database/sqlite
1
0
Fork 0
mirror of https://github.com/sqlite/sqlite.git synced 2025-11-18 10:21:03 +03:00
Code Activity

Prevent use-after-free of the u.vtab.idxStr string following an OOM

Browse Source 
while generating the OP_VFilter opcode.

FossilOrigin-Name: 751fe4edb2d4602e652523c2759de3f4fffd29d5c66cae68caf45b30fd8b750a
This commit is contained in:
drh
2020-09-17 11:32:14 +00:00
parent f1ea425560
commit bc2e95140b
3 changed files with 10 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
src/wherecode.c
View File

@@ -1397,6 +1397,9 @@ Bitmask sqlite3WhereCodeOneLoopStart(
pLoop->u.vtab.needFree ? P4_DYNAMIC : P4_STATIC);
VdbeCoverage(v);
pLoop->u.vtab.needFree = 0;
/* An OOM inside of AddOp4(OP_VFilter) instruction above might have freed
** the u.vtab.idxStr. NULL it out to prevent a use-after-free */
if( db->mallocFailed ) pLoop->u.vtab.idxStr = 0;
pLevel->p1 = iCur;
pLevel->op = pWInfo->eOnePass ? OP_Noop : OP_VNext;
pLevel->p2 = sqlite3VdbeCurrentAddr(v);