Fix a 1-byte buffer overwrite that can occur when a virtual table overloads an SQL...

FossilOrigin-Name: bfe336a8993e06e70d3c32a929202fb015dcbb89

diff --git a/manifest b/manifest
index 806e668285cad08dcd173b96d6dc8b7226fbcea3..79169a9ae5cb675686b53080b8864a20865d3ab6 100644 (file)
--- a/manifest
+++ b/manifest
@@ -1,5 +1,5 @@
-C Report\san\serror\sif\sa\sUSING\sor\sON\sclause\sis\sspecified\sfollowing\sa\sfrom-list\selement\sthat\sis\snot\sto\sthe\sright\sof\sa\sjoin\soperator.\sFix\sfor\s#3846.\s(CVS\s6832)
-D 2009-07-01T16:12:08
+C Fix\sa\s1-byte\sbuffer\soverwrite\sthat\scan\soccur\swhen\sa\svirtual\stable\soverloads\san\sSQL\sfunction.\s(CVS\s6833)
+D 2009-07-01T18:04:21
 F Makefile.arm-wince-mingw32ce-gcc fcd5e9cd67fe88836360bb4f9ef4cb7f8e2fb5a0
 F Makefile.in 8b8fb7823264331210cddf103831816c286ba446
 F Makefile.linux-gcc d53183f4aa6a9192d249731c90dbdffbd2c68654
@@ -210,7 +210,7 @@ F src/vdbeapi.c 0ab8ada7260b32031ca97f338caecf0812460624
 F src/vdbeaux.c 3773217a73f93fb292d264b3b1da98c179a0f2f0
 F src/vdbeblob.c f3d3151d8ddfe9fed288f9e2c98c96e12e914fbb
 F src/vdbemem.c 1618f685d19b4bcc96e40b3c478487bafd2ae246
-F src/vtab.c 98fbffc5efe68d8107511dec0a650efc7daa9446
+F src/vtab.c 00902f289521041712fb0293d0bf8688c7af8e48
 F src/walker.c 1edca756275f158b80f20eb6f104c8d3fcc96a04
 F src/where.c cf0d091748c2fa6f7df96e5b08d2db26fd2eb437
 F test/aggerror.test a867e273ef9e3d7919f03ef4f0e8c0d2767944f2
@@ -738,7 +738,7 @@ F tool/speedtest2.tcl ee2149167303ba8e95af97873c575c3e0fab58ff
 F tool/speedtest8.c 2902c46588c40b55661e471d7a86e4dd71a18224
 F tool/speedtest8inst1.c 293327bc76823f473684d589a8160bde1f52c14e
 F tool/vdbe-compress.tcl 672f81d693a03f80f5ae60bfefacd8a349e76746
-P 42f9d1e56483a59353bff57d75f09ed67e1d9c3c
-R 23d368ef27404e6adaeea4f513ad5353
+P 29b48972b65a17dab343b063a620cf8d456a923c
+R 88ce6118d616e71c0f1f18756951eecb
 U danielk1977
-Z 8f538dfbca52be8303d8e87518479b92
+Z 258584205553a4e9af935a9ece340ce8

diff --git a/manifest.uuid b/manifest.uuid
index fff3e0e277f9f0fee637d19f3b77bb9fda231301..f2fd7de35559d5907710abe7ce87f23a01032665 100644 (file)
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-29b48972b65a17dab343b063a620cf8d456a923c
\ No newline at end of file
+bfe336a8993e06e70d3c32a929202fb015dcbb89
\ No newline at end of file

diff --git a/src/vtab.c b/src/vtab.c
index e315edf021e8e6c8856a88a787db16f9b1f9fcc7..e870ec043c98bbda75497690152bea1b441b3cf9 100644 (file)
--- a/src/vtab.c
+++ b/src/vtab.c
@@ -11,7 +11,7 @@
 *************************************************************************
 ** This file contains code used to help implement virtual tables.
 **
-** $Id: vtab.c,v 1.91 2009/06/15 16:27:08 shane Exp $
+** $Id: vtab.c,v 1.92 2009/07/01 18:04:21 danielk1977 Exp $
 */
 #ifndef SQLITE_OMIT_VIRTUALTABLE
 #include "sqliteInt.h"
@@ -825,7 +825,7 @@ FuncDef *sqlite3VtabOverloadFunction(
   /* Create a new ephemeral function definition for the overloaded
   ** function */
   pNew = sqlite3DbMallocZero(db, sizeof(*pNew)
-                             + sqlite3Strlen30(pDef->zName) );
+                             + sqlite3Strlen30(pDef->zName) + 1);
   if( pNew==0 ){
     return pDef;
   }