From e0b995b2a62b78979eb65bb8dadfa912eaa8e62f Mon Sep 17 00:00:00 2001
From: drh <>
Date: Mon, 11 May 2026 12:00:19 +0000
Subject: [PATCH] Fix potential buffer overwrite that could occur in fts5 when
 processing corrupt records.

CVE: CVE-2026-11822
CVE: CVE-2026-11824
Upstream: https://sqlite.org/src/info/061febcf41ca
Upstream: https://github.com/sqlite/sqlite/commit/e0b995b2a62b78979eb65bb8dadfa912eaa8e62f
[thomas: backport and remove tests]
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
---
 ext/fts5/fts5_index.c           |  2 +-
 1 files changed, 1 insertion(+), 1 deletion(-)

diff --git a/ext/fts5/fts5_index.c b/ext/fts5/fts5_index.c
index 164d613881..29be766042 100644
--- a/sqlite3.c
+++ b/sqlite3.c
@@ -245146,7 +245146,7 @@ static void fts5DataRelease(Fts5Data *pData){
 static Fts5Data *fts5LeafRead(Fts5Index *p, i64 iRowid){
   Fts5Data *pRet = fts5DataRead(p, iRowid);
   if( pRet ){
-    if( pRet->nn<4 || pRet->szLeaf>pRet->nn ){
+    if( pRet->szLeaf<4 || pRet->szLeaf>pRet->nn ){
       p->rc = FTS5_CORRUPT;
       fts5DataRelease(pRet);
       pRet = 0;