Fix a crash that could occur if a sub-select inside an EXISTS expression features...

FossilOrigin-Name: 9768e7db624fbfe688d61ac06bffca14a169d439d8f65f5a14529af5660d3d2e

diff --git a/manifest b/manifest
index eb58efbcf72120dec267346681c2ea821ac0805c..a48bedc97f292e60bb1f1ad48e0e1013e6ea229a 100644 (file)
--- a/manifest
+++ b/manifest
@@ -1,5 +1,5 @@
-C Fix\sa\sbuffer\soverrun\sthat\scould\soccur\sin\sfts5\swhen\srunning\sa\sprefix\squery\sagainst\sa\scorrupt\sdb.
-D 2021-03-03T19:36:40.931
+C Fix\sa\scrash\sthat\scould\soccur\sif\sa\ssub-select\sinside\san\sEXISTS\sexpression\sfeatures\san\sORDER\sBY\sclause\scontaining\sone\sor\smore\swindow\sfunctions.
+D 2021-03-04T14:18:22.305
 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
 F LICENSE.md df5091916dbb40e6e9686186587125e1b2ff51f022cc334e886c19a0e9982724
@@ -542,7 +542,7 @@ F src/printf.c 2b03a80d7c11bb422115dca175a18bf430e9c9dbaa0eee63b758f0c022f8f34f
 F src/random.c 80f5d666f23feb3e6665a6ce04c7197212a88384
 F src/resolve.c 889469e6980181ce77ee8ab3fc84bd52ed6c1c3577fd102d52623d66cc65a3d0
 F src/rowset.c ba9515a922af32abe1f7d39406b9d35730ed65efab9443dc5702693b60854c92
-F src/select.c 0e242e141cc1b28f16b8973454aeeabd4367377f05507e3961044ae3035d80cd
+F src/select.c 1a7931e67fea84f5cb5432c14a334deac72c6a9b25f351607d56bef163707773
 F src/shell.c.in 844417f84df1f6c4fce1c815629a888cfdcf219e86513e9c332bbcc38832f477
 F src/sqlite.h.in 8855a19f37ade8dad189a9e48233a2ebe1b46faf469c7eb0906a654e252dcc57
 F src/sqlite3.rc 5121c9e10c3964d5755191c80dd1180c122fc3a8
@@ -1908,7 +1908,7 @@ F vsixtest/vsixtest.tcl 6a9a6ab600c25a91a7acc6293828957a386a8a93
 F vsixtest/vsixtest.vcxproj.data 2ed517e100c66dc455b492e1a33350c1b20fbcdc
 F vsixtest/vsixtest.vcxproj.filters 37e51ffedcdb064aad6ff33b6148725226cd608e
 F vsixtest/vsixtest_TemporaryKey.pfx e5b1b036facdb453873e7084e1cae9102ccc67a0
-P 3f520b8bdef7dcdad30e052ed8a07b0493bff4497603521e701fab7324df2995
-R bf9673d09bb6129e5121f0cfe63374d9
+P 4da40620ac8557aba6e1e06e720418b55e9950f406288b03749ef1b117041cd9
+R dbbe9c3309db800b2bcddd55fa5a9e76
 U dan
-Z 428ef74b7b93c2a0a1d5bc43a56052a4
+Z bd8c7ff2ba0ee91419f8449d3502d963

diff --git a/manifest.uuid b/manifest.uuid
index 26c15e4d61592f8bc6410dc8c22f2aa86cf0f74e..9c4f9114985bc88a40f2259679f42910ee271d64 100644 (file)
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-4da40620ac8557aba6e1e06e720418b55e9950f406288b03749ef1b117041cd9
\ No newline at end of file
+9768e7db624fbfe688d61ac06bffca14a169d439d8f65f5a14529af5660d3d2e
\ No newline at end of file

diff --git a/src/select.c b/src/select.c
index 53c83c9a33883f088f5577ecd7de3473c2da828d..10203156e2d2232d61d6610b12c7b46bee0331f4 100644 (file)
--- a/src/select.c
+++ b/src/select.c
@@ -85,12 +85,16 @@ static void clearSelect(sqlite3 *db, Select *p, int bFree){
     sqlite3ExprDelete(db, p->pHaving);
     sqlite3ExprListDelete(db, p->pOrderBy);
     sqlite3ExprDelete(db, p->pLimit);
+    if( OK_IF_ALWAYS_TRUE(p->pWith) ) sqlite3WithDelete(db, p->pWith);
 #ifndef SQLITE_OMIT_WINDOWFUNC
     if( OK_IF_ALWAYS_TRUE(p->pWinDefn) ){
       sqlite3WindowListDelete(db, p->pWinDefn);
     }
+    while( p->pWin ){
+      assert( p->pWin->ppThis==&p->pWin );
+      sqlite3WindowUnlinkFromSelect(p->pWin);
+    }
 #endif
-    if( OK_IF_ALWAYS_TRUE(p->pWith) ) sqlite3WithDelete(db, p->pWith);
     if( bFree ) sqlite3DbFreeNN(db, p);
     p = pPrior;
     bFree = 1;