AryaWu/sqlite

1# 2009 June 32#3# The author disclaims copyright to this source code.  In place of4# a legal notice, here is a blessing:5#6#    May you do good and not evil.7#    May you find forgiveness for yourself and forgive others.8#    May you share freely, never taking more than you give.9#10#***********************************************************************11#12# $Id: corruptD.test,v 1.2 2009/06/05 17:09:12 drh Exp $13 14set testdir [file dirname $argv0]15source $testdir/tester.tcl16 17# Do not use a codec for tests in this file, as the database file is18# manipulated directly using tcl scripts (using the [hexio_write] command).19#20do_not_use_codec21 22# These tests deal with corrupt database files23#24database_may_be_corrupt25 26#--------------------------------------------------------------------------27# OVERVIEW28#29#   This test file attempts to verify that SQLite does not read past the 30#   end of any in-memory buffers as a result of corrupted database page 31#   images. Usually this happens because a field within a database page32#   that contains an offset to some other structure within the same page33#   is set to too large a value. A database page contains the following34#   such fields:35#36#     1. The page header field that contains the offset to the first 37#        free block of space.38#39#     2. The first two bytes of all but the last free block on the free-block40#        list (the offset to the next free block).41#42#     3. The page header field containing the number of cells on the page43#        (implicitly defines the offset to the final element in the cell offset44#        array, which could potentially be off the end of the page).45#46#     4. The page header field containing the offset to the start of the cell47#        content area.48#49#     5. The contents of the cell offset array.50#51#     6. The first few bytes of each cell determine the size of the cell52#        stored within the page, and hence the offset to the final byte of53#        the cell.54#55#   If any of the above fields are set to too large a value, then a buffer56#   overread may occur. This test script creates and operates on various57#   strategically corrupted database files to attempt to provoke such buffer58#   overreads.59#60#   Very often, a buffer overread passes unnoticed, particularly in workstation61#   environments. For this reason, this test script should be run using valgrind62#   (or similar) in order to verify that no overreads occur.63#64# TEST PLAN65# 66#   Test cases corruptD-1.* are white-box tests. They attempt to corrupt67#   one of the above fields, then exercise each part of the code in btree.c68#   that uses said field.69#   70#   Offset variables 1, 2, 3 and 4 are all checked to make sure they71#   will not result in buffer overruns as part of page initialization in72#   sqlite3BtreeInitPage(). Offsets 5 and 6 cannot be tested as part of73#   page initialization, as trying to do so causes a performance hit.74#75 76do_test corruptD-1.0 {77  execsql { 78    PRAGMA auto_vacuum = 0;79    PRAGMA page_size = 1024;80    CREATE TABLE t1(a, b);81    CREATE INDEX i1 ON t1(a, b);82  }83  for {set ii 1} {$ii < 50} {incr ii} {84    execsql { INSERT INTO t1 VALUES($ii, $ii * $ii) }85  }86  execsql {87    DELETE FROM t1 WHERE a = 10;88    DELETE FROM t1 WHERE a = 20;89    DELETE FROM t1 WHERE a = 30;90    DELETE FROM t1 WHERE a = 40;91  }92  forcecopy test.db test.bu93} {}94 95proc incr_change_counter {} {96  hexio_write test.db 24 [97    hexio_render_int32 [expr [hexio_get_int [hexio_read test.db 24 4]] + 1]98  ]99}100 101proc restore_file {} {102  db close103  forcecopy test.bu test.db104  sqlite3 db test.db105}106 107#-------------------------------------------------------------------------108# The following tests, corruptD-1.1.*, focus on the page header field109# containing the offset of the first free block in a page. 110#111do_test corruptD-1.1.1 {112  incr_change_counter113  hexio_write test.db [expr 1024+1] FFFF114  catchsql { PRAGMA quick_check }115} {0 {{*** in database main ***116Tree 2 page 2: free space corruption} {wrong # of entries in index i1}}}117do_test corruptD-1.1.2 {118  incr_change_counter119  hexio_write test.db [expr 1024+1] [hexio_render_int32 1021]120  catchsql { SELECT * FROM t1 ORDER BY rowid }121} {1 {database disk image is malformed}}122 123#-------------------------------------------------------------------------124# The following tests, corruptD-1.2.*, focus on the offsets contained125# in the first 2 byte of each free-block on the free-list.126#127do_test corruptD-1.2.1 {128  restore_file129} {}130do_test corruptD-1.2.2 {131} {}132 133#-------------------------------------------------------------------------134# The following tests, corruptD-1.4.*, ...135#136 137 138#-------------------------------------------------------------------------139# The following tests, corruptD-1.5.*, focus on the offsets contained140# in the cell offset array.141# 142#   defragmentPage143#144 145finish_test146