SQLite Forum

Hi Team, 

There are potential NULL pointer dereferences, checks should be implemented to the return value of function sqlite3ExprSkipCollateAndLikely. A similar problem has been fixed in [check-in:5aeb5a2d].

In function resolveCompoundOrderBy in /src/resolve.c,           

    Expr *pE, *pDup;
    if( pItem->done ) continue;
    pE = sqlite3ExprSkipCollateAndLikely(pItem->pExpr);
    if( sqlite3ExprIsInteger(pE, &iCol) ){
      if( iCol<=0 || iCol>pEList->nExpr ){
        resolveOutOfRangeError(pParse, "ORDER", i+1, pEList->nExpr);
        return 1;
      }
    }else{
      iCol = resolveAsName(pParse, pEList, pE);


In function resolveCompoundOrderBy in /src/resolve.c,

    Expr *pE2 = sqlite3ExprSkipCollateAndLikely(pE);
    if( zType[0]!='G' ){
    iCol = resolveAsName(pParse, pSelect->pEList, pE2);


In function findIndexCol in /src/where.c,

    Expr *p = sqlite3ExprSkipCollateAndLikely(pList->a[i].pExpr);
    if( p->op==TK_COLUMN
     && p->iColumn==pIdx->aiColumn[iCol]
     && p->iTable==iBase


In function isDistinctRedundant in /src/where.c,

    for(i=0; i<pDistinct->nExpr; i++){
        Expr *p = sqlite3ExprSkipCollateAndLikely(pDistinct->a[i].pExpr);
        if( p->op==TK_COLUMN && p->iTable==iBase && p->iColumn<0 ) return 1;
    }


In function indexMightHelpWithOrderBy in /src/where.c,
    
    Expr *pExpr = sqlite3ExprSkipCollateAndLikely(pOB->a[ii].pExpr);
    if( pExpr->op==TK_COLUMN && pExpr->iTable==iCursor ){
      if( pExpr->iColumn<0 ) return 1;
      for(jj=0; jj<pIndex->nKeyCol; jj++){
        if( pExpr->iColumn==pIndex->aiColumn[jj] ) return 1;
      }


In function exprToRegister in /src/expr.c,

    Expr *p = sqlite3ExprSkipCollateAndLikely(pExpr);
    p->op2 = p->op;
    p->op = TK_REGISTER;
    p->iTable = iReg;
    ExprClearProperty(p, EP_Skip);


In function sqlite3ExprCodeTemp in /src/expr.c,

    pExpr = sqlite3ExprSkipCollateAndLikely(pExpr);
    if( ConstFactorOk(pParse)
     && pExpr->op!=TK_REGISTER
     && sqlite3ExprIsConstantNotJoin(pExpr)
    ){