SQLite

View Ticket
Login
Plaintext
Ticket Hash: 6b00e0a34c8abd71093ea35df3f8ce9a8012aa0d
Title: The great OP_If bug
Status: Fixed Type: Code_Defect
Severity: Critical Priority: Immediate
Subsystem: Code_Generator Resolution: Fixed
Last Modified: 2009-11-16 12:51:04
Version Found In: 3.6.16
Description:
The code generator for EXISTS and SELECT expressions was storing the number of the register that holds the result in the Expr.iColumn field. However, Expr.iColumn is a 16-bit signed integer. Hence, for very complex statements that use more than 32768 registers prior to running the EXISTS or SELECT, the register number will overflow and possibly result in using a negative number for an array index and causing a subsequent malfunction or crash.

Solutions to this problem include:

  1. Make the Expr.iColumn field a 32-bit signed integer. (Version 3.6.16.1)
  1. Do not store the result register number in Expr but instead return the result register number as a function return value from the code generator routines that evaluate EXISTS and SELECT. (Version 3.6.20)

drh added on 2009-10-30 14:05:23:
Fixed by check-in [65a1f1334d] on the 3.6.16 branch.

Fixed by check-in [7253f8fad1] on the trunk.