Fix a NULL pointer dereference after a syntax error that can occur as a

result of check-in [6b2ff26c25bb9da3] yesterday.  This problem was
discovered by the OSSFuzz.

FossilOrigin-Name: d49afb8f9804e96662d1e3cadc4c6643908706d848a53d5ed019919c98f2ccba

diff --git a/manifest b/manifest
index f187cc02903241cf493d054218090e8a14061c7f..1c622c1102d05b8f3199f40537afb89503766f24 100644 (file)
--- a/manifest
+++ b/manifest
@@ -1,5 +1,5 @@
-C Simplification\sto\sthe\serror\shandling\slogic\sin\sthe\sextension\sloader.
-D 2017-12-23T14:39:36.160
+C Fix\sa\sNULL\spointer\sdereference\safter\sa\ssyntax\serror\sthat\scan\soccur\sas\sa\nresult\sof\scheck-in\s[6b2ff26c25bb9da3]\syesterday.\s\sThis\sproblem\swas\ndiscovered\sby\sthe\sOSSFuzz.
+D 2017-12-24T18:56:28.786
 F Makefile.in ceb40bfcb30ebba8e1202b34c56ff7e13e112f9809e2381d99be32c2726058f5
 F Makefile.linux-gcc 7bc79876b875010e8c8f9502eb935ca92aa3c434
 F Makefile.msc 6480671f7c129e61208d69492b3c71ce4310d49fceac83cfb17f1c081e242b69
@@ -423,7 +423,7 @@ F src/btmutex.c 0e9ce2d56159b89b9bc8e197e023ee11e39ff8ca
 F src/btree.c b83a6b03f160528020bb965f0c3a40af5286cd4923c3870fd218177f03a120a7
 F src/btree.h 32ef5d3f25dc70ef1ee9cecf84a023c21378f06a57cd701d2e866e141b150f09
 F src/btreeInt.h 55b702efce17e5d1941865464227d3802cfc9c7c832fac81d4c94dced47a71fc
-F src/build.c ed567f088edbc305dad33a6b14e08f8216a3860f6bad1d180450d5a5414bf346
+F src/build.c ab5bdf955c85bcd56acbf310a48bbd50b4b92079efa40d997a7e4246f8e03741
 F src/callback.c fe677cb5f5abb02f7a772a62a98c2f516426081df68856e8f2d5f950929b966a
 F src/complete.c a3634ab1e687055cd002e11b8f43eb75c17da23e
 F src/ctime.c ff1be3eed7bdd75aaca61ca8dc848f7c9f850ef2fb9cb56f2734e922a098f9c0
@@ -682,7 +682,7 @@ F test/collate9.test 3adcc799229545940df2f25308dd1ad65869145a
 F test/collateA.test b8218ab90d1fa5c59dcf156efabb1b2599c580d6
 F test/collateB.test 1e68906951b846570f29f20102ed91d29e634854ee47454d725f2151ecac0b95
 F test/colmeta.test 2c765ea61ee37bc43bbe6d6047f89004e6508eb1
-F test/colname.test a7ecb8f1d6d8b30a6cf8fa84a2cd6f6e91cad8296376fabe485cf93cd5eb6229
+F test/colname.test 36da785927822ecd0de979459e27e9be63f458dd08d3edde41af3af37a337d58
 F test/conflict.test 029faa2d81a0d1cafb5f88614beb663d972c01db
 F test/conflict2.test bb0b94cf7196c64a3cbd815c66d3ee98c2fecd9c
 F test/conflict3.test a83db76a6c3503b2fa057c7bfb08c318d8a422202d8bc5b86226e078e5b49ff9
@@ -1687,7 +1687,7 @@ F vsixtest/vsixtest.tcl 6a9a6ab600c25a91a7acc6293828957a386a8a93
 F vsixtest/vsixtest.vcxproj.data 2ed517e100c66dc455b492e1a33350c1b20fbcdc
 F vsixtest/vsixtest.vcxproj.filters 37e51ffedcdb064aad6ff33b6148725226cd608e
 F vsixtest/vsixtest_TemporaryKey.pfx e5b1b036facdb453873e7084e1cae9102ccc67a0
-P 05fee1a21ea398f1e4d6f1cf361657eff25ed6cd8f85ab398262dcfd30da57e9
-R 7fbfe3e61eca395fa5baf5f121a4d2ad
+P 07c773148d8db185fa54991df09298b64f4fef28879e6c9395759265e8183977
+R 2e4222d820aa06549d33319e9e33c627
 U drh
-Z d82d9c01768cefc5beb206b92e1398bf
+Z 67298e45eb2d4d992f0cdf5678deffdf

diff --git a/manifest.uuid b/manifest.uuid
index 8454418cd58e230e62abeb6701fe7cd63bee5ff7..d58d2c0dd53e6e1bb96ff681b5e100c36f0dcc5e 100644 (file)
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-07c773148d8db185fa54991df09298b64f4fef28879e6c9395759265e8183977
\ No newline at end of file
+d49afb8f9804e96662d1e3cadc4c6643908706d848a53d5ed019919c98f2ccba
\ No newline at end of file

diff --git a/src/build.c b/src/build.c
index 01d8972415b466512c8d355919b89f00d5b4b7ca..390dae5d3bb35f9acda331c9a802d9caf22fef09 100644 (file)
--- a/src/build.c
+++ b/src/build.c
@@ -1965,6 +1965,7 @@ void sqlite3EndTable(
       pParse->nTab = 2;
       addrTop = sqlite3VdbeCurrentAddr(v) + 1;
       sqlite3VdbeAddOp3(v, OP_InitCoroutine, regYield, 0, addrTop);
+      if( pParse->nErr ) return;
       pSelTab = sqlite3ResultSetOfSelect(pParse, pSelect);
       if( pSelTab==0 ) return;
       assert( p->aCol==0 );

diff --git a/test/colname.test b/test/colname.test
index 5a4028677333e69c49146e112c4b3cda4a23a204..cacf91e4e356c80ce8da9476ea46775d2220fee1 100644 (file)
--- a/test/colname.test
+++ b/test/colname.test
@@ -398,6 +398,16 @@ do_execsql_test colname-9.320 {
   SELECT name FROM pragma_table_info('t2');
 } {Bbb}
 
+# Issue detected by clusterfuzz on 2017-12-24 (Christmas Eve)
+# caused by check-in https://sqlite.org/src/info/6b2ff26c25
+#
+# Prior to being fixed, the following CREATE TABLE was dereferencing
+# a NULL pointer and segfaulting.
+#
+do_catchsql_test colname-9.400 {
+  CREATE TABLE t4 AS SELECT #0;
+} {1 {near "#0": syntax error}}
+
 
 # Make sure the quotation marks get removed from the column names
 # when constructing a new table from an aggregate SELECT.