From 7bcd4f0f17fb5bb6ae11be6ef0b70197195f2d61 Mon Sep 17 00:00:00 2001 From: Scott Hess Date: Fri, 23 Sep 2016 09:54:14 -0700 Subject: [PATCH 14/14] [backport] Address integer overflow in sqlite3MulInt64. SQLite check-in http://www.sqlite.org/src/info/db3ebd7c52cfc5fc "Improved implementation of 64-bit signed integer multiply that correctly detects overflow (and promotes to floating-point) in some corner cases. Fix for ticket [1ec41379c9c1e400]" http://www.sqlite.org/src/info/1ec41379c9c1e400" BUG=601727 --- third_party/sqlite/src/src/util.c | 37 +++++++++++------------------------ third_party/sqlite/src/test/expr.test | 27 +++++++++++++++++++++++++ 2 files changed, 38 insertions(+), 26 deletions(-) diff --git a/third_party/sqlite/src/src/util.c b/third_party/sqlite/src/src/util.c index b4c5e62..7640f1d 100644 --- a/third_party/sqlite/src/src/util.c +++ b/third_party/sqlite/src/src/util.c @@ -1244,36 +1244,21 @@ int sqlite3SubInt64(i64 *pA, i64 iB){ return sqlite3AddInt64(pA, -iB); } } -#define TWOPOWER32 (((i64)1)<<32) -#define TWOPOWER31 (((i64)1)<<31) int sqlite3MulInt64(i64 *pA, i64 iB){ i64 iA = *pA; - i64 iA1, iA0, iB1, iB0, r; - - iA1 = iA/TWOPOWER32; - iA0 = iA % TWOPOWER32; - iB1 = iB/TWOPOWER32; - iB0 = iB % TWOPOWER32; - if( iA1==0 ){ - if( iB1==0 ){ - *pA *= iB; - return 0; + if( iB>0 ){ + if( iA>LARGEST_INT64/iB ) return 1; + if( iA0 ){ + if( iBLARGEST_INT64/-iB ) return 1; } - r = iA0*iB1; - }else if( iB1==0 ){ - r = iA1*iB0; - }else{ - /* If both iA1 and iB1 are non-zero, overflow will result */ - return 1; } - testcase( r==(-TWOPOWER31)-1 ); - testcase( r==(-TWOPOWER31) ); - testcase( r==TWOPOWER31 ); - testcase( r==TWOPOWER31-1 ); - if( r<(-TWOPOWER31) || r>=TWOPOWER31 ) return 1; - r *= TWOPOWER32; - if( sqlite3AddInt64(&r, iA0*iB0) ) return 1; - *pA = r; + *pA = iA*iB; return 0; } diff --git a/third_party/sqlite/src/test/expr.test b/third_party/sqlite/src/test/expr.test index 7d7b8ce..7a6d477 100644 --- a/third_party/sqlite/src/test/expr.test +++ b/third_party/sqlite/src/test/expr.test @@ -308,6 +308,33 @@ ifcapable floatingpoint {if {[working_64bit_int]} { test_realnum_expr expr-1.257\ {i1=-4294967296, i2=-2147483647} {i1*i2} 9223372032559808512 + test_realnum_expr expr-1.260\ + {i1=3037000500, i2=3037000500} {i1*i2} 9.22337203700025e+18 + test_realnum_expr expr-1.261\ + {i1=3037000500, i2=-3037000500} {i1*i2} -9.22337203700025e+18 + test_realnum_expr expr-1.262\ + {i1=-3037000500, i2=3037000500} {i1*i2} -9.22337203700025e+18 + test_realnum_expr expr-1.263\ + {i1=-3037000500, i2=-3037000500} {i1*i2} 9.22337203700025e+18 + + test_realnum_expr expr-1.264\ + {i1=3037000500, i2=3037000499} {i1*i2} 9223372033963249500 + test_realnum_expr expr-1.265\ + {i1=3037000500, i2=-3037000499} {i1*i2} -9223372033963249500 + test_realnum_expr expr-1.266\ + {i1=-3037000500, i2=3037000499} {i1*i2} -9223372033963249500 + test_realnum_expr expr-1.267\ + {i1=-3037000500, i2=-3037000499} {i1*i2} 9223372033963249500 + + test_realnum_expr expr-1.268\ + {i1=3037000499, i2=3037000500} {i1*i2} 9223372033963249500 + test_realnum_expr expr-1.269\ + {i1=3037000499, i2=-3037000500} {i1*i2} -9223372033963249500 + test_realnum_expr expr-1.270\ + {i1=-3037000499, i2=3037000500} {i1*i2} -9223372033963249500 + test_realnum_expr expr-1.271\ + {i1=-3037000499, i2=-3037000500} {i1*i2} 9223372033963249500 + }} ifcapable floatingpoint { -- 2.5.0