1# 2009 June 3 2# 3# The author disclaims copyright to this source code. In place of 4# a legal notice, here is a blessing: 5# 6# May you do good and not evil. 7# May you find forgiveness for yourself and forgive others. 8# May you share freely, never taking more than you give. 9# 10#*********************************************************************** 11# 12# $Id: corruptD.test,v 1.2 2009/06/05 17:09:12 drh Exp $ 13 14set testdir [file dirname $argv0] 15source $testdir/tester.tcl 16 17# Do not use a codec for tests in this file, as the database file is 18# manipulated directly using tcl scripts (using the [hexio_write] command). 19# 20do_not_use_codec 21 22#-------------------------------------------------------------------------- 23# OVERVIEW 24# 25# This test file attempts to verify that SQLite does not read past the 26# end of any in-memory buffers as a result of corrupted database page 27# images. Usually this happens because a field within a database page 28# that contains an offset to some other structure within the same page 29# is set to too large a value. A database page contains the following 30# such fields: 31# 32# 1. The page header field that contains the offset to the first 33# free block of space. 34# 35# 2. The first two bytes of all but the last free block on the free-block 36# list (the offset to the next free block). 37# 38# 3. The page header field containing the number of cells on the page 39# (implicitly defines the offset to the final element in the cell offset 40# array, which could potentially be off the end of the page). 41# 42# 4. The page header field containing the offset to the start of the cell 43# content area. 44# 45# 5. The contents of the cell offset array. 46# 47# 6. The first few bytes of each cell determine the size of the cell 48# stored within the page, and hence the offset to the final byte of 49# the cell. 50# 51# If any of the above fields are set to too large a value, then a buffer 52# overread may occur. This test script creates and operates on various 53# strategically corrupted database files to attempt to provoke such buffer 54# overreads. 55# 56# Very often, a buffer overread passes unnoticed, particularly in workstation 57# environments. For this reason, this test script should be run using valgrind 58# (or similar) in order to verify that no overreads occur. 59# 60# TEST PLAN 61# 62# Test cases corruptD-1.* are white-box tests. They attempt to corrupt 63# one of the above fields, then exercise each part of the code in btree.c 64# that uses said field. 65# 66# Offset variables 1, 2, 3 and 4 are all checked to make sure they 67# will not result in buffer overruns as part of page initialization in 68# sqlite3BtreeInitPage(). Offsets 5 and 6 cannot be tested as part of 69# page initialization, as trying to do so causes a performance hit. 70# 71 72do_test corruptD-1.0 { 73 execsql { 74 PRAGMA auto_vacuum = 0; 75 PRAGMA page_size = 1024; 76 CREATE TABLE t1(a, b); 77 CREATE INDEX i1 ON t1(a, b); 78 } 79 for {set ii 1} {$ii < 50} {incr ii} { 80 execsql { INSERT INTO t1 VALUES($ii, $ii * $ii) } 81 } 82 execsql { 83 DELETE FROM t1 WHERE a = 10; 84 DELETE FROM t1 WHERE a = 20; 85 DELETE FROM t1 WHERE a = 30; 86 DELETE FROM t1 WHERE a = 40; 87 } 88 copy_file test.db test.bu 89} {} 90 91proc incr_change_counter {} { 92 hexio_write test.db 24 [ 93 hexio_render_int32 [expr [hexio_get_int [hexio_read test.db 24 4]] + 1] 94 ] 95} 96 97proc restore_file {} { 98 db close 99 copy_file test.bu test.db 100 sqlite3 db test.db 101} 102 103#------------------------------------------------------------------------- 104# The following tests, corruptD-1.1.*, focus on the page header field 105# containing the offset of the first free block in a page. 106# 107do_test corruptD-1.1.1 { 108 incr_change_counter 109 hexio_write test.db [expr 1024+1] FFFF 110 catchsql { SELECT * FROM t1 } 111} {1 {database disk image is malformed}} 112do_test corruptD-1.1.2 { 113 incr_change_counter 114 hexio_write test.db [expr 1024+1] [hexio_render_int32 1021] 115 catchsql { SELECT * FROM t1 } 116} {1 {database disk image is malformed}} 117 118#------------------------------------------------------------------------- 119# The following tests, corruptD-1.2.*, focus on the offsets contained 120# in the first 2 byte of each free-block on the free-list. 121# 122do_test corruptD-1.2.1 { 123 restore_file 124} {} 125do_test corruptD-1.2.2 { 126} {} 127 128#------------------------------------------------------------------------- 129# The following tests, corruptD-1.4.*, ... 130# 131 132 133#------------------------------------------------------------------------- 134# The following tests, corruptD-1.5.*, focus on the offsets contained 135# in the cell offset array. 136# 137# defragmentPage 138# 139 140finish_test 141