[glass] Reject invalid blocksize in version file

Throw DatabaseCorruptError if value is out of range or not a power of
two.

xapian-core/backends/glass/glass_version.cc

@@ -456,25 +456,33 @@ RootInfo::serialise(string &s) const
 bool
 RootInfo::unserialise(const char ** p, const char * end)
 {
-    unsigned val;
+    unsigned val, b;
     if (!unpack_uint(p, end, &root) ||
 	!unpack_uint(p, end, &val) ||
 	!unpack_uint(p, end, &num_entries) ||
-	!unpack_uint(p, end, &blocksize) ||
+	!unpack_uint(p, end, &b) ||
 	!unpack_uint(p, end, &compress_min) ||
 	!unpack_string(p, end, fl_serialised)) return false;
-    int level_ = val >> 2;
+    auto level_ = val >> 2;
     if (rare(level_ >= GLASS_BTREE_CURSOR_LEVELS))
 	throw Xapian::DatabaseCorruptError("Impossibly deep Btree");
     level = level_;
     sequential = val & 0x02;
     root_is_fake = val & 0x01;
-    blocksize <<= 11;
-    AssertRel(blocksize,>=,GLASS_MIN_BLOCKSIZE);
+
+    b <<= 11;
+    if (rare(b < GLASS_MIN_BLOCKSIZE ||
+	     b > GLASS_MAX_BLOCKSIZE ||
+	     (b & (b - 1)) != 0)) {
+	throw Xapian::DatabaseCorruptError("Invalid block size");
+    }
+    blocksize = b;
+
     // Map old default to new default.
     if (compress_min == 4) {
 	compress_min = COMPRESS_MIN;
     }
+
     return true;
 }
 

xapian-core/tests/Makefile.am

@@ -211,8 +211,9 @@ EXTRA_DIST +=\
 	testdata/apitest_declen.txt \
 	testdata/apitest_diversify.txt \
 	testdata/etext.txt \
-	testdata/glass_corrupt_level_db1 \
-	testdata/glass_corrupt_level_db2 \
+	testdata/glass_corrupt_db1 \
+	testdata/glass_corrupt_db2 \
+	testdata/glass_corrupt_db3 \
 	testdata/phraseweightcheckbug1.txt \
 	testdata/snippet.txt
 

xapian-core/tests/api_backend.cc

@@ -2068,23 +2068,18 @@ DEFINE_TESTCASE(unsupportedcheck3, !backend) {
     }
 }
 
-// Test handling of corrupt DB with out of range levels count.
+// Test handling of corrupt DB with out of range values in the version file.
 // Regression test for #824, fixed in 1.4.25.
-DEFINE_TESTCASE(corruptdblevels1, glass) {
+DEFINE_TESTCASE(corruptglass1, glass) {
     string db_path =
-	test_driver::get_srcdir() + "/testdata/glass_corrupt_level_db1";
+	test_driver::get_srcdir() + "/testdata/glass_corrupt_db1";
 
-    TEST_EXCEPTION(Xapian::DatabaseCorruptError,
-		   Xapian::Database db(db_path));
+    for (int n = '1'; n <= '3'; ++n) {
+	db_path.back() = n;
+	TEST_EXCEPTION(Xapian::DatabaseCorruptError,
+		       Xapian::Database db(db_path));
 
-    TEST_EXCEPTION(Xapian::DatabaseCorruptError,
-		   Xapian::Database::check(db_path));
-
-    db_path.back() = '2';
-
-    TEST_EXCEPTION(Xapian::DatabaseCorruptError,
-		   Xapian::Database db(db_path));
-
-    TEST_EXCEPTION(Xapian::DatabaseCorruptError,
-		   Xapian::Database::check(db_path));
+	TEST_EXCEPTION(Xapian::DatabaseCorruptError,
+		       Xapian::Database::check(db_path));
+    }
 }