database/sqlite
1
0
Fork 0
mirror of https://github.com/sqlite/sqlite.git synced 2025-11-08 03:22:21 +03:00
Code Activity

Fix additional cases of possible signed integer overflow, especially with

Browse Source 
regard to negation.

FossilOrigin-Name: 2d5800bd8cfc7d7f5578a71b1aeaa74b2ec4b372
This commit is contained in:
drh
2011-03-08 02:38:28 +00:00
parent 2327275b8c
commit d50ffc416f
9 changed files with 45 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
src/expr.c
View File

@@ -389,6 +389,7 @@ Expr *sqlite3ExprAlloc(
if( op!=TK_INTEGER || pToken->z==0
|| sqlite3GetInt32(pToken->z, &iValue)==0 ){
nExtra = pToken->n+1;
assert( iValue>=0 );
}
}
pNew = sqlite3DbMallocZero(db, sizeof(Expr)+nExtra);
@@ -614,6 +615,8 @@ void sqlite3ExprAssignVarNumber(Parse *pParse, Expr *pExpr){
*/
void sqlite3ExprDelete(sqlite3 *db, Expr *p){
if( p==0 ) return;
/* Sanity check: Assert that the IntValue is non-negative if it exists */
assert( !ExprHasProperty(p, EP_IntValue) || p->u.iValue>=0 );
if( !ExprHasAnyProperty(p, EP_TokenOnly) ){
sqlite3ExprDelete(db, p->pLeft);
sqlite3ExprDelete(db, p->pRight);
@@ -1223,13 +1226,6 @@ int sqlite3ExprIsInteger(Expr *p, int *pValue){
}
default: break;
}
if( rc ){
assert( ExprHasAnyProperty(p, EP_Reduced|EP_TokenOnly)
|| (p->flags2 & EP2_MallocedToken)==0 );
p->op = TK_INTEGER;
p->flags |= EP_IntValue;
p->u.iValue = *pValue;
}
return rc;
}
@@ -1954,6 +1950,7 @@ static void codeInteger(Parse *pParse, Expr *pExpr, int negFlag, int iMem){
Vdbe *v = pParse->pVdbe;
if( pExpr->flags & EP_IntValue ){
int i = pExpr->u.iValue;
assert( i>=0 );
if( negFlag ) i = -i;
sqlite3VdbeAddOp2(v, OP_Integer, i, iMem);
}else{