Avoid two more instances of pointer arithmetic on freed pointers.

FossilOrigin-Name: 2910ef64097b890c9f8929bf609ea2827db7ac97

diff --git a/manifest b/manifest
index 771dba7fa82bb4b26e88bd0976157d96a8a74676..04ba39cdd89bc0f6f490c3d1351b26623963b89e 100644 (file)
--- a/manifest
+++ b/manifest
@@ -1,5 +1,5 @@
-C Modify\sthe\sorder\sof\sterms\sin\san\s"if"\scondition\sto\savoid\simplicitly\scomparing\sa\sdangling\spointer\sto\sNULL\sfollowing\san\sOOM\serror.
-D 2016-01-28T18:22:46.091
+C Avoid\stwo\smore\sinstances\sof\spointer\sarithmetic\son\sfreed\spointers.
+D 2016-01-29T08:38:35.193
 F Makefile.in 027c1603f255390c43a426671055a31c0a65fdb4
 F Makefile.linux-gcc 7bc79876b875010e8c8f9502eb935ca92aa3c434
 F Makefile.msc 72b7858f02017611c3ac1ddc965251017fed0845
@@ -342,7 +342,7 @@ F src/pcache.h 4d0ccaad264d360981ec5e6a2b596d6e85242545
 F src/pcache1.c 72f644dc9e1468c72922eff5904048427b817051
 F src/pragma.c ea290193369faa0a26ae2f924e7b86289b4a7987
 F src/pragma.h 64c78a648751b9f4f297276c4eb7507b14b4628c
-F src/prepare.c 8ca7237428f372a04717d558555ea67ee1c5df93
+F src/prepare.c db85f0451ba93ecb3c1e497c279abece5cb5aead
 F src/printf.c af589a27b7d40f6f4f704e9eea99f02f18ad6d32
 F src/random.c ba2679f80ec82c4190062d756f22d0c358180696
 F src/resolve.c 9f7ce3a3c087afb7597b7c916c99126ff3f12f0c
@@ -419,7 +419,7 @@ F src/vdbeapi.c ffae8f5af4570fbd548504e815e9fb7227f0822e
 F src/vdbeaux.c fc8926c4232cd5c982f36197b1443212f265d927
 F src/vdbeblob.c 37c3d11a753e403698c69e17383d282e1ae73e75
 F src/vdbemem.c b9181e77eca2a095929d46250daf85c8d2621fc0
-F src/vdbesort.c 3bb1f1f03162e6d223da623714d8e93fcaeac658
+F src/vdbesort.c ef3c6d1f1a7d44cf67bb2bee59ea3d1fe5bad174
 F src/vdbetrace.c 8befe829faff6d9e6f6e4dee5a7d3f85cc85f1a0
 F src/vtab.c 320682cca733115b4cbe71320b5c5eeb1074ebde
 F src/vxworks.h d2988f4e5a61a4dfe82c6524dd3d6e4f2ce3cdb9
@@ -1422,7 +1422,7 @@ F tool/vdbe_profile.tcl 246d0da094856d72d2c12efec03250d71639d19f
 F tool/warnings-clang.sh f6aa929dc20ef1f856af04a730772f59283631d4
 F tool/warnings.sh 48bd54594752d5be3337f12c72f28d2080cb630b
 F tool/win/sqlite.vsix deb315d026cc8400325c5863eef847784a219a2f
-P 688eb3b400a3f2f8005c341e8259f4c1485cb0ed
-R e0b38fbf138d8fe5067019d9b4797980
+P 5372f800835da61736a64dcee8b476bbe7ee2e46
+R 3b0a4b2b0654f088a973292429d2f71d
 U dan
-Z 338551eead62c92e7c871564cd38e428
+Z daf578eb367bf673fc68218c1dc6fe42

diff --git a/manifest.uuid b/manifest.uuid
index 9de4b4f3bfeaf0c7216c24055fcc31fdee9c457a..32fa4e26075076143f0549552950a6e17e636321 100644 (file)
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-5372f800835da61736a64dcee8b476bbe7ee2e46
\ No newline at end of file
+2910ef64097b890c9f8929bf609ea2827db7ac97
\ No newline at end of file

diff --git a/src/prepare.c b/src/prepare.c
index acd50fcaf705ef136a45ed90215ff1495a01dab2..f8ad54665ab0345188cc83fa2926d1be98a7c3ef 100644 (file)
--- a/src/prepare.c
+++ b/src/prepare.c
@@ -582,8 +582,8 @@ static int sqlite3Prepare(
     zSqlCopy = sqlite3DbStrNDup(db, zSql, nBytes);
     if( zSqlCopy ){
       sqlite3RunParser(pParse, zSqlCopy, &zErrMsg);
-      sqlite3DbFree(db, zSqlCopy);
       pParse->zTail = &zSql[pParse->zTail-zSqlCopy];
+      sqlite3DbFree(db, zSqlCopy);
     }else{
       pParse->zTail = &zSql[nBytes];
     }

diff --git a/src/vdbesort.c b/src/vdbesort.c
index 22029aa6bfbfd5357e62f687997b56f04ba38c6e..380772ee16b60b910c56f8a2b9181b58e60b8188 100644 (file)
--- a/src/vdbesort.c
+++ b/src/vdbesort.c
@@ -1821,6 +1821,7 @@ int sqlite3VdbeSorterWrite(
 
     if( nMin>pSorter->nMemory ){
       u8 *aNew;
+      int iListOff = (u8*)pSorter->list.pList - pSorter->list.aMemory;
       int nNew = pSorter->nMemory * 2;
       while( nNew < nMin ) nNew = nNew*2;
       if( nNew > pSorter->mxPmaSize ) nNew = pSorter->mxPmaSize;
@@ -1828,9 +1829,7 @@ int sqlite3VdbeSorterWrite(
 
       aNew = sqlite3Realloc(pSorter->list.aMemory, nNew);
       if( !aNew ) return SQLITE_NOMEM;
-      pSorter->list.pList = (SorterRecord*)(
-          aNew + ((u8*)pSorter->list.pList - pSorter->list.aMemory)
-      );
+      pSorter->list.pList = (SorterRecord*)&aNew[iListOff];
       pSorter->list.aMemory = aNew;
       pSorter->nMemory = nNew;
     }