264 lines
7.0 KiB
Plaintext
264 lines
7.0 KiB
Plaintext
# 2014-01-20
|
|
#
|
|
# The author disclaims copyright to this source code. In place of
|
|
# a legal notice, here is a blessing:
|
|
#
|
|
# May you do good and not evil.
|
|
# May you find forgiveness for yourself and forgive others.
|
|
# May you share freely, never taking more than you give.
|
|
#
|
|
#***********************************************************************
|
|
#
|
|
|
|
set testdir [file dirname $argv0]
|
|
source $testdir/tester.tcl
|
|
set testprefix corruptI
|
|
|
|
if {[permutation]=="mmap"} {
|
|
finish_test
|
|
return
|
|
}
|
|
|
|
# This module uses hard-coded offsets which do not work if the reserved_bytes
|
|
# value is nonzero.
|
|
if {[nonzero_reserved_bytes]} {finish_test; return;}
|
|
|
|
database_may_be_corrupt
|
|
|
|
# Initialize the database.
|
|
#
|
|
do_execsql_test 1.1 {
|
|
PRAGMA page_size=1024;
|
|
PRAGMA auto_vacuum=0;
|
|
CREATE TABLE t1(a);
|
|
CREATE INDEX i1 ON t1(a);
|
|
INSERT INTO t1 VALUES('abcdefghijklmnop');
|
|
} {}
|
|
db close
|
|
|
|
do_test 1.2 {
|
|
set offset [hexio_get_int [hexio_read test.db [expr 2*1024 + 8] 2]]
|
|
set off [expr 2*1024 + $offset + 1]
|
|
hexio_write test.db $off 7f06
|
|
sqlite3 db test.db
|
|
catchsql { SELECT * FROM t1 WHERE a = 10 }
|
|
} {0 {}}
|
|
|
|
do_test 1.3 {
|
|
db close
|
|
set offset [hexio_get_int [hexio_read test.db [expr 2*1024 + 8] 2]]
|
|
set off [expr 2*1024 + $offset + 1]
|
|
hexio_write test.db $off FFFF7f02
|
|
sqlite3 db test.db
|
|
catchsql { SELECT * FROM t1 WHERE a = 10 }
|
|
} {1 {database disk image is malformed}}
|
|
|
|
do_test 2.0 {
|
|
execsql {
|
|
CREATE TABLE r(x);
|
|
INSERT INTO r VALUES('ABCDEFGHIJK');
|
|
CREATE INDEX r1 ON r(x);
|
|
}
|
|
set pg [db one {SELECT rootpage FROM sqlite_master WHERE name = 'r1'}]
|
|
} {5}
|
|
|
|
do_test 2.1 {
|
|
db close
|
|
set offset [hexio_get_int [hexio_read test.db [expr (5-1)*1024 + 8] 2]]
|
|
set off [expr (5-1)*1024 + $offset + 1]
|
|
hexio_write test.db $off FFFF0004
|
|
sqlite3 db test.db
|
|
catchsql { SELECT * FROM r WHERE x >= 10.0 }
|
|
} {1 {database disk image is malformed}}
|
|
|
|
do_test 2.2 {
|
|
catchsql { SELECT * FROM r WHERE x >= 10 }
|
|
} {1 {database disk image is malformed}}
|
|
|
|
if {[db one {SELECT sqlite_compileoption_used('ENABLE_OVERSIZE_CELL_CHECK')}]} {
|
|
# The following tests only work if OVERSIZE_CELL_CHECK is disabled
|
|
} else {
|
|
reset_db
|
|
do_execsql_test 3.1 {
|
|
PRAGMA auto_vacuum=0;
|
|
PRAGMA page_size = 512;
|
|
CREATE TABLE t1(a INTEGER PRIMARY KEY, b);
|
|
WITH s(a, b) AS (
|
|
SELECT 2, 'abcdefghij'
|
|
UNION ALL
|
|
SELECT a+2, b FROM s WHERe a < 40
|
|
)
|
|
INSERT INTO t1 SELECT * FROM s;
|
|
} {}
|
|
|
|
do_test 3.2 {
|
|
hexio_write test.db [expr 512+3] 0054
|
|
db close
|
|
sqlite3 db test.db
|
|
execsql { INSERT INTO t1 VALUES(5, 'klmnopqrst') }
|
|
execsql { INSERT INTO t1 VALUES(7, 'klmnopqrst') }
|
|
} {}
|
|
|
|
db close
|
|
sqlite3 db test.db
|
|
do_catchsql_test 3.3 {
|
|
INSERT INTO t1 VALUES(9, 'klmnopqrst');
|
|
} {1 {database disk image is malformed}}
|
|
} ;# end-if !defined(ENABLE_OVERSIZE_CELL_CHECK)
|
|
|
|
|
|
#-------------------------------------------------------------------------
|
|
# Test that an assert() failure discovered by AFL corrupt database file
|
|
# testing has been fixed.
|
|
#
|
|
reset_db
|
|
do_execsql_test 4.0 {
|
|
PRAGMA page_size = 65536;
|
|
PRAGMA autovacuum = 0;
|
|
CREATE TABLE t1(a INTEGER PRIMARY KEY, b);
|
|
INSERT INTO t1 VALUES(-1, 'abcdefghij');
|
|
INSERT INTO t1 VALUES(0, 'abcdefghij');
|
|
}
|
|
|
|
set root [db one {SELECT rootpage FROM sqlite_master}]
|
|
set offset [expr ($root-1) * 65536]
