SQLite

Check-in [71c03b59b6]
Login

Many hyperlinks are disabled.
Use anonymous login to enable hyperlinks.

Overview
Comment:Fix a potential assertion fault discovered by OSS-Fuzz.
Downloads: Tarball | ZIP archive
Timelines: family | ancestors | descendants | both | trunk
Files: files | file ages | folders
SHA1: 71c03b59b645884ebd6b9e18713cd2eb8c949870
User & Date: drh 2017-01-10 15:08:06.289
Context
2017-01-10
16:09
Avoid unnecessary calls to the xRoundup() method of the memory allocator when the soft heap limit is not set. (check-in: 4209b89eab user: drh tags: trunk)
15:08
Fix a potential assertion fault discovered by OSS-Fuzz. (check-in: 71c03b59b6 user: drh tags: trunk)
2017-01-09
19:55
Remove a redundant assignment statement. (check-in: a5fa09657b user: drh tags: trunk)
Changes
Side-by-Side Diff Ignore Whitespace Patch
Changes to src/whereexpr.c.
︙
909
910
911
912
913
914
915

916
917
918
919
920
921
922

909
910
911
912
913
914
915
916
917
918
919
920
921
922
923








+








  Expr *pStr1 = 0;                 /* RHS of LIKE/GLOB operator */
  int isComplete = 0;              /* RHS of LIKE/GLOB ends with wildcard */
  int noCase = 0;                  /* uppercase equivalent to lowercase */
  int op;                          /* Top-level operator.  pExpr->op */
  Parse *pParse = pWInfo->pParse;  /* Parsing context */
  sqlite3 *db = pParse->db;        /* Database connection */
  unsigned char eOp2;              /* op2 value for LIKE/REGEXP/GLOB */
  int nLeft;                       /* Number of elements on left side vector */

  if( db->mallocFailed ){
    return;
  }
  pTerm = &pWC->a[idxTerm];
  pMaskSet = &pWInfo->sMaskSet;
  pExpr = pTerm->pExpr;
︙
1180
1181
1182
1183
1184
1185
1186

1187

1188
1189
1190


1191
1192
1193
1194
1195
1196
1197
1198
1199
1200

1181
1182
1183
1184
1185
1186
1187
1188

1189
1190


1191
1192

1193

1194
1195
1196
1197
1198
1199
1200








+
-
+

-
-
+
+
-

-








  ** new terms completely replace the original vector comparison, which is
  ** no longer used.
  **
  ** This is only required if at least one side of the comparison operation
  ** is not a sub-select.  */
  if( pWC->op==TK_AND 
  && (pExpr->op==TK_EQ || pExpr->op==TK_IS)
  && (nLeft = sqlite3ExprVectorSize(pExpr->pLeft))>1
  && sqlite3ExprIsVector(pExpr->pLeft)
  && sqlite3ExprVectorSize(pExpr->pRight)==nLeft
  && ( (pExpr->pLeft->flags & EP_xIsSelect)==0 
    || (pExpr->pRight->flags & EP_xIsSelect)==0
  )){
    || (pExpr->pRight->flags & EP_xIsSelect)==0)
  ){
    int nLeft = sqlite3ExprVectorSize(pExpr->pLeft);
    int i;
    assert( nLeft==sqlite3ExprVectorSize(pExpr->pRight) );
    for(i=0; i<nLeft; i++){
      int idxNew;
      Expr *pNew;
      Expr *pLeft = sqlite3ExprForVectorField(pParse, pExpr->pLeft, i);
      Expr *pRight = sqlite3ExprForVectorField(pParse, pExpr->pRight, i);

      pNew = sqlite3PExpr(pParse, pExpr->op, pLeft, pRight);
︙