From f68d7d17a18496d8cf33a4997b4a5cc4d05681c7 Mon Sep 17 00:00:00 2001
From: drh <drh@noemail.net>
Date: Thu, 3 May 2007 13:02:26 +0000
Subject: [PATCH] Use memmove() instead of memcpy() when moving between memory
 regions that might overlap.  Ticket #2334. (CVS 3905)

FossilOrigin-Name: 678d672b73cc7b7f563c15daee3831cb5bbd890e
---
 manifest      | 14 +++++++-------
 manifest.uuid |  2 +-
 src/select.c  | 22 ++++++++++++++++++----
 3 files changed, 26 insertions(+), 12 deletions(-)

diff --git a/manifest b/manifest
index d8bd65f69b..e53f064f7b 100644
--- a/manifest
+++ b/manifest
@@ -1,5 +1,5 @@
-C Minor\sbugfixes\sfor\sincrblob\smode.\s(CVS\s3904)
-D 2007-05-03T11:43:35
+C Use\smemmove()\sinstead\sof\smemcpy()\swhen\smoving\sbetween\smemory\sregions\sthat\nmight\soverlap.\s\sTicket\s#2334.\s(CVS\s3905)
+D 2007-05-03T13:02:27
 F Makefile.in 8cab54f7c9f5af8f22fd97ddf1ecfd1e1860de62
 F Makefile.linux-gcc 2d8574d1ba75f129aba2019f0b959db380a90935
 F README 9c4e2d6706bdcc3efdd773ce752a8cdab4f90028
@@ -94,7 +94,7 @@ F src/pragma.c 4fdefc03c3fd0ee87f8aad82bf80ba9bf1cdf416
 F src/prepare.c 03277063bc4f5860efbf23548fa0123ac0f6eaec
 F src/printf.c 0c6f40648770831341ac45ab32423a80b4c87f05
 F src/random.c 6119474a6f6917f708c1dee25b9a8e519a620e88
-F src/select.c b914abca0ba28893e7fb7c7fb97a05e240e2ce8b
+F src/select.c 3c8f3bc7fd823abb8af30ec89ba6bcc515923fa1
 F src/server.c 087b92a39d883e3fa113cae259d64e4c7438bc96
 F src/shell.c 3ae4654560e91220a95738a73d135d91d937cda1
 F src/sqlite.h.in 1e053c58fd4df28c38ffdca2443b16d5f76f6f1e
@@ -472,7 +472,7 @@ F www/tclsqlite.tcl bb0d1357328a42b1993d78573e587c6dcbc964b9
 F www/vdbe.tcl 87a31ace769f20d3627a64fa1fade7fed47b90d0
 F www/version3.tcl 890248cf7b70e60c383b0e84d77d5132b3ead42b
 F www/whentouse.tcl fc46eae081251c3c181bd79c5faef8195d7991a5
-P db54a9466e3bea9c03740ce0b755cfa02bafaccd
-R b6ef9d6353faa34f0c7bbdd7931d71b1
-U danielk1977
-Z bf7e40e57d9391f8c0bf488430df6340
+P b84d597c902d60341607bc405440603868ac52c8
+R 12d14d4fb14068f61aa4421e14587d06
+U drh
+Z db885090be703cd83c0833d00fbb5cc8
diff --git a/manifest.uuid b/manifest.uuid
index 9f3b944479..0332c9d223 100644
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-b84d597c902d60341607bc405440603868ac52c8
\ No newline at end of file
+678d672b73cc7b7f563c15daee3831cb5bbd890e
\ No newline at end of file
diff --git a/src/select.c b/src/select.c
index 62ba725654..ed524c2e73 100644
--- a/src/select.c
+++ b/src/select.c
@@ -12,7 +12,7 @@
 ** This file contains C code routines that are called by the parser
 ** to handle SELECT statements in SQLite.
 **
-** $Id: select.c,v 1.338 2007/04/16 17:07:55 drh Exp $
+** $Id: select.c,v 1.339 2007/05/03 13:02:27 drh Exp $
 */
 #include "sqliteInt.h"
 
@@ -1909,8 +1909,8 @@ static int multiSelect(
     KeyInfo *pKeyInfo;            /* Collating sequence for the result set */
     Select *pLoop;                /* For looping through SELECT statements */
     int nKeyCol;                  /* Number of entries in pKeyInfo->aCol[] */
-    CollSeq **apColl;
-    CollSeq **aCopy;
+    CollSeq **apColl;             /* For looping through pKeyInfo->aColl[] */
+    CollSeq **aCopy;              /* A copy of pKeyInfo->aColl[] */
 
     assert( p->pRightmost==p );
     nKeyCol = nCol + (pOrderBy ? pOrderBy->nExpr : 0);
@@ -1951,9 +1951,23 @@ static int multiSelect(
       int addr;
       u8 *pSortOrder;
 
+      /* Reuse the same pKeyInfo for the ORDER BY as was used above for
+      ** the compound select statements.  Except we have to change out the
+      ** pKeyInfo->aColl[] values.  Some of the aColl[] values will be
+      ** reused when constructing the pKeyInfo for the ORDER BY, so make
+      ** a copy.  Sufficient space to hold both the nCol entries for
+      ** the compound select and the nOrderbyExpr entries for the ORDER BY
+      ** was allocated above.  But we need to move the compound select
+      ** entries out of the way before constructing the ORDER BY entries.
+      ** Move the compound select entries into aCopy[] where they can be
+      ** accessed and reused when constructing the ORDER BY entries.
+      ** Because nCol might be greater than or less than nOrderByExpr
+      ** we have to use memmove() when doing the copy.
+      */
       aCopy = &pKeyInfo->aColl[nOrderByExpr];
       pSortOrder = pKeyInfo->aSortOrder = (u8*)&aCopy[nCol];
-      memcpy(aCopy, pKeyInfo->aColl, nCol*sizeof(CollSeq*));
+      memmove(aCopy, pKeyInfo->aColl, nCol*sizeof(CollSeq*));
+
       apColl = pKeyInfo->aColl;
       for(i=0; i<nOrderByExpr; i++, pOTerm++, apColl++, pSortOrder++){
         Expr *pExpr = pOTerm->pExpr;