|
|
|
|
ifcapable oversize_cell_check {
|
|
set res {1 {database disk image is malformed}}
|
|
} else {
|
|
set res {0 {}}
|
|
}
|
|
do_test 4.1 {
|
|
db close
|
|
hexio_write test.db [expr $offset + 8 + 2] 0000
|
|
hexio_write test.db [expr $offset + 5] 0000
|
|
sqlite3 db test.db
|
|
catchsql { DELETE FROM t1 WHERE a=0 }
|
|
} $res
|
|
|
|
|
|
#-------------------------------------------------------------------------
|
|
# Database properties:
|
|
#
|
|
# * Incremental vacuum mode.
|
|
# * Database root table has a single leaf page.
|
|
# * Free list consists of a single trunk page.
|
|
#
|
|
# The db is then corrupted by adding the root table leaf page as a free-list
|
|
# leaf page (so that it is referenced twice).
|
|
#
|
|
# Then, a new table is created. The new root page is the current free-list
|
|
# trunk. This means that the root table leaf page is made into the new
|
|
# free list trunk, which corrupts its header. Then, when the new entry is
|
|
# inserted into the root table, things would get chaotic.
|
|
#
|
|
reset_db
|
|
do_test 5.0 {
|
|
execsql {
|
|
PRAGMA page_size = 512;
|
|
PRAGMA auto_vacuum = 2;
|
|
}
|
|
for {set i 3} {1} {incr i} {
|
|
execsql "CREATE TABLE t${i}(x)"
|
|
if {[db one {PRAGMA page_count}]>$i} break
|
|
}
|
|
set nPage [db one {PRAGMA page_count}]
|
|
execsql {
|
|
CREATE TABLE t100(x);
|
|
DROP TABLE t100;
|
|
}
|
|
} {}
|
|
|
|
do_execsql_test 5.1 {
|
|
PRAGMA page_count
|
|
} [expr $nPage+1]
|
|
|
|
do_test 5.2 {
|
|
# The last page of the db is now the only leaf of the sqlite_master table.
|
|
# Corrupt the db by adding it to the free-list as well (the second last
|
|
# page of the db is the free-list trunk).
|
|
db close
|
|
hexio_write test.db [expr 512*($nPage-1)] [
|
|
format "%.8X%.8X%.8X" 0 1 [expr $nPage+1]
|
|
]
|
|
} {12}
|
|
|
|
do_test 5.3 {
|
|
sqlite3 db test.db
|
|
catchsql { CREATE TABLE tx(x); }
|
|
} {1 {database disk image is malformed}}
|
|
|
|
|
|
#-------------------------------------------------------------------------
|
|
# Set the payload size of a cell to just less than 2^32 bytes (not
|
|
# possible in an uncorrupted db). Then try to delete the cell. At one
|
|
# point this led to an integer overflow that caused an assert() to fail.
|
|
#
|
|
reset_db
|
|
do_execsql_test 6.0 {
|
|
PRAGMA page_size = 512;
|
|
PRAGMA auto_vacuum=0;
|
|
CREATE TABLE t1(x);
|
|
INSERT INTO t1 VALUES(zeroblob(300));
|
|
INSERT INTO t1 VALUES(zeroblob(600));
|
|
} {}
|
|
do_test 6.1 {
|
|
db close
|
|
hexio_write test.db 616 8FFFFFFF7F02
|
|
sqlite3 db test.db
|
|
execsql { DELETE FROM t1 WHERE rowid=2 }
|
|
} {}
|
|
|
|
#-------------------------------------------------------------------------
|
|
# See what happens if the sqlite_master entry associated with a PRIMARY
|
|
# KEY or UNIQUE index is removed.
|
|
#
|
|
reset_db
|
|
do_execsql_test 7.0 {
|
|
PRAGMA auto_vacuum=0;
|
|
CREATE TABLE t1(x PRIMARY KEY, y);
|
|
INSERT INTO t1 VALUES('a', 'A');
|
|
INSERT INTO t1 VALUES('b', 'A');
|
|
INSERT INTO t1 VALUES('c', 'A');
|
|
SELECT name FROM sqlite_master;
|
|
} {t1 sqlite_autoindex_t1_1}
|
|
sqlite3_db_config db DEFENSIVE 0
|
|
do_execsql_test 7.1 {
|
|
PRAGMA writable_schema = 1;
|
|
DELETE FROM sqlite_master WHERE name = 'sqlite_autoindex_t1_1';
|
|
}
|
|
do_test 7.2 {
|
|
db close
|
|
sqlite3 db test.db
|
|
catchsql { UPDATE t1 SET x='d' AND y='D' WHERE rowid = 2 }
|
|
} {1 {database disk image is malformed}}
|
|
|
|
#-------------------------------------------------------------------------
|
|
# At one point an assert() would fail if attempt was made to free page 1.
|
|
#
|
|
reset_db
|
|
do_execsql_test 8.0 {
|
|
PRAGMA auto_vacuum=0;
|
|
CREATE TABLE t1(x);
|
|
INSERT INTO t1 VALUES(zeroblob(300));
|
|
INSERT INTO t1 VALUES(zeroblob(300));
|
|
INSERT INTO t1 VALUES(zeroblob(300));
|
|
INSERT INTO t1 VALUES(zeroblob(300));
|
|
} {}
|
|
|
|
do_test 8.1 {
|
|
db close
|
|
hexio_write test.db [expr 1024 + 8] 00000001
|
|
sqlite3 db test.db
|
|
catchsql { DELETE FROM t1 }
|
|
} {1 {database disk image is malformed}}
|
|
|
|
do_test 8.2 {
|
|
db close
|
|
sqlite3 db test.db
|
|
execsql { PRAGMA integrity_check }
|
|
} {/.*in database main.*/}
|
|
|
|
|
|
finish_test
|