Fix a potential use-after-free error during parsing of malformed

CREATE TABLE statement.

FossilOrigin-Name: c5dbc599b910c02a961675b12b273b8df6d29450

diff --git a/manifest b/manifest
index eeb7bbca0b858340c5bceb7aed7e9499200534c2..6bee34d1abed66fd0e378969fa11096a7dca6034 100644 (file)
--- a/manifest
+++ b/manifest
@@ -1,5 +1,5 @@
-C Enhance\sfuzzcheck.c\sto\saccept\sdatabase-specific\sconfiguration\sparameters\sin\nthe\soption\sCONFIG\stable.\s\sAdd\sthe\sfuzzdata5.db\sfuzz\sdatabase\scontaining\ntest\scases\sfrom\sOSS-FUZZ.
-D 2016-11-14T18:27:41.319
+C Fix\sa\spotential\suse-after-free\serror\sduring\sparsing\sof\smalformed\nCREATE\sTABLE\sstatement.
+D 2016-11-14T20:08:00.627
 F Makefile.in 6b572807415d3f0a379cebc9461416d8df4a12c8
 F Makefile.linux-gcc 7bc79876b875010e8c8f9502eb935ca92aa3c434
 F Makefile.msc bb4d970894abbbe0e88d00aac29bd52af8bc95f4
@@ -392,7 +392,7 @@ F src/shell.c f04e4af75c5517735397d060ed0b4a874104bb41
 F src/sqlite.h.in 803f7050f69b2eea573fac219f3c92582c096027
 F src/sqlite3.rc 5121c9e10c3964d5755191c80dd1180c122fc3a8
 F src/sqlite3ext.h 8648034aa702469afb553231677306cc6492a1ae
-F src/sqliteInt.h 603953faca895386d4f3a8b7046f3e4e6c071c53
+F src/sqliteInt.h c471d791b10c0f2164c8b7a87adc338e703c09cc
 F src/sqliteLimit.h c0373387c287c8d0932510b5547ecde31b5da247
 F src/status.c a9e66593dfb28a9e746cba7153f84d49c1ddc4b1
 F src/table.c 5226df15ab9179b9ed558d89575ea0ce37b03fc9
@@ -819,7 +819,7 @@ F test/fuzzdata1.db 7ee3227bad0e7ccdeb08a9e6822916777073c664
 F test/fuzzdata2.db f03a420d3b822cc82e4f894ca957618fbe9c4973
 F test/fuzzdata3.db c6586d3e3cef0fbc18108f9bb649aa77bfc38aba
 F test/fuzzdata4.db 1882f0055fb63214d8407ddc7aca9b0b1c59af21
-F test/fuzzdata5.db b39d6f1b2e6b37789d95e73a291febd5cb5ff779
+F test/fuzzdata5.db 42d0545086da9f30f8ff83962dc28e273a8d50c2
 F test/fuzzer1.test 3d4c4b7e547aba5e5511a2991e3e3d07166cfbb8
 F test/fuzzer2.test a85ef814ce071293bce1ad8dffa217cbbaad4c14
 F test/fuzzerfault.test 8792cd77fd5bce765b05d0c8e01b9edcf8af8536
@@ -1534,7 +1534,7 @@ F vsixtest/vsixtest.tcl 6a9a6ab600c25a91a7acc6293828957a386a8a93
 F vsixtest/vsixtest.vcxproj.data 2ed517e100c66dc455b492e1a33350c1b20fbcdc
 F vsixtest/vsixtest.vcxproj.filters 37e51ffedcdb064aad6ff33b6148725226cd608e
 F vsixtest/vsixtest_TemporaryKey.pfx e5b1b036facdb453873e7084e1cae9102ccc67a0
-P 6f2d43eca68175ed28abae3afa792095af906af2
-R d3c47178caac86bf7a157d9adc36d0a2
+P a71fad4538311ede111815d221d9eb8d9018092b
+R 2fe5b30a451a8ce17b7c2166fae94aef
 U drh
-Z 2f0e4ab34b209b49e42001823006ce97
+Z e6fc9b27598a768c0afd9ae99ec00c26

diff --git a/manifest.uuid b/manifest.uuid
index a64fde53b01db5cb9b6e8e46599ce9f973970b30..dce4b3a195c88cabe2f81c21f3a02f5554e808e5 100644 (file)
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-a71fad4538311ede111815d221d9eb8d9018092b
\ No newline at end of file
+c5dbc599b910c02a961675b12b273b8df6d29450
\ No newline at end of file

diff --git a/src/sqliteInt.h b/src/sqliteInt.h
index 88662958dded5ccac0646ab3124d16ad785fa8c3..5e256942ff9bec0ab4cbc7bd09bc1e39449f0193 100644 (file)
--- a/src/sqliteInt.h
+++ b/src/sqliteInt.h
@@ -2947,15 +2947,15 @@ struct Parse {
   } aColCache[SQLITE_N_COLCACHE];  /* One for each column cache entry */
   int aTempReg[8];        /* Holding area for temporary registers */
   Token sNameToken;       /* Token with unqualified schema object name */
-  Token sLastToken;       /* The last token parsed */
 
   /************************************************************************
   ** Above is constant between recursions.  Below is reset before and after
   ** each recursion.  The boundary between these two regions is determined
-  ** using offsetof(Parse,nVar) so the nVar field must be the first field
-  ** in the recursive region.
+  ** using offsetof(Parse,sLastToken) so the sLastToken field must be the
+  ** first field in the recursive region.
   ************************************************************************/
 
+  Token sLastToken;       /* The last token parsed */
   ynVar nVar;               /* Number of '?' variables seen in the SQL so far */
   int nzVar;                /* Number of available slots in azVar[] */
   u8 iPkSortOrder;          /* ASC or DESC for INTEGER PRIMARY KEY */
@@ -2989,7 +2989,7 @@ struct Parse {
 ** Sizes and pointers of various parts of the Parse object.
 */
 #define PARSE_HDR_SZ offsetof(Parse,aColCache) /* Recursive part w/o aColCache*/
-#define PARSE_RECURSE_SZ offsetof(Parse,nVar)  /* Recursive part */
+#define PARSE_RECURSE_SZ offsetof(Parse,sLastToken)    /* Recursive part */
 #define PARSE_TAIL_SZ (sizeof(Parse)-PARSE_RECURSE_SZ) /* Non-recursive part */
 #define PARSE_TAIL(X) (((char*)(X))+PARSE_RECURSE_SZ)  /* Pointer to tail */
 

diff --git a/test/fuzzdata5.db b/test/fuzzdata5.db
index b5c45f11697c6e1935965dbbfb5d59d0bb1c1dd4..fdd4ec3e98d14bd820040777fd0343fb9f2c205d 100644 (file)
Binary files a/test/fuzzdata5.db and b/test/fuzzdata5.db differ