From: drh <drh@noemail.net>
Date: Sat, 31 Aug 2019 20:13:30 +0000 (+0000)
Subject: Improvements to the algorithm that determines which SELECT in a sequence
X-Git-Tag: version-3.30.0~78
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=80f6bfc064eac13c408aa7e46e2e154d1d40f297;p=thirdparty%2Fsqlite.git

Improvements to the algorithm that determines which SELECT in a sequence
of nested SELECT statements that an aggregate function belongs to.  This
resolves an issue identified by dbsqlfuzz.

FossilOrigin-Name: d768007473f4ed40abbdf2c7e501b580b1cc37c1620c7cb90af1f208a8c35145
---

diff --git a/manifest b/manifest
index 7d0e3d14ee..388d7e7892 100644
--- a/manifest
+++ b/manifest
@@ -1,5 +1,5 @@
-C If\sa\sDELETE\strigger\sfired\sby\san\sUPDATE\sOR\sREPLACE\sstatement\sdeletes\sthe\srow\sbeing\supdated,\sdo\snot\sattempt\sto\sproceed\swith\sthe\soriginal\sUPDATE\soperation.\sFix\sfor\s[d6a0fbc1].
-D 2019-08-31T17:14:35.569
+C Improvements\sto\sthe\salgorithm\sthat\sdetermines\swhich\sSELECT\sin\sa\ssequence\nof\snested\sSELECT\sstatements\sthat\san\saggregate\sfunction\sbelongs\sto.\s\sThis\nresolves\san\sissue\sidentified\sby\sdbsqlfuzz.
+D 2019-08-31T20:13:30.510
 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
 F LICENSE.md df5091916dbb40e6e9686186587125e1b2ff51f022cc334e886c19a0e9982724
@@ -475,7 +475,7 @@ F src/date.c e1d8ac7102f3f283e63e13867acb0efa33861cf34f0faf4cdbaf9fa7a1eb7041
 F src/dbpage.c 135eb3b5e74f9ef74bde5cec2571192c90c86984fa534c88bf4a055076fa19b7
 F src/dbstat.c c12833de69cb655751487d2c5a59607e36be1c58ba1f4bd536609909ad47b319
 F src/delete.c d08c9e01a2664afd12edcfa3a9c6578517e8ff8735f35509582693adbe0edeaf
-F src/expr.c 60cf8c778c3291220487bea46667339160f15bbddaef57c1a703c56d5fc76c52
+F src/expr.c eb9b2e8b19d28ff58d20585964052166c0d38620593a8ab5c66214415f850261
 F src/fault.c 460f3e55994363812d9d60844b2a6de88826e007
 F src/fkey.c 6b79f4c2447691aa9ac86e2a6a774b65f3b3dd053d4220a4893051a0de20f82e
 F src/func.c 4ee36219698d50d672a28eca4adb0fd6b92e607a1883d318315e0d2fd5044467
@@ -618,7 +618,7 @@ F test/8_3_names.test ebbb5cd36741350040fd28b432ceadf495be25b2
 F test/affinity2.test da465d3d490ab24ef64f7715b5953343a4967762b9350b29eb1462879ff3fb9e
 F test/affinity3.test 6a101af2fc945ce2912f6fe54dd646018551710d
 F test/aggerror.test a867e273ef9e3d7919f03ef4f0e8c0d2767944f2
-F test/aggnested.test 18b00de006597e960a6b27ccec51474ac66cf1070a87c1933e5694dc02190ef1
+F test/aggnested.test 12106f0748e8e9bfc1a8e6840e203e051eae06a26ed13fc9fd5db108a8d6db54
 F test/alias.test 4529fbc152f190268a15f9384a5651bbbabc9d87
 F test/all.test 2ecb8bbd52416642e41c9081182a8df05d42c75637afd4488aace78cc4b69e13
 F test/alter.test 16ed8d2470193f34bc711e51506ff1211ebfab8025ca3b9510ff2aef139874cb
@@ -1838,8 +1838,7 @@ F vsixtest/vsixtest.tcl 6a9a6ab600c25a91a7acc6293828957a386a8a93
 F vsixtest/vsixtest.vcxproj.data 2ed517e100c66dc455b492e1a33350c1b20fbcdc
 F vsixtest/vsixtest.vcxproj.filters 37e51ffedcdb064aad6ff33b6148725226cd608e
