database/sqlite
1
0
Fork 0
mirror of https://github.com/sqlite/sqlite.git synced 2025-08-05 15:55:57 +03:00
Code Activity

Enhance the sqlite3_vtab_in_first() and sqlite3_vtab_in_next() interfaces so

Browse Source 
that they reliably return SQLITE_ERROR (and not SQLITE_MISUSE) if they are
invoked on a parameter that did not have multi-value IN processing enabled
via a prior call to sqlite3_vtab_in().  See
[forum:/forumpost/a823d4a3d5f73def|forum thread a823d4a3d5f73def].

FossilOrigin-Name: 144326dc171025dc8b5a77bebd8de3c19d5244ab807f5aa41f95313a25b880bc
This commit is contained in:
drh
2023-01-25 16:56:24 +00:00
parent a0fe1e7d13
commit b604f1456e
6 changed files with 36 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
src/vdbeapi.c
View File

@@ -882,6 +882,17 @@ int sqlite3_vtab_nochange(sqlite3_context *p){
return sqlite3_value_nochange(p->pOut);
}
/*
** The destructor function for a ValueList object. This needs to be
** a separate function, unknowable to the application, to ensure that
** calls to sqlite3_vtab_in_first()/sqlite3_vtab_in_next() that are not
** preceeded by activation of IN processing via sqlite3_vtab_int() do not
** try to access a fake ValueList object inserted by a hostile extension.
*/
void sqlite3VdbeValueListFree(void *pToDelete){
sqlite3_free(pToDelete);
}
/*
** Implementation of sqlite3_vtab_in_first() (if bNext==0) and
** sqlite3_vtab_in_next() (if bNext!=0).
@@ -896,8 +907,15 @@ static int valueFromValueList(
*ppOut = 0;
if( pVal==0 ) return SQLITE_MISUSE;
pRhs = (ValueList*)sqlite3_value_pointer(pVal, "ValueList");
if( pRhs==0 ) return SQLITE_MISUSE;
if( pVal->xDel!=sqlite3VdbeValueListFree ){
return SQLITE_ERROR;
}else{
assert( (pVal->flags&(MEM_TypeMask|MEM_Term|MEM_Subtype)) ==
(MEM_Null|MEM_Term|MEM_Subtype) );
assert( pVal->eSubtype=='p' );
assert( pVal->u.zPType!=0 && strcmp(pVal->u.zPType,"ValueList")==0 );
pRhs = (ValueList*)pVal->z;
}
if( bNext ){
rc = sqlite3BtreeNext(pRhs->pCsr, 0);
}else{