Fix a bug in the SQLITE_ENABLE_SORTER_REFERENCES code causing an out-of-bounds

array reference.

FossilOrigin-Name: 8cadaf587dc96370f9c8a1dccc366b93021e8cfe4526da9368a088828fd14faf

diff --git a/manifest b/manifest
index 965fc6a2a9823463597c00b92c1d55e9faacc379..8ec9e6c9d9066aad7600b08a94a46e35aa1f6b31 100644 (file)
--- a/manifest
+++ b/manifest
@@ -1,5 +1,5 @@
-C More\sdocumentation\stypo\sfixes.\s\sNo\scode\schanges.
-D 2018-05-31T19:14:52.660
+C Fix\sa\sbug\sin\sthe\sSQLITE_ENABLE_SORTER_REFERENCES\scode\scausing\san\sout-of-bounds\narray\sreference.
+D 2018-06-01T13:30:45.839
 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
 F Makefile.in bfc40f350586923e0419d2ea4b559c37ec10ee4b6e210e08c14401f8e340f0da
@@ -495,7 +495,7 @@ F src/printf.c 7f6f3cba8e0c49c19e30a1ff4e9aeda6e06814dcbad4b664a69e1b6cb6e7e365
 F src/random.c 80f5d666f23feb3e6665a6ce04c7197212a88384
 F src/resolve.c 6415381a0e9d22c0e7cba33ca4a53f81474190862f5d4838190f5eb5b0b47bc9
 F src/rowset.c 7b7e7e479212e65b723bf40128c7b36dc5afdfac
-F src/select.c a35d462ee7a3c0856ad7a9d9c8921fbf3d91d911a8f39ad9d61302eb43b24a71
+F src/select.c 3291892add3a8f01dc3754e40ef9e30ad22c78e3404a388ae58f0390a1fb29eb
 F src/shell.c.in c29cb307d6275131e6f9874e0fa73f87acf40a22c4a82faba2059a93b4d294d1
 F src/sqlite.h.in 63b07f76731f2b1e55c48fdb9f0508dcc6fbe3971010b8612ffd847c3c56d9a1
 F src/sqlite3.rc 5121c9e10c3964d5755191c80dd1180c122fc3a8
@@ -1730,7 +1730,7 @@ F vsixtest/vsixtest.tcl 6a9a6ab600c25a91a7acc6293828957a386a8a93
 F vsixtest/vsixtest.vcxproj.data 2ed517e100c66dc455b492e1a33350c1b20fbcdc
 F vsixtest/vsixtest.vcxproj.filters 37e51ffedcdb064aad6ff33b6148725226cd608e
 F vsixtest/vsixtest_TemporaryKey.pfx e5b1b036facdb453873e7084e1cae9102ccc67a0
-P 5a2a88cb01ef4b299f9a5b2963f392a3bae90e8a7f84b190e67f86090f891e23
-R 83eb95c42c4211ddc8c96b6c475fc4c0
-U drh
-Z b5d002785807c4d01d6de681c100939a
+P 66c24513c2f6de98bd888c3e4c07bbb39fabf30ea9dd01eb255460054055347d
+R de534748a7bde116d78575c0d00249be
+U dan
+Z 98720dc1e5a3205614c222172ada64da

diff --git a/manifest.uuid b/manifest.uuid
index c167de4c2d88267c96586d63b82d2783fb3bd459..e30e5be6dacc2865fda7b74acd2b2e2662cf68a7 100644 (file)
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-66c24513c2f6de98bd888c3e4c07bbb39fabf30ea9dd01eb255460054055347d
\ No newline at end of file
+8cadaf587dc96370f9c8a1dccc366b93021e8cfe4526da9368a088828fd14faf
\ No newline at end of file

diff --git a/src/select.c b/src/select.c
index 3818ef51703c10f5337f6dfe08070157dcda83ac..529df0f949994184cc2e8198dde49e3bc7931c4f 100644 (file)
--- a/src/select.c
+++ b/src/select.c
@@ -817,7 +817,7 @@ static void selectExprDefer(
     if( pItem->u.x.iOrderByCol==0 ){
       Expr *pExpr = pItem->pExpr;
       Table *pTab = pExpr->pTab;
-      if( pExpr->op==TK_COLUMN && pTab && !IsVirtual(pTab)
+      if( pExpr->op==TK_COLUMN && pExpr->iColumn>=0 && pTab && !IsVirtual(pTab)
        && (pTab->aCol[pExpr->iColumn].colFlags & COLFLAG_SORTERREF)
       ){
         int j;