 F vsixtest/vsixtest_TemporaryKey.pfx e5b1b036facdb453873e7084e1cae9102ccc67a0
-P e2db1123faac26c0e0b6a1ebef1685ea7633bfcafd1ff743ba5380700f7745af
-R 1a919c61b513d8917573ee41d8ce4c15
-T +closed 2a0152c9f5f2ca56734189521b3b114ad6ba7ee7941d0f22d262081125436f72
-U dan
-Z 6965309018f410a0aa2e8d19660bb27e
+P 4145b3e05051ba6729105157a876793ad14a05d895fc10fe704f437eab16ea93
+R 30aae3120e96fb727d9d30a86d181e41
+U drh
+Z e2cf69056f38cf2141131156d9461b54
diff --git a/manifest.uuid b/manifest.uuid
index 5a00355cf9..cef6b58a19 100644
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-4145b3e05051ba6729105157a876793ad14a05d895fc10fe704f437eab16ea93
\ No newline at end of file
+d768007473f4ed40abbdf2c7e501b580b1cc37c1620c7cb90af1f208a8c35145
\ No newline at end of file
diff --git a/src/expr.c b/src/expr.c
index 0332dc3e53..ba464f9af6 100644
--- a/src/expr.c
+++ b/src/expr.c
@@ -5297,7 +5297,10 @@ static int exprSrcCount(Walker *pWalker, Expr *pExpr){
     }
     if( i<nSrc ){
       p->nThis++;
-    }else{
+    }else if( nSrc==0 || pExpr->iTable<pSrc->a[0].iCursor ){
+      /* In a well-formed parse tree (no name resolution errors),
+      /* TK_COLUMN nodes with smaller Expr.iTable values are in an
+      ** outer context.  Those are the only ones to count as "other" */
       p->nOther++;
     }
   }
@@ -5314,8 +5317,9 @@ int sqlite3FunctionUsesThisSrc(Expr *pExpr, SrcList *pSrcList){
   Walker w;
   struct SrcCount cnt;
   assert( pExpr->op==TK_AGG_FUNCTION );
+  memset(&w, 0, sizeof(w));
   w.xExprCallback = exprSrcCount;
-  w.xSelectCallback = 0;
+  w.xSelectCallback = sqlite3SelectWalkNoop;
   w.u.pSrcCount = &cnt;
   cnt.pSrc = pSrcList;
   cnt.nThis = 0;
diff --git a/test/aggnested.test b/test/aggnested.test
index 91de63b768..d712c840f1 100644
--- a/test/aggnested.test
+++ b/test/aggnested.test
@@ -1,4 +1,4 @@
-# 2012 August 23
+# 2012-08-23
 #
 # The author disclaims copyright to this source code.  In place of
 # a legal notice, here is a blessing:
@@ -232,6 +232,34 @@ do_test aggnested-3.16 {
      GROUP BY id1;
   }
 } {12 2 34 4}
+
+# 2019-08-31
+# Problem found by dbsqlfuzz
+#
+do_execsql_test aggnested-4.1 {
+  DROP TABLE IF EXISTS aa;
+  DROP TABLE IF EXISTS bb;
+  CREATE TABLE aa(x INT);  INSERT INTO aa(x) VALUES(123);
+  CREATE TABLE bb(y INT);  INSERT INTO bb(y) VALUES(456);
+  SELECT (SELECT sum(x+(SELECT y)) FROM bb) FROM aa;
+} {579}
+do_execsql_test aggnested-4.2 {
+  SELECT (SELECT sum(x+y) FROM bb) FROM aa;
+} {579}
+do_execsql_test aggnested-4.3 {
+  DROP TABLE IF EXISTS tx;
+  DROP TABLE IF EXISTS ty;
+  CREATE TABLE tx(x INT);
+  INSERT INTO tx VALUES(1),(2),(3),(4),(5);
+  CREATE TABLE ty(y INT);
+  INSERT INTO ty VALUES(91),(92),(93);
+  SELECT min((SELECT count(y) FROM ty)) FROM tx;
+} {3}
+do_execsql_test aggnested-4.4 {
+  SELECT max((SELECT a FROM (SELECT count(*) AS a FROM ty) AS s)) FROM tx;
+} {3}
+
+
  
 
 finish_test