mirror of
https://github.com/sqlite/sqlite.git
synced 2025-11-11 01:42:22 +03:00
Fix an incorrect table ref-count in the new recursive CTE logic that might
result in a reference to freed memory following a syntax error. FossilOrigin-Name: 75a0288871ccb2a69a636cbb328fe19045a0d0ef96a193ecd118b9a196784d2d
This commit is contained in:
@@ -4861,6 +4861,7 @@ static int withExpand(
|
||||
&& 0==sqlite3StrICmp(pItem->zName, pCte->zName)
|
||||
){
|
||||
pItem->pTab = pTab;
|
||||
pTab->nTabRef++;
|
||||
pItem->fg.isRecursive = 1;
|
||||
if( pRecTerm->selFlags & SF_Recursive ){
|
||||
sqlite3ErrorMsg(pParse,
|
||||
@@ -4868,7 +4869,6 @@ static int withExpand(
|
||||
);
|
||||
return SQLITE_ERROR;
|
||||
}
|
||||
pTab->nTabRef++;
|
||||
pRecTerm->selFlags |= SF_Recursive;
|
||||
if( iRecTab<0 ) iRecTab = pParse->nTab++;
|
||||
pItem->iCursor = iRecTab;
|
||||
|
||||
Reference in New Issue
Block a user