From 7bcd4f0f17fb5bb6ae11be6ef0b70197195f2d61 Mon Sep 17 00:00:00 2001
From: Scott Hess <shess@chromium.org>
Date: Fri, 23 Sep 2016 09:54:14 -0700
Subject: [PATCH 14/14] [backport] Address integer overflow in sqlite3MulInt64.

SQLite check-in http://www.sqlite.org/src/info/db3ebd7c52cfc5fc

"Improved implementation of 64-bit signed integer multiply that
correctly detects overflow (and promotes to floating-point) in some
corner cases. Fix for ticket [1ec41379c9c1e400]"

http://www.sqlite.org/src/info/1ec41379c9c1e400"

BUG=601727
---
 third_party/sqlite/src/src/util.c     | 37 +++++++++++------------------------
 third_party/sqlite/src/test/expr.test | 27 +++++++++++++++++++++++++
 2 files changed, 38 insertions(+), 26 deletions(-)

diff --git a/third_party/sqlite/src/src/util.c b/third_party/sqlite/src/src/util.c
index b4c5e62..7640f1d 100644
--- a/third_party/sqlite/src/src/util.c
+++ b/third_party/sqlite/src/src/util.c
@@ -1244,36 +1244,21 @@ int sqlite3SubInt64(i64 *pA, i64 iB){
     return sqlite3AddInt64(pA, -iB);
   }
 }
-#define TWOPOWER32 (((i64)1)<<32)
-#define TWOPOWER31 (((i64)1)<<31)
 int sqlite3MulInt64(i64 *pA, i64 iB){
   i64 iA = *pA;
-  i64 iA1, iA0, iB1, iB0, r;
-
-  iA1 = iA/TWOPOWER32;
-  iA0 = iA % TWOPOWER32;
-  iB1 = iB/TWOPOWER32;
-  iB0 = iB % TWOPOWER32;
-  if( iA1==0 ){
-    if( iB1==0 ){
-      *pA *= iB;
-      return 0;
+  if( iB>0 ){
+    if( iA>LARGEST_INT64/iB ) return 1;
+    if( iA<SMALLEST_INT64/iB ) return 1;
+  }else if( iB<0 ){
+    if( iA>0 ){
+      if( iB<SMALLEST_INT64/iA ) return 1;
+    }else if( iA<0 ){
+      if( iB==SMALLEST_INT64 ) return 1;
+      if( iA==SMALLEST_INT64 ) return 1;
+      if( -iA>LARGEST_INT64/-iB ) return 1;
     }
-    r = iA0*iB1;
-  }else if( iB1==0 ){
-    r = iA1*iB0;
-  }else{
-    /* If both iA1 and iB1 are non-zero, overflow will result */
-    return 1;
   }
-  testcase( r==(-TWOPOWER31)-1 );
-  testcase( r==(-TWOPOWER31) );
-  testcase( r==TWOPOWER31 );
-  testcase( r==TWOPOWER31-1 );
-  if( r<(-TWOPOWER31) || r>=TWOPOWER31 ) return 1;
-  r *= TWOPOWER32;
-  if( sqlite3AddInt64(&r, iA0*iB0) ) return 1;
-  *pA = r;
+  *pA = iA*iB;
   return 0;
 }
 
diff --git a/third_party/sqlite/src/test/expr.test b/third_party/sqlite/src/test/expr.test
index 7d7b8ce..7a6d477 100644
--- a/third_party/sqlite/src/test/expr.test
+++ b/third_party/sqlite/src/test/expr.test
@@ -308,6 +308,33 @@ ifcapable floatingpoint {if {[working_64bit_int]} {
   test_realnum_expr expr-1.257\
       {i1=-4294967296, i2=-2147483647} {i1*i2}    9223372032559808512
 
+  test_realnum_expr expr-1.260\
+      {i1=3037000500, i2=3037000500} {i1*i2}      9.22337203700025e+18
+  test_realnum_expr expr-1.261\
+      {i1=3037000500, i2=-3037000500} {i1*i2}     -9.22337203700025e+18
+  test_realnum_expr expr-1.262\
+      {i1=-3037000500, i2=3037000500} {i1*i2}     -9.22337203700025e+18
+  test_realnum_expr expr-1.263\
+      {i1=-3037000500, i2=-3037000500} {i1*i2}    9.22337203700025e+18
+
+  test_realnum_expr expr-1.264\
+      {i1=3037000500, i2=3037000499} {i1*i2}      9223372033963249500
+  test_realnum_expr expr-1.265\
+      {i1=3037000500, i2=-3037000499} {i1*i2}     -9223372033963249500
+  test_realnum_expr expr-1.266\
+      {i1=-3037000500, i2=3037000499} {i1*i2}     -9223372033963249500
+  test_realnum_expr expr-1.267\
+      {i1=-3037000500, i2=-3037000499} {i1*i2}    9223372033963249500
+
+  test_realnum_expr expr-1.268\
+      {i1=3037000499, i2=3037000500} {i1*i2}      9223372033963249500
+  test_realnum_expr expr-1.269\
+      {i1=3037000499, i2=-3037000500} {i1*i2}     -9223372033963249500
+  test_realnum_expr expr-1.270\
+      {i1=-3037000499, i2=3037000500} {i1*i2}     -9223372033963249500
+  test_realnum_expr expr-1.271\
+      {i1=-3037000499, i2=-3037000500} {i1*i2}    9223372033963249500
+
 }}
 
 ifcapable floatingpoint {
-- 
2.5.0