[M102-LTS] Enhance defensive mode so that it disallows CREATE TRIGGER statements if
the statements within the trigger attempt to write on a shadow table. Also
make the legacy FTS3 code more robust against integer overflow during
memory allocation.
Bug: 1368076
FossilOrigin-Name: c41f25e6f3591e575452c4c68f8072a0163cc00d80af31f90d407c7deca79622
(cherry picked from commit 3ec786ab9cfa213525ecc18b326aeb18ab842f7d)
Change-Id: I3b2cbf7c04f1873a6001d577feefaa8abd9f2a7d
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/deps/sqlite/+/3933554
Reviewed-by: Ayu Ishii <ayui@chromium.org>
diff --git a/src/trigger.c b/src/trigger.c
index 5df6b0c..fcf1f77 100644
--- a/src/trigger.c
+++ b/src/trigger.c
@@ -354,6 +354,23 @@
Vdbe *v;
char *z;
+ /* If this is a new CREATE TABLE statement, and if shadow tables
+ ** are read-only, and the trigger makes a change to a shadow table,
+ ** then raise an error - do not allow the trigger to be created. */
+ if( sqlite3ReadOnlyShadowTables(db) ){
+ TriggerStep *pStep;
+ for(pStep=pTrig->step_list; pStep; pStep=pStep->pNext){
+ if( pStep->zTarget!=0
+ && sqlite3ShadowTableName(db, pStep->zTarget)
+ ){
+ sqlite3ErrorMsg(pParse,
+ "trigger \"%s\" may not write to shadow table \"%s\"",
+ pTrig->zName, pStep->zTarget);
+ goto triggerfinish_cleanup;
+ }
+ }
+ }
+
/* Make an entry in the sqlite_schema table */
v = sqlite3GetVdbe(pParse);
if( v==0 ) goto triggerfinish_cleanup;