From: drh <drh@noemail.net>
Date: Mon, 19 Oct 2020 20:49:54 +0000 (+0000)
Subject: Fix an incorrect table ref-count in the new recursive CTE logic that might
X-Git-Tag: version-3.34.0~50
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=94d6f3f836c45be780c897278d19467c03236a15;p=thirdparty%2Fsqlite.git

Fix an incorrect table ref-count in the new recursive CTE logic that might
result in a reference to freed memory following a syntax error.

FossilOrigin-Name: 75a0288871ccb2a69a636cbb328fe19045a0d0ef96a193ecd118b9a196784d2d
---

diff --git a/manifest b/manifest
index af65523b3a..e3268ccd94 100644
--- a/manifest
+++ b/manifest
@@ -1,5 +1,5 @@
-C Enhance\srecursive\scommon\stable\sexpressions\sto\ssupport\stwo\sor\smore\nrecursive\sterms.
-D 2020-10-19T12:35:08.121
+C Fix\san\sincorrect\stable\sref-count\sin\sthe\snew\srecursive\sCTE\slogic\sthat\smight\nresult\sin\sa\sreference\sto\sfreed\smemory\sfollowing\sa\ssyntax\serror.
+D 2020-10-19T20:49:54.635
 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
 F LICENSE.md df5091916dbb40e6e9686186587125e1b2ff51f022cc334e886c19a0e9982724
@@ -537,7 +537,7 @@ F src/printf.c 30e92b638fac71dcd85cdea1d12ecfae354c9adee2c71e8e1ae4727cde7c91ed
 F src/random.c 80f5d666f23feb3e6665a6ce04c7197212a88384
 F src/resolve.c 97b91fb25d86881ff20c9ad2ad98412c6c1bb5f7d6c9bb044db250cbc9cfcd4b
 F src/rowset.c ba9515a922af32abe1f7d39406b9d35730ed65efab9443dc5702693b60854c92
-F src/select.c aabd90874b280dd69498c83380fe9a9cd7a703bf578a12fdc68993a91979b17d
+F src/select.c 645aa47fb8ce95e95290d4852d44cf5997c89c3e754a74c91e010459a8db7a72
 F src/shell.c.in b317d851046496c92e28529eb96f9d2ec1ad480590b1676e0362865f5466f886
 F src/sqlite.h.in ff32663b457306eb88c3039868280aa39da31162ed69c4e71fa8e028684e7277
 F src/sqlite3.rc 5121c9e10c3964d5755191c80dd1180c122fc3a8
@@ -1883,7 +1883,7 @@ F vsixtest/vsixtest.tcl 6a9a6ab600c25a91a7acc6293828957a386a8a93
 F vsixtest/vsixtest.vcxproj.data 2ed517e100c66dc455b492e1a33350c1b20fbcdc
 F vsixtest/vsixtest.vcxproj.filters 37e51ffedcdb064aad6ff33b6148725226cd608e
 F vsixtest/vsixtest_TemporaryKey.pfx e5b1b036facdb453873e7084e1cae9102ccc67a0
-P 7f8802bb7be61fdf7c7a591945d533d848bc46d2989f7739dd9ad89e1b6a9c65 cd5182bd6f5969ba0812275f471224908296960358013327cebbe0c52b820f04
-R f59d82fc144a7165d4f5d8ce148ff473
+P 77e64647ec429c6e0d884abbd00dabebe738f89544a4984d6fd7a702b928ccfd
+R 0c15a2499eb1c5aca61fe63f618e24c5
 U drh
-Z 5a75366d244ab861cea8e3bd1126539d
+Z f93dededcb8b1cf1b40f7b606d98b9f2
diff --git a/manifest.uuid b/manifest.uuid
index b69c648357..90bca06c48 100644
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-77e64647ec429c6e0d884abbd00dabebe738f89544a4984d6fd7a702b928ccfd
\ No newline at end of file
+75a0288871ccb2a69a636cbb328fe19045a0d0ef96a193ecd118b9a196784d2d
\ No newline at end of file
diff --git a/src/select.c b/src/select.c
index 5935964692..6d992602f8 100644
--- a/src/select.c
+++ b/src/select.c
@@ -4861,6 +4861,7 @@ static int withExpand(
          && 0==sqlite3StrICmp(pItem->zName, pCte->zName)
         ){
           pItem->pTab = pTab;
+          pTab->nTabRef++;
           pItem->fg.isRecursive = 1;
           if( pRecTerm->selFlags & SF_Recursive ){
             sqlite3ErrorMsg(pParse,
@@ -4868,7 +4869,6 @@ static int withExpand(
             );
             return SQLITE_ERROR;
           }
-          pTab->nTabRef++;
           pRecTerm->selFlags |= SF_Recursive;
           if( iRecTab<0 ) iRecTab = pParse->nTab++;
           pItem->iCursor = iRecTab;