Fix a segfault that could occur if the ORDER BY clause of a compound SELECT contains...

FossilOrigin-Name: 5ba15ebb34c3af85ef6c54bbb3acb57176d629cda83774881b2a6467e138e904

diff --git a/manifest b/manifest
index 97cb985b6e9e8a3ab47b9295fcfb590e7fa4530e..3515f86b6c5ff1f5ab2ec54b1ba8f9a0b0bc0e94 100644 (file)
--- a/manifest
+++ b/manifest
@@ -1,5 +1,5 @@
-C Fix\sthe\sdisplay\sof\sSrcList\sin\sthe\ssqlite3TreeView\sdebugging\sroutines.
-D 2021-04-12T12:58:55.116
+C Fix\sa\ssegfault\sthat\scould\soccur\sif\sthe\sORDER\sBY\sclause\sof\sa\scompound\sSELECT\scontains\sa\ssub-select\sthat\suses\sone\sor\smore\swindow\sfunctions.
+D 2021-04-12T16:59:28.732
 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
 F LICENSE.md df5091916dbb40e6e9686186587125e1b2ff51f022cc334e886c19a0e9982724
@@ -540,14 +540,14 @@ F src/pragma.h 8dc78ab7e9ec6ce3ded8332810a2066f1ef6267e2e03cd7356ee00276125c6cf
 F src/prepare.c 7a0fc6866748541af55e59f950f3461aa419f137d6e6a16c6246c115b9198287
 F src/printf.c 78fabb49b9ac9a12dd1c89d744abdc9b67fd3205e62967e158f78b965a29ec4b
 F src/random.c 80f5d666f23feb3e6665a6ce04c7197212a88384
-F src/resolve.c d4b0dd7994ba79a1e7fba75900a7dbfd5ad35744709fb4af271a18264ed90039
+F src/resolve.c 90503542110852f365137b27be799f6e5b407c59eaae908fae7fffd38d117b47
 F src/rowset.c ba9515a922af32abe1f7d39406b9d35730ed65efab9443dc5702693b60854c92
 F src/select.c ed07c4ad9c6f21b7b5b71a4eb844d4c52908324b8a3a48f00e0c0923337150c9
 F src/shell.c.in 9320b476fde0f7c46700e5695b69b435f1e46843a1513cdd187ac426cdbee016
 F src/sqlite.h.in 18ec33e32001721fd4e9c4705a24a85dff04956ac2c0a21775058884ba845b09
 F src/sqlite3.rc 5121c9e10c3964d5755191c80dd1180c122fc3a8
 F src/sqlite3ext.h 61b38c073d5e1e96a3d45271b257aef27d0d13da2bea5347692ae579475cd95e
-F src/sqliteInt.h a908dadfca73eba1827f11641dc57c32d2c01410cf72bff63a3ff4050a9e7386
+F src/sqliteInt.h 95679aa6addc29e48453770a80aeb8ea623d3fa76e309768d83a00ad87fe9111
 F src/sqliteLimit.h d7323ffea5208c6af2734574bae933ca8ed2ab728083caa117c9738581a31657
 F src/status.c 4b8bc2a6905163a38b739854a35b826c737333fab5b1f8e03fa7eb9a4799c4c1
 F src/table.c 0f141b58a16de7e2fbe81c308379e7279f4c6b50eb08efeec5892794a0ba30d1
@@ -1769,7 +1769,7 @@ F test/win32heap.test 10fd891266bd00af68671e702317726375e5407561d859be1aa04696f2
 F test/win32lock.test fbf107c91d8f5512be5a5b87c4c42ab9fdd54972
 F test/win32longpath.test 4baffc3acb2e5188a5e3a895b2b543ed09e62f7c72d713c1feebf76222fe9976
 F test/win32nolock.test ac4f08811a562e45a5755e661f45ca85892bdbbc
-F test/window1.test 1d3527fe4e1ce49005e47f976804aec324a2354b45dd4458465ba1ea6f58bb72
+F test/window1.test d85fd6d82f06ac98da31a7ca1417a051de0a7c01a8c61e4e93d3c7383544f5c7
 F test/window2.tcl 492c125fa550cda1dd3555768a2303b3effbeceee215293adf8871efc25f1476
 F test/window2.test e466a88bd626d66edc3d352d7d7e1d5531e0079b549ba44efb029d1fbff9fd3c
 F test/window3.tcl acea6e86a4324a210fd608d06741010ca83ded9fde438341cb978c49928faf03
@@ -1912,7 +1912,7 @@ F vsixtest/vsixtest.tcl 6a9a6ab600c25a91a7acc6293828957a386a8a93
 F vsixtest/vsixtest.vcxproj.data 2ed517e100c66dc455b492e1a33350c1b20fbcdc
 F vsixtest/vsixtest.vcxproj.filters 37e51ffedcdb064aad6ff33b6148725226cd608e
 F vsixtest/vsixtest_TemporaryKey.pfx e5b1b036facdb453873e7084e1cae9102ccc67a0
-P a4e3f13329332f91a250bc18459fd4100990a1ac0516f8a0a6b21ff117db9795
-R 69ebcba1c2ed8bedc6bebbd2142e3727
-U drh
-Z 80313787b667b082cab0e4bdbe569436
+P 28ecb3810b40ca58c2e04a752bbc2234c64c27185aef2cb3fe7c933082dc2578
+R 62bc949f2e959c0595e9131b28ace0cd
+U dan
+Z a8d1690d44ebe253332d3b34a770214c

