Fix a double-free that can occur when using the fts3 legacy syntax '-' operator....

FossilOrigin-Name: c19d419e8cf94a26d9bb6ad478e84841168a882e

diff --git a/ext/fts3/fts3_expr.c b/ext/fts3/fts3_expr.c
index ae11e2d2e015c97f7ac63a9a59251c685c60d450..4fb3be0d6fa3612937829cc8d1a26f8e96753e8f 100644 (file)
--- a/ext/fts3/fts3_expr.c
+++ b/ext/fts3/fts3_expr.c
@@ -538,10 +538,10 @@ static int fts3ExprParse(
         pNot->eType = FTSQUERY_NOT;
         pNot->pRight = p;
         if( pNotBranch ){
-          pNotBranch->pLeft = p;
-          pNot->pRight = pNotBranch;
+          pNot->pLeft = pNotBranch;
         }
         pNotBranch = pNot;
+        p = pPrev;
       }else{
         int eType = p->eType;
         assert( eType!=FTSQUERY_PHRASE || !p->pPhrase->isNot );
@@ -623,7 +623,11 @@ static int fts3ExprParse(
       if( !pRet ){
         rc = SQLITE_ERROR;
       }else{
-        pNotBranch->pLeft = pRet;
+        Fts3Expr *pIter = pNotBranch;
+        while( pIter->pLeft ){
+          pIter = pIter->pLeft;
+        }
+        pIter->pLeft = pRet;
         pRet = pNotBranch;
       }
     }

diff --git a/manifest b/manifest
index cbf62e1d717f3317cd17d0793a31dea355666108..9b5fa91d66be5ddabbd827eabe2d325162c377ef 100644 (file)
--- a/manifest
+++ b/manifest
@@ -1,5 +1,5 @@
-C Simplifications\sto\sthe\sPRAGMA\sintegrity_check\slogic\sin\sbtree.c.\s(CVS\s6873)
-D 2009-07-10T02:52:21
+C Fix\sa\sdouble-free\sthat\scan\soccur\swhen\susing\sthe\sfts3\slegacy\ssyntax\s'-'\soperator.\sAdd\stests\sfor\sthe\ssame\soperator.\sTicket\s#3960.\s(CVS\s6874)
+D 2009-07-10T09:24:43
 F Makefile.arm-wince-mingw32ce-gcc fcd5e9cd67fe88836360bb4f9ef4cb7f8e2fb5a0
 F Makefile.in df9359da7a726ccb67a45db905c5447d5c00c6ef
 F Makefile.linux-gcc d53183f4aa6a9192d249731c90dbdffbd2c68654
@@ -58,7 +58,7 @@ F ext/fts3/README.tokenizers 998756696647400de63d5ba60e9655036cb966e9
 F ext/fts3/README.txt 8c18f41574404623b76917b9da66fcb0ab38328d
 F ext/fts3/fts3.c 35bfa67d9cd659b799b8498895fe60b1e8bd3500
 F ext/fts3/fts3.h 3a10a0af180d502cecc50df77b1b22df142817fe
-F ext/fts3/fts3_expr.c 212548eb2dc50f8640fd0d6afb56d1c2aca59a73
+F ext/fts3/fts3_expr.c 25f8f5b73c6c62d8adc521a8324ae19ab6b899ca
 F ext/fts3/fts3_expr.h b5412dcf565c6d90d6a8c22090ceb9ed8c745634
 F ext/fts3/fts3_hash.c e15e84d18f8df149ab290029872d4559c4c7c15a
 F ext/fts3/fts3_hash.h 004b759e1602ff16dfa02fea3ca1c77336ad6798
@@ -382,7 +382,7 @@ F test/fts3b.test b3a25180a633873d37d86e1ccd00ed690d37237a
 F test/fts3c.test 4c7ef29b37aca3e8ebb6a39b57910caa6506034e
 F test/fts3d.test d92a47fe8ed59c9e53d2d8e6d2685bb380aadadc
 F test/fts3e.test 1f6c6ac9cc8b772ca256e6b22aaeed50c9350851
-F test/fts3expr.test 9764961c3f4ac818dacda01ed35d8bfcef42338b
+F test/fts3expr.test 8e5b1a0632959e302ad8e31ba625279cfc8e9d67
 F test/fts3expr2.test 18da930352e5693eaa163a3eacf96233b7290d1a
 F test/fts3near.test dc196dd17b4606f440c580d45b3d23aa975fd077
 F test/func.test 004caa157b91986bed8c85d7c7d0a86d6e10528d
@@ -740,7 +740,7 @@ F tool/speedtest2.tcl ee2149167303ba8e95af97873c575c3e0fab58ff
 F tool/speedtest8.c 2902c46588c40b55661e471d7a86e4dd71a18224
 F tool/speedtest8inst1.c 293327bc76823f473684d589a8160bde1f52c14e
 F tool/vdbe-compress.tcl 672f81d693a03f80f5ae60bfefacd8a349e76746
-P 9403f04dfdabdd2ba9adb1a91ca9b400cf4ca6b3
-R f5584a1b216a472f2389b4db4fb67036
-U drh
-Z edc8374917110976eef49eaed71b43e7
+P 440c573c7e2a22f9a67a9571883e205fbadb7c11
+R 832e9103a4322f20a003eefc85e64149
+U danielk1977
+Z fa26a29c136a6c05a174c9dac92631c9

