From d54522a5b832422ab893a1e9fa7a99ab314ea4e2 Mon Sep 17 00:00:00 2001
From: drh <>
Date: Sun, 4 Oct 2026 21:54:17 +0000
Subject: [PATCH] Fix expression tree depth calculations for COLLATE.
 [bugs:/info/2026-10-04T04:50:56Z|Bug 2026-10-04T04:50:56Z]

FossilOrigin-Name: 252c0b7bf5a727d29605672bb58e06c758173c276671df3e388a68294998b4d3
---
 manifest             | 19 +++++++++----------
 manifest.uuid        |  2 +-
 src/expr.c           | 12 +++++++++---
 src/sqliteInt.h      |  4 ++--
 test/sqllimits1.test |  9 ++++++++-
 5 files changed, 29 insertions(+), 17 deletions(-)

diff --git a/manifest b/manifest
index f24029ec2e..586bfc4cab 100644
--- a/manifest
+++ b/manifest
@@ -1,5 +1,5 @@
-C Improve\ssupport\sfor\s--with-tcl\sin\scross-compilation\senvironments,\sas\sdiscussed\sin\s[forum:fe9e99eb27c8c2ba|forum\sthread\s2026-08-15T18:21:17Z].
-D 2026-10-04T19:51:51.315
+C Fix\sexpression\stree\sdepth\scalculations\sfor\sCOLLATE.\n[bugs:/info/2026-10-04T04:50:56Z|Bug\s2026-10-04T04:50:56Z]
+D 2026-10-04T21:54:17.561
 F .fossil-settings/binary-glob 61195414528fb3ea9693577e1980230d78a1f8b0a54c78cf1b9b24d0a409ed6a x
 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
@@ -751,7 +751,7 @@ F src/date.c 080641f59097d14fc7341f8bc0458d273b3a62d8381916db8ccbc89c2aae07b3
 F src/dbpage.c ec8590c5e7a564cef28ca3c6156521316a4d26cb572a34841b0bcb26b67b3f97
 F src/dbstat.c 34d4e825fbf763640ce3dbc56910ab080495ef4a6efb48b2b1852a43d43763fc
 F src/delete.c 59eeca3fb88c29329afc41bb803ee568b120d9dd7470b5f38ab55cc38390b451
-F src/expr.c e312efc69da66f6f0fe91f6cecc5024aa9d0797d232ba4d5032558ed4458f841
+F src/expr.c b90fd483db217989ca862d583e5afe2a0078720fd5bd0279b115f862c463dc05
 F src/fault.c 460f3e55994363812d9d60844b2a6de88826e007
 F src/fkey.c 26788ae6c785d70f9829c4176e9764447014fc73e6ba31e9f1881720a64ae7f1
 F src/func.c 54d96eeafcb6ec4cff92028ea0f7bb09e27b375b248d969aeb80a61e560ef302
@@ -805,7 +805,7 @@ F src/shell.c.in 8504577eb02e87b58f9d632bc4458efda074476428774692207ddacc0fe9e1d
 F src/sqlite.h.in 884996e07cfb7681efc76661b79d56a93f9edaea7f6fc4a3c82636dc84783486
 F src/sqlite3.rc 015537e6ac1eec6c7050e17b616c2ffe6f70fca241835a84a4f0d5937383c479
 F src/sqlite3ext.h 5e113c4c0442f2f1b3345d44cbe4b82fad45f2fc0c35f0ed4eef27fb8f1cb394
-F src/sqliteInt.h 37d9f55cdadcb0e93558a29c3031a9d85fc6fb38fccf55348a230d719089e1b5
+F src/sqliteInt.h d91420b02f66913743f70118aa29f3f2264b52998c0690dcb8862638cfbde3a2
 F src/sqliteLimit.h c433b3fdb5e52f4226bf78d7e8081dff8fd8fbb0ce0cb1a5fee282aaa8976813
 F src/status.c 7565d63a79aa2f326339a24a0461a60096d0bd2bce711fefb50b5c89335f3592
 F src/table.c 0f141b58a16de7e2fbe81c308379e7279f4c6b50eb08efeec5892794a0ba30d1
@@ -1750,7 +1750,7 @@ F test/spellfix2.test dfc8f519a3fc204cb2dfa8b4f29821ae90f6f8c3
 F test/spellfix3.test 0f9efaaa502a0e0a09848028518a6fb096c8ad33
 F test/spellfix4.test 7c56a09de68b95051ef0627fe235e514efbba2aa816dc2a9c5c670d98877e632
 F test/sqldiff1.test 1b7ab4f312442c5cc6b3a5f299fa8ca051416d1dd173cb1126fd51bf64f2c3fb
-F test/sqllimits1.test c4545743e6e374d1c2b61f8c23546cbd7cce994c729b53e426a05f7688ac2e51
+F test/sqllimits1.test 95dcc54332b5fdb00036876d1d98e91d22f4ea0f3b6c076ee8106bd157390977
 F test/sqllog.test 6af6cb0b09f4e44e1917e06ce85be7670302517a
 F test/starschema1.test f5388cd32527ab18d3f98f9e3402ec780f6a186e04e0d9c8531d7568ee734e11
 F test/startup.c 1beb5ca66fcc0fce95c3444db9d1674f90fc605499a574ae2434dcfc10d22805
@@ -2278,9 +2278,8 @@ F tool/warnings-clang.sh bbf6a1e685e534c92ec2bfba5b1745f34fb6f0bc2a362850723a9ee
 F tool/warnings.sh a554d13f6e5cf3760f041b87939e3d616ec6961859c3245e8ef701d1eafc2ca2
 F tool/win/sqlite.vsix deb315d026cc8400325c5863eef847784a219a2f
 F tool/winmain.c 00c8fb88e365c9017db14c73d3c78af62194d9644feaf60e220ab0f411f3604c
-P f63139ba68bc7df770bbd3c26bcd760c479889fb45fa921e9e225e38c9e2044c 41f095e34974da53170200719a069c0a30110e27a1db85f562bbe744a40e9a80
-R 771ec5fa0646617381291d7cfe227f57
-T +closed 41f095e34974da53170200719a069c0a30110e27a1db85f562bbe744a40e9a80 Closed\sby\sintegrate-merge.
