SQLite

Check-in [4892440b]
Login

Many hyperlinks are disabled.
Use anonymous login to enable hyperlinks.

Overview
Comment:Changes to vtabCallConstructor() to avoid a harmless static analyzer warning and to help prove that the UAF reported by forum post cafbe582e8 is a false-positive.
Downloads: Tarball | ZIP archive | SQL archive
Timelines: family | ancestors | descendants | both | trunk
Files: files | file ages | folders
SHA3-256: 4892440b93306e5a245f18c0d3d295d851e6712260e420016c0d70e12abf8901
User & Date: drh 2024-02-13 17:11:19
Context
2024-02-13
18:41
Fix a bug in PRAGMA integrity_check introduced by enhancement (8a) in release 3.42.0 and first reported by forum post ee4f6fa5ab. (check-in: 460353df user: drh tags: trunk)
17:11
Changes to vtabCallConstructor() to avoid a harmless static analyzer warning and to help prove that the UAF reported by forum post cafbe582e8 is a false-positive. (check-in: 4892440b user: drh tags: trunk)
2024-02-12
19:12
Replace the assert() that was removed by [f023cb541b5dd72c] because [1cd5d4623f44af25] made it true again. (check-in: 189a49f1 user: drh tags: trunk)
Changes
Unified Diff Ignore Whitespace Patch
Changes to src/vtab.c.
︙︙
607
608
609
610
611
612
613


614
615
616
617
618
619
620

  sCtx.pTab = pTab;
  sCtx.pVTable = pVTable;
  sCtx.pPrior = db->pVtabCtx;
  sCtx.bDeclared = 0;
  db->pVtabCtx = &sCtx;
  pTab->nTabRef++;
  rc = xConstruct(db, pMod->pAux, nArg, azArg, &pVTable->pVtab, &zErr);


  sqlite3DeleteTable(db, pTab);
  db->pVtabCtx = sCtx.pPrior;
  if( rc==SQLITE_NOMEM ) sqlite3OomFault(db);
  assert( sCtx.pTab==pTab );

  if( SQLITE_OK!=rc ){
    if( zErr==0 ){








>
>








607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622

  sCtx.pTab = pTab;
  sCtx.pVTable = pVTable;
  sCtx.pPrior = db->pVtabCtx;
  sCtx.bDeclared = 0;
  db->pVtabCtx = &sCtx;
  pTab->nTabRef++;
  rc = xConstruct(db, pMod->pAux, nArg, azArg, &pVTable->pVtab, &zErr);
  assert( pTab!=0 );
  assert( pTab->nTabRef>1 || rc!=SQLITE_OK );
  sqlite3DeleteTable(db, pTab);
  db->pVtabCtx = sCtx.pPrior;
  if( rc==SQLITE_NOMEM ) sqlite3OomFault(db);
  assert( sCtx.pTab==pTab );

  if( SQLITE_OK!=rc ){
    if( zErr==0 ){
︙︙
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643

    ** the sqlite3_vtab object if successful.  */
    memset(pVTable->pVtab, 0, sizeof(pVTable->pVtab[0]));
    pVTable->pVtab->pModule = pMod->pModule;
    pMod->nRefModule++;
    pVTable->nRef = 1;
    if( sCtx.bDeclared==0 ){
      const char *zFormat = "vtable constructor did not declare schema: %s";
      *pzErr = sqlite3MPrintf(db, zFormat, pTab->zName);
      sqlite3VtabUnlock(pVTable);
      rc = SQLITE_ERROR;
    }else{
      int iCol;
      u16 oooHidden = 0;
      /* If everything went according to plan, link the new VTable structure
      ** into the linked list headed by pTab->u.vtab.p. Then loop through the








|








631
632
633
634
635
636
637
638
639
640
641
642
643
644
645

    ** the sqlite3_vtab object if successful.  */
    memset(pVTable->pVtab, 0, sizeof(pVTable->pVtab[0]));
    pVTable->pVtab->pModule = pMod->pModule;
    pMod->nRefModule++;
    pVTable->nRef = 1;
    if( sCtx.bDeclared==0 ){
      const char *zFormat = "vtable constructor did not declare schema: %s";
      *pzErr = sqlite3MPrintf(db, zFormat, zModuleName);
      sqlite3VtabUnlock(pVTable);
      rc = SQLITE_ERROR;
    }else{
      int iCol;
      u16 oooHidden = 0;
      /* If everything went according to plan, link the new VTable structure
      ** into the linked list headed by pTab->u.vtab.p. Then loop through the
︙︙