Do not allocate so much surplus memory in the implementation of the

replace() function. (CVS 3951)

FossilOrigin-Name: 0cf518ceebda8e7421d054813f97cc447d292344

manifest

@@ -1,5 +1,5 @@
-C Limit\sthe\slength\sof\sthe\spatterns\son\sLIKE\sand\sGLOB\sto\savoid\sproblems\swith\ndeep\srecursion\sand\sN^2\sbehavior.\s(CVS\s3950)
+C Do\snot\sallocate\sso\smuch\ssurplus\smemory\sin\sthe\simplementation\sof\sthe\nreplace()\sfunction.\s(CVS\s3951)
-D 2007-05-08T15:34:48
+D 2007-05-08T15:46:18
 F Makefile.in 87b200ad9970907f76df734d29dff3d294c10935
 F Makefile.linux-gcc 2d8574d1ba75f129aba2019f0b959db380a90935
 F README 9c4e2d6706bdcc3efdd773ce752a8cdab4f90028
@@ -71,7 +71,7 @@ F src/date.c 263ef5b81b4ffdd80e8a830645798967bbbcfd05
 F src/delete.c 5c0d89b3ef7d48fe1f5124bfe8341f982747fe29
 F src/experimental.c 1b2d1a6cd62ecc39610e97670332ca073c50792b
 F src/expr.c 2f0f9f89efe9170e5e6ca5d5e93a9d5896fff5ac
-F src/func.c 21a7e73009510e90f09759b5097481c68ca8dcd3
+F src/func.c 1598afc91529eed0307e9581f852779efbc8d12d
 F src/hash.c 67b23e14f0257b69a3e8aa663e4eeadc1a2b6fd5
 F src/hash.h 1b3f7e2609141fd571f62199fc38687d262e9564
 F src/insert.c e595ca26805dfb3a9ebaabc28e7947c479f3b14d
@@ -485,7 +485,7 @@ F www/tclsqlite.tcl bb0d1357328a42b1993d78573e587c6dcbc964b9
 F www/vdbe.tcl 87a31ace769f20d3627a64fa1fade7fed47b90d0
 F www/version3.tcl 890248cf7b70e60c383b0e84d77d5132b3ead42b
 F www/whentouse.tcl fc46eae081251c3c181bd79c5faef8195d7991a5
-P 17c4235c492f746867c1d2b8621043b93f8aa10e
+P 42e6c826998e69462462b0787d3650246d36f3b5
-R 0a41035fc5149b0f6c2804cac4e2cff2
+R 1e9068e3e524fdba724ca45c93150d52
 U drh
-Z a17f2a395ca2369e7d20c7284dc12ad3
+Z 4f1deed1abb3d0cd324c190974c006a2

manifest.uuid

@@ -1 +1 @@
-42e6c826998e69462462b0787d3650246d36f3b5
+0cf518ceebda8e7421d054813f97cc447d292344

src/func.c

@@ -16,7 +16,7 @@
 ** sqliteRegisterBuildinFunctions() found at the bottom of the file.
 ** All other code has file scope.
 **
-** $Id: func.c,v 1.150 2007/05/08 15:34:48 drh Exp $
+** $Id: func.c,v 1.151 2007/05/08 15:46:18 drh Exp $
 */
 #include "sqliteInt.h"
 #include <ctype.h>
@@ -748,7 +748,7 @@ static void replaceFunc(
   int nStr;                /* Size of zStr */
   int nPattern;            /* Size of zPattern */
   int nRep;                /* Size of zRep */
-  int nOut;                /* Maximum size of zOut */
+  i64 nOut;                /* Maximum size of zOut */
   int loopLimit;           /* Last zStr[] that might match zPattern[] */
   int i, j;                /* Loop counters */
 
@@ -762,29 +762,33 @@ static void replaceFunc(
   nRep = sqlite3_value_bytes(argv[2]);
   zRep = sqlite3_value_text(argv[2]);
   if( zRep==0 ) return;
-  if( nPattern>=nRep ){
+  nOut = nStr + 1;
-    nOut = nStr;
+  assert( nOut<SQLITE_MAX_LENGTH );
-  }else{
+  zOut = sqlite3_malloc((int)nOut);
-    i64 nOut64 = (i64)(nStr/nPattern + 1) * (i64)nRep;
+  if( zOut==0 ){
-    nOut = ((nOut64>SQLITE_MAX_LENGTH) ? SQLITE_MAX_LENGTH : nOut64);
+    return;
   }
-  zOut = sqlite3_malloc(nOut+1);
-  if( zOut==0 ) return;
   loopLimit = nStr - nPattern;  
   for(i=j=0; i<=loopLimit; i++){
     if( zStr[i]!=zPattern[0] || memcmp(&zStr[i], zPattern, nPattern) ){
       zOut[j++] = zStr[i];
     }else{
-      if( (j+nRep+loopLimit-i)>SQLITE_MAX_LENGTH ){
+      nOut += nRep - nPattern;
+      if( nOut>=SQLITE_MAX_LENGTH ){
         sqlite3_result_error_toobig(context);
         sqlite3_free(zOut);
         return;
       }
+      zOut = sqlite3_realloc(zOut, (int)nOut);
+      if( zOut==0 ){
+        return;
+      }
       memcpy(&zOut[j], zRep, nRep);
       j += nRep;
       i += nPattern-1;
     }
   }
+  assert( j+nStr-i+1==nOut );
   memcpy(&zOut[j], &zStr[i], nStr-i);
   j += nStr - i;
   assert( j<=nOut );