Fix a possible OOB write in the recover extension given a corrupt

schema.  [bugs:/info/2026-10-25T12:08:19Z|Bug 2026-10-25T12:08:19Z].

FossilOrigin-Name: 37963c3869640f9857dd4edf5e26fdca336ec71d8b1cf188507cab5fad91f681

ext/recover/recovercorrupt4.test

@@ -60,4 +60,36 @@ if {[permutation]!="inmemory_journal"} {
   } {1 1 2 2 4 4 8 8}
 }
 
+# Bug 2026-10-25T12:08:19Z
+#
+reset_db
+do_execsql_test 2.0 {
+  CREATE TABLE x(a); INSERT INTO x VALUES(1);
+  PRAGMA writable_schema=ON;
+  DELETE FROM sqlite_schema WHERE name='x';
+  INSERT INTO sqlite_schema VALUES('table','aa','aa',0,
+    'CREATE TEMP TABLE tb(c0,c1,c2,c3,c4,c5,c6,c7,c8,c9,c10,c11,c12,c13,c14,c15,c16,c17)');
+  INSERT INTO sqlite_schema VALUES('table','ab','ab',0,'CREATE INDEX temp.x ON tb(c17)');
+  INSERT INTO sqlite_schema VALUES('table','x','x',2,'CREATE TABLE x(a)');
+  PRAGMA writable_schema=RESET;
+}
+do_catchsql_test 2.1 {
+  PRAGMA integrity_check;
+} {1 {malformed database schema (aa)}}
+do_test 2.3 {
+  forcedelete test.db2
+  set R [sqlite3_recover_init db main test.db2]
+  $R run
+  $R finish
+} {}
+do_test 2.4 {
+  sqlite3 db2 test.db2
+  db2 eval {PRAGMA integrity_check}
+} {ok}
+do_test 2.5 {
+  db2 eval {SELECT * FROM x}
+} {1}
+
+
+
 finish_test

ext/recover/sqlite3recover.c

@@ -1141,7 +1141,7 @@ static void recoverAddTable(
       int iField = sqlite3_column_int(pStmt, 0);
       int iCol = sqlite3_column_int(pStmt, 1);
 
-      assert( iCol<pNew->nCol );
+      if( iCol>=pNew->nCol ) break;
       pNew->aCol[iCol].iField = iField;
 
       pNew->bIntkey = 0;

manifest

@@ -1,5 +1,5 @@
-C Have\svec1\scheck\sthe\svector\ssize\sfield\sis\swithin\srange\swhen\sloading\sa\sconfiguration.\sReport\s[bugs:/info/2026-10-24T09:06:20Z\s|\s2026-10-24T09:06:20Z].
-D 2026-10-24T16:35:32.680
+C Fix\sa\spossible\sOOB\swrite\sin\sthe\srecover\sextension\sgiven\sa\scorrupt\nschema.\s\s[bugs:/info/2026-10-25T12:08:19Z|Bug\s2026-10-25T12:08:19Z].
+D 2026-10-25T13:07:54.033
 F .fossil-settings/binary-glob 61195414528fb3ea9693577e1980230d78a1f8b0a54c78cf1b9b24d0a409ed6a x
 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
@@ -484,7 +484,7 @@ F ext/recover/recoverclobber.test 3ba6c0c373c5c63d17e82eced64c05c57ccaf26c1abe1c
 F ext/recover/recovercorrupt.test 64c081ad1200ae77b447da99eb724785d6bf71715f394543dc7689642e92bf49
 F ext/recover/recovercorrupt2.test 7347ccc9c36a925d99b56689c791423b45294834198f17575183fd500f52d85d
 F ext/recover/recovercorrupt3.test 2e7b9a1b528ca23ed382cec6f64e3fcbbd0f8e852add7562397fd8df83f335d5
-F ext/recover/recovercorrupt4.test 3e2794145dad2517c018cb68b96f59d4d55b18b3d6271e1d37852cfd7a30b50c
+F ext/recover/recovercorrupt4.test ce5c5359f633cd8457fb9a2fb786fe92c86042ef885de90119a4f81f1b275fe6
 F ext/recover/recoverfault.test 9d9f88eeb222615a25e7514f234c950d46bee20d24cd8db49d8fff8d650dcfe1
 F ext/recover/recoverfault2.test 730e7371bcda769554d15460cb23126abba1be8eca9539ccabf63623e7bb7e09
 F ext/recover/recoverold.test 68db3d6f85dd2b98e785b6c4da4f5eea4bbe52ccf6674d9a94c7506dc92596aa
@@ -492,7 +492,7 @@ F ext/recover/recoverpgsz.test 88766fcb810e52ee05335c456d4e5fb06d02b73d3ccb48c52
 F ext/recover/recoverrowid.test f948bf4024a5f41b0e21b8af80c60564c5b5d78c05a8d64fc00787715ff9f45f
 F ext/recover/recoverslowidx.test c90d59c46bb8924a973ac6fbc38f3163cee38cc240256addcab1cf1a322c37dc
 F ext/recover/recoversql.test e66d01f95302a223bcd3fd42b5ee58dc2b53d70afa90b0d00e41e4b8eab20486
-F ext/recover/sqlite3recover.c 7a049049c9844837a82a28bed0885ea4515cb44b60c227ebaebb858f628a6847
+F ext/recover/sqlite3recover.c a0107dc9d68dd76d7432f6ae18745c3b7a3425b519e870e81769880c9105fb89
 F ext/recover/sqlite3recover.h 011c799f02deb70ab685916f6f538e6bb32c4e0025e79bfd0e24ff9c74820959
 F ext/recover/test_recover.c 3d0fb1df7823f5bc22a0b93955034d16a2dfa2eb1e443e9a0123a77f120599a3
 F ext/rtree/README 734aa36238bcd2dee91db5dba107d5fcbdb02396612811377a8ad50f1272b1c1
@@ -2289,8 +2289,8 @@ F tool/warnings-clang.sh bbf6a1e685e534c92ec2bfba5b1745f34fb6f0bc2a362850723a9ee
 F tool/warnings.sh a554d13f6e5cf3760f041b87939e3d616ec6961859c3245e8ef701d1eafc2ca2
 F tool/win/sqlite.vsix deb315d026cc8400325c5863eef847784a219a2f
 F tool/winmain.c 00c8fb88e365c9017db14c73d3c78af62194d9644feaf60e220ab0f411f3604c
-P 25a81a8650505b08597947ec58ad6591ca62af4b40a92a910347ac61053865f7
-R 14359a8cab679bf55908828e0d5d93c4
-U dan
-Z 9972ed632ad6bb8fc2b316c1a3ca35fd
+P d3325353c8326ba92f03b3bdd46dc4522cd7eb3da670adb073bb060927be58c6
+R f821efa76317ac93cafa49acb96b5e04
+U drh
+Z ee711a829ebd704e268e13c01c48bb7d
 # Remove this line to create a well-formed Fossil manifest.

manifest.uuid

@@ -1 +1 @@
-d3325353c8326ba92f03b3bdd46dc4522cd7eb3da670adb073bb060927be58c6
+37963c3869640f9857dd4edf5e26fdca336ec71d8b1cf188507cab5fad91f681