wasCSharpSQLite – Blame information for rev 4

Subversion Repositories:
Rev:
Rev Author Line No. Line
1 office 1 # 2009 June 3
2 #
3 # The author disclaims copyright to this source code. In place of
4 # a legal notice, here is a blessing:
5 #
6 # May you do good and not evil.
7 # May you find forgiveness for yourself and forgive others.
8 # May you share freely, never taking more than you give.
9 #
10 #***********************************************************************
11 #
12 # $Id: corruptD.test,v 1.2 2009/06/05 17:09:12 drh Exp $
13  
14 set testdir [file dirname $argv0]
15 source $testdir/tester.tcl
16  
17 # Do not use a codec for tests in this file, as the database file is
18 # manipulated directly using tcl scripts (using the [hexio_write] command).
19 #
20 do_not_use_codec
21  
22 #--------------------------------------------------------------------------
23 # OVERVIEW
24 #
25 # This test file attempts to verify that SQLite does not read past the
26 # end of any in-memory buffers as a result of corrupted database page
27 # images. Usually this happens because a field within a database page
28 # that contains an offset to some other structure within the same page
29 # is set to too large a value. A database page contains the following
30 # such fields:
31 #
32 # 1. The page header field that contains the offset to the first
33 # free block of space.
34 #
35 # 2. The first two bytes of all but the last free block on the free-block
36 # list (the offset to the next free block).
37 #
38 # 3. The page header field containing the number of cells on the page
39 # (implicitly defines the offset to the final element in the cell offset
40 # array, which could potentially be off the end of the page).
41 #
42 # 4. The page header field containing the offset to the start of the cell
43 # content area.
44 #
45 # 5. The contents of the cell offset array.
46 #
47 # 6. The first few bytes of each cell determine the size of the cell
48 # stored within the page, and hence the offset to the final byte of
49 # the cell.
50 #
51 # If any of the above fields are set to too large a value, then a buffer
52 # overread may occur. This test script creates and operates on various
53 # strategically corrupted database files to attempt to provoke such buffer
54 # overreads.
55 #
56 # Very often, a buffer overread passes unnoticed, particularly in workstation
57 # environments. For this reason, this test script should be run using valgrind
58 # (or similar) in order to verify that no overreads occur.
59 #
60 # TEST PLAN
61 #
62 # Test cases corruptD-1.* are white-box tests. They attempt to corrupt
63 # one of the above fields, then exercise each part of the code in btree.c
64 # that uses said field.
65 #
66 # Offset variables 1, 2, 3 and 4 are all checked to make sure they
67 # will not result in buffer overruns as part of page initialization in
68 # sqlite3BtreeInitPage(). Offsets 5 and 6 cannot be tested as part of
69 # page initialization, as trying to do so causes a performance hit.
70 #
71  
72 do_test corruptD-1.0 {
73 execsql {
74 PRAGMA auto_vacuum = 0;
75 PRAGMA page_size = 1024;
76 CREATE TABLE t1(a, b);
77 CREATE INDEX i1 ON t1(a, b);
78 }
79 for {set ii 1} {$ii < 50} {incr ii} {
80 execsql { INSERT INTO t1 VALUES($ii, $ii * $ii) }
81 }
82 execsql {
83 DELETE FROM t1 WHERE a = 10;
84 DELETE FROM t1 WHERE a = 20;
85 DELETE FROM t1 WHERE a = 30;
86 DELETE FROM t1 WHERE a = 40;
87 }
88 copy_file test.db test.bu
89 } {}
90  
91 proc incr_change_counter {} {
92 hexio_write test.db 24 [
93 hexio_render_int32 [expr [hexio_get_int [hexio_read test.db 24 4]] + 1]
94 ]
95 }
96  
97 proc restore_file {} {
98 db close
99 copy_file test.bu test.db
100 sqlite3 db test.db
101 }
102  
103 #-------------------------------------------------------------------------
104 # The following tests, corruptD-1.1.*, focus on the page header field
105 # containing the offset of the first free block in a page.
106 #
107 do_test corruptD-1.1.1 {
108 incr_change_counter
109 hexio_write test.db [expr 1024+1] FFFF
110 catchsql { SELECT * FROM t1 }
111 } {1 {database disk image is malformed}}
112 do_test corruptD-1.1.2 {
113 incr_change_counter
114 hexio_write test.db [expr 1024+1] [hexio_render_int32 1021]
115 catchsql { SELECT * FROM t1 }
116 } {1 {database disk image is malformed}}
117  
118 #-------------------------------------------------------------------------
119 # The following tests, corruptD-1.2.*, focus on the offsets contained
120 # in the first 2 byte of each free-block on the free-list.
121 #
122 do_test corruptD-1.2.1 {
123 restore_file
124 } {}
125 do_test corruptD-1.2.2 {
126 } {}
127  
128 #-------------------------------------------------------------------------
129 # The following tests, corruptD-1.4.*, ...
130 #
131  
132  
133 #-------------------------------------------------------------------------
134 # The following tests, corruptD-1.5.*, focus on the offsets contained
135 # in the cell offset array.
136 #
137 # defragmentPage
138 #
139  
140 finish_test