-U stephan
-Z 644ec730ae144cd98eb5e04d50c3db8f
+P d4330c79a477bab7e86aba860813f4f83e9af5ef8067698fcdf41efd6a0e8516
+R 960558da009947c307ca304fdbbe4e0f
+U drh
+Z 6378420ac511b5740e99c19b2a3da65d
 # Remove this line to create a well-formed Fossil manifest.
diff --git a/manifest.uuid b/manifest.uuid
index d3a13f06ae..e3648f7934 100644
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-d4330c79a477bab7e86aba860813f4f83e9af5ef8067698fcdf41efd6a0e8516
+252c0b7bf5a727d29605672bb58e06c758173c276671df3e388a68294998b4d3
diff --git a/src/expr.c b/src/expr.c
index 9fc89cb42a..56be686398 100644
--- a/src/expr.c
+++ b/src/expr.c
@@ -173,23 +173,29 @@ int sqlite3ExprDataType(const Expr *pExpr){
 ** and the pExpr parameter is returned unchanged.
 */
 Expr *sqlite3ExprAddCollateToken(
-  const Parse *pParse,     /* Parsing context */
+  Parse *pParse,           /* Parsing context */
   Expr *pExpr,             /* Add the "COLLATE" clause to this expression */
   const Token *pCollName,  /* Name of collating sequence */
   int dequote              /* True to dequote pCollName */
 ){
-  if( pCollName->n>0 ){
+  if( pCollName->n>0 && pParse->nErr==0 ){
     Expr *pNew = sqlite3ExprAlloc(pParse->db, TK_COLLATE, pCollName, dequote);
+    assert( pExpr!=0 );
     if( pNew ){
       pNew->pLeft = pExpr;
       pNew->flags |= EP_Collate|EP_Skip;
+#if SQLITE_MAX_EXPR_DEPTH>0
+      pNew->nHeight = pExpr->nHeight+1;
+      sqlite3ExprCheckHeight(pParse, pNew->nHeight);
+      testcase( pParse->nErr>0 );
+#endif
       pExpr = pNew;
     }
   }
   return pExpr;
 }
 Expr *sqlite3ExprAddCollateString(
-  const Parse *pParse,  /* Parsing context */
+  Parse *pParse,        /* Parsing context */
   Expr *pExpr,          /* Add the "COLLATE" clause to this expression */
   const char *zC        /* The collating sequence name */
 ){
diff --git a/src/sqliteInt.h b/src/sqliteInt.h
index 0abd844f0d..f0c169c8d8 100644
--- a/src/sqliteInt.h
+++ b/src/sqliteInt.h
@@ -5508,8 +5508,8 @@ void sqlite3SetTextEncoding(sqlite3 *db, u8);
 CollSeq *sqlite3ExprCollSeq(Parse *pParse, const Expr *pExpr);
 CollSeq *sqlite3ExprNNCollSeq(Parse *pParse, const Expr *pExpr);
 int sqlite3ExprCollSeqMatch(Parse*,const Expr*,const Expr*);
-Expr *sqlite3ExprAddCollateToken(const Parse *pParse, Expr*, const Token*, int);
-Expr *sqlite3ExprAddCollateString(const Parse*,Expr*,const char*);
+Expr *sqlite3ExprAddCollateToken(Parse *pParse, Expr*, const Token*, int);
+Expr *sqlite3ExprAddCollateString(Parse*,Expr*,const char*);
 Expr *sqlite3ExprSkipCollate(Expr*);
 Expr *sqlite3ExprSkipCollateAndLikely(Expr*);
 int sqlite3CheckCollSeq(Parse *, CollSeq *);
diff --git a/test/sqllimits1.test b/test/sqllimits1.test
index f4fc582cfd..d57dae7850 100644
--- a/test/sqllimits1.test
+++ b/test/sqllimits1.test
@@ -733,7 +733,14 @@ if {$SQLITE_MAX_EXPR_DEPTH==0} {
       SELECT $expr
     }]
   } "1 {Expression tree is too large (maximum depth $::SQLITE_MAX_EXPR_DEPTH)}"
-  
+  do_test sqllimits1-9.1b {
+    set max $::SQLITE_MAX_EXPR_DEPTH
+    set expr "('abc'='ABC' [string repeat { COLLATE nocase} $max])"
+    catchsql [subst {
+      SELECT $expr
+    }]
+  } "1 {Expression tree is too large (maximum depth $::SQLITE_MAX_EXPR_DEPTH)}"
+
 if 0 {  
   # Attempting to beat the expression depth limit using nested SELECT
   # queries causes a parser stack overflow.