diff --git a/manifest.uuid b/manifest.uuid
index 90e9b7eb6f58ccf91530cd2274722d2c7f917c50..0cd07ddadc03293bcdadb1220cdd8bc0488defa9 100644 (file)
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-440c573c7e2a22f9a67a9571883e205fbadb7c11
\ No newline at end of file
+c19d419e8cf94a26d9bb6ad478e84841168a882e
\ No newline at end of file

diff --git a/test/fts3expr.test b/test/fts3expr.test
index 77caaea392b47cf7b2df382c034b6afe76140c72..5708507addf9f914d970d2f71757549cb4d9c943 100644 (file)
--- a/test/fts3expr.test
+++ b/test/fts3expr.test
@@ -11,7 +11,7 @@
 # This file implements regression tests for SQLite library.  The
 # focus of this script is testing the FTS3 module.
 #
-# $Id: fts3expr.test,v 1.7 2009/03/12 15:43:48 danielk1977 Exp $
+# $Id: fts3expr.test,v 1.8 2009/07/10 09:24:43 danielk1977 Exp $
 #
 
 set testdir [file dirname $argv0]
@@ -463,11 +463,26 @@ foreach {id expr res} {
   13 "((((((one two OR four five)))))) NOT three" {3 11 19 24 25 26 27}
 
 } {
-  do_test fts3expr-6.$id {
+  do_test fts3expr-6.1.$id {
     execsql { SELECT rowid FROM t1 WHERE t1 MATCH $expr ORDER BY rowid }
   } $res
 }
 
+set sqlite_fts3_enable_parentheses 0
+foreach {id expr res} {
+  1 "one -two three"  {5 13 21 29}
+  2 "-two one three"  {5 13 21 29}
+  3 "one three -two"  {5 13 21 29}
+  4 "-one -two three" {4 12 20 28}
+  5 "three -one -two" {4 12 20 28}
+  6 "-one three -two" {4 12 20 28}
+} {
+  do_test fts3expr-6.2.$id {
+    execsql { SELECT rowid FROM t1 WHERE t1 MATCH $expr ORDER BY rowid }
+  } $res
+}
+set sqlite_fts3_enable_parentheses 1
+
 do_test fts3expr-7.1 {
   execsql {
     CREATE VIRTUAL TABLE test USING fts3 (keyword);
@@ -476,5 +491,6 @@ do_test fts3expr-7.1 {
   }
 } {}
 
+
 set sqlite_fts3_enable_parentheses 0
 finish_test