From: drh <drh@noemail.net>
Date: Tue, 24 Dec 2019 15:01:17 +0000 (+0000)
Subject: Extra defense against problems following an OOM.  dbsqlfuzz find.  Also
X-Git-Tag: version-3.31.0~158
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=4eac5f04ab996fc5bf262edfcead84bc4e8a3ccb;p=thirdparty%2Fsqlite.git

Extra defense against problems following an OOM.  dbsqlfuzz find.  Also
import the latest dbsqlfuzz test cases.

FossilOrigin-Name: 0a70f5ddaf3567f335cc0fd0fcd5303e2afb5e38a6388faddf5cab1f2a74e3dd
---

diff --git a/manifest b/manifest
index 5f1dc5644d..8b62b2ce6a 100644
--- a/manifest
+++ b/manifest
@@ -1,5 +1,5 @@
-C Fix\sa\sspurious\sreport\sof\scorruption\sthat\scould\sbe\smade\sby\sthe\sfts5\sintegrity-check\sin\sSQLITE_DEBUG\sbuilds\sif\sthe\sfts5\sindex\scontains\smalformed\sutf\stext.
-D 2019-12-24T14:27:03.948
+C Extra\sdefense\sagainst\sproblems\sfollowing\san\sOOM.\s\sdbsqlfuzz\sfind.\s\sAlso\nimport\sthe\slatest\sdbsqlfuzz\stest\scases.
+D 2019-12-24T15:01:17.851
 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
 F LICENSE.md df5091916dbb40e6e9686186587125e1b2ff51f022cc334e886c19a0e9982724
@@ -479,7 +479,7 @@ F src/date.c e1d8ac7102f3f283e63e13867acb0efa33861cf34f0faf4cdbaf9fa7a1eb7041
 F src/dbpage.c 135eb3b5e74f9ef74bde5cec2571192c90c86984fa534c88bf4a055076fa19b7
 F src/dbstat.c 6c407e549406c10fde9ac3987f6d734459205239ad370369bc5fcd683084a4fa
 F src/delete.c a5c59b9c0251cf7682bc52af0d64f09b1aefc6781a63592c8f1136f7b73c66e4
-F src/expr.c ba7bed1c4f5ef0e90d80e9afea6f0cbff22827608ff4251162d16107758b4933
+F src/expr.c 518e46716bcf072b41e3e88209965e2495f4c7888f2f698ff00b3e415738912d
 F src/fault.c 460f3e55994363812d9d60844b2a6de88826e007
 F src/fkey.c 92a248ec0fa4ed8ab60c98d9b188ce173aaf218f32e7737ba77deb2a684f9847
 F src/func.c ed33e38cd642058182a31a3f518f2e34f4bbe53aa483335705c153c4d3e50b12
@@ -1017,7 +1017,7 @@ F test/fuzzdata4.db b502c7d5498261715812dd8b3c2005bad08b3a26e6489414bd13926cd3e4
 F test/fuzzdata5.db e35f64af17ec48926481cfaf3b3855e436bd40d1cfe2d59a9474cb4b748a52a5
 F test/fuzzdata6.db 92a80e4afc172c24f662a10a612d188fb272de4a9bd19e017927c95f737de6d7
 F test/fuzzdata7.db e7a86fd83dda151d160445d542e32e5c6019c541b3a74c2a525b6ac640639711
-F test/fuzzdata8.db f8da99ea7e57a436e300e59b2d5ad0d0f765fcb0468b2c1b1f9b9f03d928e0ef
+F test/fuzzdata8.db 7fd98a5d4c281d993950212507ad56a55ace0cf3083785eb3366aad9ebd8041c
 F test/fuzzer1.test 3d4c4b7e547aba5e5511a2991e3e3d07166cfbb8
 F test/fuzzer2.test a85ef814ce071293bce1ad8dffa217cbbaad4c14
 F test/fuzzerfault.test 8792cd77fd5bce765b05d0c8e01b9edcf8af8536
@@ -1852,7 +1852,7 @@ F vsixtest/vsixtest.tcl 6a9a6ab600c25a91a7acc6293828957a386a8a93
 F vsixtest/vsixtest.vcxproj.data 2ed517e100c66dc455b492e1a33350c1b20fbcdc
 F vsixtest/vsixtest.vcxproj.filters 37e51ffedcdb064aad6ff33b6148725226cd608e
 F vsixtest/vsixtest_TemporaryKey.pfx e5b1b036facdb453873e7084e1cae9102ccc67a0
-P b473ad35c5ce355853e1805a5c0658bda1500775f22f59c6b6759ae990e65aca
-R 88e0f620d2e9b56c3b0053f9411f1c0c
-U dan
-Z 0716b408ff1a9ce855db0a1c4ccdfffe
+P a11b393dc2c882cf0b3c47c3405bf43ca1d6459605bd39cccce4d32da653a72d
+R 27ce7f877a564e4328201c0fcf5cd524
+U drh
+Z 02d9d6056c86e58fa1f721e17435d869
diff --git a/manifest.uuid b/manifest.uuid
index 83c2c41554..f01574c641 100644
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-a11b393dc2c882cf0b3c47c3405bf43ca1d6459605bd39cccce4d32da653a72d
\ No newline at end of file
+0a70f5ddaf3567f335cc0fd0fcd5303e2afb5e38a6388faddf5cab1f2a74e3dd
\ No newline at end of file
diff --git a/src/expr.c b/src/expr.c
index 617fcf0633..601574e68e 100644
--- a/src/expr.c
+++ b/src/expr.c
@@ -2207,7 +2207,9 @@ int sqlite3ExprCanBeNull(const Expr *p){
     case TK_COLUMN:
       return ExprHasProperty(p, EP_CanBeNull) ||
              p->y.pTab==0 ||  /* Reference to column of index on expression */
-             (p->iColumn>=0 && p->y.pTab->aCol[p->iColumn].notNull==0);
+             (p->iColumn>=0
+              && ALWAYS(p->y.pTab->aCol!=0) /* Defense against OOM problems */
+              && p->y.pTab->aCol[p->iColumn].notNull==0);
     default:
       return 1;
   }
@@ -3224,6 +3226,7 @@ static void sqlite3ExprCodeIN(
   }else{
     destStep2 = destStep6 = sqlite3VdbeMakeLabel(pParse);
   }
+  if( pParse->nErr ) goto sqlite3ExprCodeIN_finished;
   for(i=0; i<nVector; i++){
     Expr *p = sqlite3VectorFieldSubexpr(pExpr->pLeft, i);
     if( sqlite3ExprCanBeNull(p) ){
diff --git a/test/fuzzdata8.db b/test/fuzzdata8.db
index 8dd6e3a8f1..7247ea1416 100644
Binary files a/test/fuzzdata8.db and b/test/fuzzdata8.db differ