|
|
@@ -3089,38 +3089,45 @@ static void rtreenode(sqlite3_context *c
|
|
RtreeNode node;
|
|
Rtree tree;
|
|
int ii;
|
|
+ int nData;
|
|
+ int errCode;
|
|
+ sqlite3_str *pOut;
|
|
|
|
UNUSED_PARAMETER(nArg);
|
|
memset(&node, 0, sizeof(RtreeNode));
|
|
memset(&tree, 0, sizeof(Rtree));
|
|
tree.nDim = sqlite3_value_int(apArg[0]);
|
|
+ if( tree.nDim<1 || tree.nDim>5 ) return;
|
|
tree.nBytesPerCell = 8 + 8 * tree.nDim;
|
|
node.zData = (u8 *)sqlite3_value_blob(apArg[1]);
|
|
+ nData = sqlite3_value_bytes(apArg[1]);
|
|
+ if( nData<4 ) return;
|
|
+ if( nData<NCELL(&node)*tree.nBytesPerCell ) return;
|
|
|
|
+ pOut = sqlite3_str_new(0);
|
|
for(ii=0; ii<NCELL(&node); ii++){
|
|
- char zCell[512];
|
|
- int nCell = 0;
|
|
RtreeCell cell;
|
|
int jj;
|
|
|
|
nodeGetCell(&tree, &node, ii, &cell);
|
|
- sqlite3_snprintf(512-nCell,&zCell[nCell],"%lld", cell.iRowid);
|
|
- nCell = strlen(zCell);
|
|
+ if( ii>0 ) sqlite3_str_append(pOut, " ", 1);
|
|
+ sqlite3_str_appendf(pOut, "{%lld", cell.iRowid);
|
|
for(jj=0; jj<tree.nDim*2; jj++){
|
|
- sqlite3_snprintf(512-nCell,&zCell[nCell]," %f",(double)cell.aCoord[jj].f);
|
|
- nCell = strlen(zCell);
|
|
+#ifndef SQLITE_RTREE_INT_ONLY
|
|
+ sqlite3_str_appendf(pOut, " %g", (double)cell.aCoord[jj].f);
|
|
+#else
|
|
+ sqlite3_str_appendf(pOut, " %d", cell.aCoord[jj].i);
|
|
+#endif
|
|
}
|
|
|
|
- if( zText ){
|
|
- char *zTextNew = sqlite3_mprintf("%s {%s}", zText, zCell);
|
|
- sqlite3_free(zText);
|
|
- zText = zTextNew;
|
|
- }else{
|
|
- zText = sqlite3_mprintf("{%s}", zCell);
|
|
- }
|
|
+
|
|
+ sqlite3_str_append(pOut, "}", 1);
|
|
+
|
|
}
|
|
-
|
|
- sqlite3_result_text(ctx, zText, -1, sqlite3_free);
|
|
+ errCode = sqlite3_str_errcode(pOut);
|
|
+ sqlite3_result_text(ctx, sqlite3_str_finish(pOut), -1, sqlite3_free);
|
|
+ sqlite3_result_error_code(ctx, errCode);
|
|
+
|
|
}
|
|
|
|
static void rtreedepth(sqlite3_context *ctx, int nArg, sqlite3_value **apArg){
|