diff --git a/manifest.uuid b/manifest.uuid
index 37df0ea7a03b341b5d665045d2ea8e585099d117..2fc77dd081afb4204cd2baaaa1e16c54731797e7 100644 (file)
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-28ecb3810b40ca58c2e04a752bbc2234c64c27185aef2cb3fe7c933082dc2578
\ No newline at end of file
+5ba15ebb34c3af85ef6c54bbb3acb57176d629cda83774881b2a6467e138e904
\ No newline at end of file

diff --git a/src/resolve.c b/src/resolve.c
index 09108e3de42f7935deefde98488c4a6be88ea41e..c564b81753c0385ce6d19a8439d67b4e30b89d02 100644 (file)
--- a/src/resolve.c
+++ b/src/resolve.c
@@ -1257,7 +1257,7 @@ static int resolveOrderByTermToExprList(
   nc.pParse = pParse;
   nc.pSrcList = pSelect->pSrc;
   nc.uNC.pEList = pEList;
-  nc.ncFlags = NC_AllowAgg|NC_UEList;
+  nc.ncFlags = NC_AllowAgg|NC_UEList|NC_NoSelect;
   nc.nNcErr = 0;
   db = pParse->db;
   savedSuppErr = db->suppressErr;
@@ -1864,7 +1864,7 @@ int sqlite3ResolveExprNames(
   pNC->ncFlags &= ~(NC_HasAgg|NC_MinMaxAgg|NC_HasWin);
   w.pParse = pNC->pParse;
   w.xExprCallback = resolveExprStep;
-  w.xSelectCallback = resolveSelectStep;
+  w.xSelectCallback = (pNC->ncFlags & NC_NoSelect) ? 0 : resolveSelectStep;
   w.xSelectCallback2 = 0;
   w.u.pNC = pNC;
 #if SQLITE_MAX_EXPR_DEPTH>0

diff --git a/src/sqliteInt.h b/src/sqliteInt.h
index c90f4cac5968c886cce1806f8df27b480684500b..f4944c2ed5fa19c9f70c9d82da2cfa7f0366775b 100644 (file)
--- a/src/sqliteInt.h
+++ b/src/sqliteInt.h
@@ -3098,6 +3098,7 @@ struct NameContext {
 #define NC_IsDDL     0x10000  /* Resolving names in a CREATE statement */
 #define NC_InAggFunc 0x20000  /* True if analyzing arguments to an agg func */
 #define NC_FromDDL   0x40000  /* SQL text comes from sqlite_schema */
+#define NC_NoSelect  0x80000  /* Do not descend into sub-selects */
 
 /*
 ** An instance of the following object describes a single ON CONFLICT

diff --git a/test/window1.test b/test/window1.test
index f1e44a2cd6788ce7e2fa40047b4abd177b2e3688..6eb97310fcf4c1dbec9917f107b20197975b0fa7 100644 (file)
--- a/test/window1.test
+++ b/test/window1.test
@@ -2045,4 +2045,19 @@ foreach {tn spec res} {
   " $res
 }
 
+
+#-------------------------------------------------------------------------
+reset_db
+do_execsql_test 67.0 {
+  CREATE TABLE t1(a, b, c);
+  CREATE TABLE t2(a, b, c);
+}
+
+do_catchsql_test 67.1 {
+  SELECT a,c,b FROM t1 INTERSECT SELECT a,b,c FROM t1 ORDER BY (             
+      SELECT nth_value(a,2) OVER w1 
+      WINDOW w1 AS ( ORDER BY ((SELECT 1 FROM v1)) )
+  )
+} {1 {1st ORDER BY term does not match any column in the result set}}
+
 finish_test