@@ -14753,6 +14753,15 @@ static void dbdataValue(
14753
14753
}
14754
14754
}
14755
14755
14756
+ /* This macro is a copy of the MX_CELL() macro in the SQLite core. Given
14757
+ ** a page-size, it returns the maximum number of cells that may be present
14758
+ ** on the page. */
14759
+ #define DBDATA_MX_CELL(pgsz) ((pgsz-8)/6)
14760
+
14761
+ /* Maximum number of fields that may appear in a single record. This is
14762
+ ** the "hard-limit", according to comments in sqliteLimit.h. */
14763
+ #define DBDATA_MX_FIELD 32676
14764
+
14756
14765
/*
14757
14766
** Move an sqlite_dbdata or sqlite_dbptr cursor to the next entry.
14758
14767
*/
@@ -14781,6 +14790,9 @@ static int dbdataNext(sqlite3_vtab_cursor *pCursor){
14781
14790
assert( iOff+3+2<=pCsr->nPage );
14782
14791
pCsr->iCell = pTab->bPtr ? -2 : 0;
14783
14792
pCsr->nCell = get_uint16(&pCsr->aPage[iOff+3]);
14793
+ if( pCsr->nCell>DBDATA_MX_CELL(pCsr->nPage) ){
14794
+ pCsr->nCell = DBDATA_MX_CELL(pCsr->nPage);
14795
+ }
14784
14796
}
14785
14797
14786
14798
if( pTab->bPtr ){
@@ -14825,19 +14837,19 @@ static int dbdataNext(sqlite3_vtab_cursor *pCursor){
14825
14837
if( pCsr->iCell>=pCsr->nCell ){
14826
14838
bNextPage = 1;
14827
14839
}else{
14840
+ int iCellPtr = iOff + 8 + nPointer + pCsr->iCell*2;
14828
14841
14829
- iOff += 8 + nPointer + pCsr->iCell*2;
14830
- if( iOff>pCsr->nPage ){
14842
+ if( iCellPtr>pCsr->nPage ){
14831
14843
bNextPage = 1;
14832
14844
}else{
14833
- iOff = get_uint16(&pCsr->aPage[iOff ]);
14845
+ iOff = get_uint16(&pCsr->aPage[iCellPtr ]);
14834
14846
}
14835
14847
14836
14848
/* For an interior node cell, skip past the child-page number */
14837
14849
iOff += nPointer;
14838
14850
14839
14851
/* Load the "byte of payload including overflow" field */
14840
- if( bNextPage || iOff>pCsr->nPage ){
14852
+ if( bNextPage || iOff>pCsr->nPage || iOff<=iCellPtr ){
14841
14853
bNextPage = 1;
14842
14854
}else{
14843
14855
iOff += dbdataGetVarintU32(&pCsr->aPage[iOff], &nPayload);
@@ -14920,7 +14932,9 @@ static int dbdataNext(sqlite3_vtab_cursor *pCursor){
14920
14932
pCsr->iField++;
14921
14933
if( pCsr->iField>0 ){
14922
14934
sqlite3_int64 iType;
14923
- if( pCsr->pHdrPtr>&pCsr->pRec[pCsr->nRec] ){
14935
+ if( pCsr->pHdrPtr>=&pCsr->pRec[pCsr->nRec]
14936
+ || pCsr->iField>=DBDATA_MX_FIELD
14937
+ ){
14924
14938
bNextPage = 1;
14925
14939
}else{
14926
14940
int szField = 0;
@@ -16408,7 +16422,7 @@ static int recoverWriteSchema1(sqlite3_recover *p){
16408
16422
if( bTable && !bVirtual ){
16409
16423
if( SQLITE_ROW==sqlite3_step(pTblname) ){
16410
16424
const char *zTbl = (const char*)sqlite3_column_text(pTblname, 0);
16411
- recoverAddTable(p, zTbl, iRoot);
16425
+ if( zTbl ) recoverAddTable(p, zTbl, iRoot);
16412
16426
}
16413
16427
recoverReset(p, pTblname);
16414
16428
}
@@ -28771,6 +28785,7 @@ static const char zOptions[] =
28771
28785
" -newline SEP set output row separator. Default: '\\n'\n"
28772
28786
" -nofollow refuse to open symbolic links to database files\n"
28773
28787
" -nonce STRING set the safe-mode escape nonce\n"
28788
+ " -no-rowid-in-view Disable rowid-in-view using sqlite3_config()\n"
28774
28789
" -nullvalue TEXT set text string for NULL values. Default ''\n"
28775
28790
" -pagecache SIZE N use N slots of SZ bytes each for page cache memory\n"
28776
28791
" -pcachetrace trace all page cache operations\n"
@@ -29061,6 +29076,10 @@ int SQLITE_CDECL wmain(int argc, wchar_t **wargv){
29061
29076
stdin_is_interactive = 0;
29062
29077
}else if( cli_strcmp(z,"-utf8")==0 ){
29063
29078
}else if( cli_strcmp(z,"-no-utf8")==0 ){
29079
+ }else if( cli_strcmp(z,"-no-rowid-in-view")==0 ){
29080
+ int val = 0;
29081
+ sqlite3_config(SQLITE_CONFIG_ROWID_IN_VIEW, &val);
29082
+ assert( val==0 );
29064
29083
}else if( cli_strcmp(z,"-heap")==0 ){
29065
29084
#if defined(SQLITE_ENABLE_MEMSYS3) || defined(SQLITE_ENABLE_MEMSYS5)
29066
29085
const char *zSize;
@@ -29336,6 +29355,8 @@ int SQLITE_CDECL wmain(int argc, wchar_t **wargv){
29336
29355
/* already handled */
29337
29356
}else if( cli_strcmp(z,"-no-utf8")==0 ){
29338
29357
/* already handled */
29358
+ }else if( cli_strcmp(z,"-no-rowid-in-view")==0 ){
29359
+ /* already handled */
29339
29360
}else if( cli_strcmp(z,"-heap")==0 ){
29340
29361
i++;
29341
29362
}else if( cli_strcmp(z,"-pagecache")==0 ){
0 commit comments