From: drh <drh@noemail.net>
Date: Sat, 19 Sep 2015 18:54:39 +0000 (+0000)
Subject: Fix a memory leak in json1.c that could occur after misuse of json_object().
X-Git-Tag: version-3.9.0~85
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=dc38495715fc2dca049e963d5150d4ba4b6e53d7;p=thirdparty%2Fsqlite.git

Fix a memory leak in json1.c that could occur after misuse of json_object().

FossilOrigin-Name: 394b81b11f261a9b179a034bc2a2d2dff0765e3b
---

diff --git a/ext/misc/json1.c b/ext/misc/json1.c
index c59b09432f..e115470f87 100644
--- a/ext/misc/json1.c
+++ b/ext/misc/json1.c
@@ -1206,7 +1206,7 @@ static void jsonObjectFunc(
   for(i=0; i<argc; i+=2){
     if( sqlite3_value_type(argv[i])!=SQLITE_TEXT ){
       sqlite3_result_error(ctx, "json_object() labels must be TEXT", -1);
-      jsonZero(&jx);
+      jsonReset(&jx);
       return;
     }
     jsonAppendSeparator(&jx);
diff --git a/manifest b/manifest
index a10210ace8..2d76ba5e00 100644
--- a/manifest
+++ b/manifest
@@ -1,5 +1,5 @@
-C Add\san\sassert()\sstatement\sto\sdelete.c.
-D 2015-09-19T18:11:18.686
+C Fix\sa\smemory\sleak\sin\sjson1.c\sthat\scould\soccur\safter\smisuse\sof\sjson_object().
+D 2015-09-19T18:54:39.661
 F Makefile.arm-wince-mingw32ce-gcc d6df77f1f48d690bd73162294bbba7f59507c72f
 F Makefile.in 2047811644c5bac91ccdfc2720e49b60965a63a7
 F Makefile.linux-gcc 91d710bdc4998cb015f39edf3cb314ec4f4d7e23
@@ -195,7 +195,7 @@ F ext/misc/eval.c f971962e92ebb8b0a4e6b62949463ee454d88fa2
 F ext/misc/fileio.c d4171c815d6543a9edef8308aab2951413cd8d0f
 F ext/misc/fuzzer.c 4c84635c71c26cfa7c2e5848cf49fe2d2cfcd767
 F ext/misc/ieee754.c b0362167289170627659e84173f5d2e8fee8566e
-F ext/misc/json1.c d96049b4147eb55755593bf806e27d5966b9d244
+F ext/misc/json1.c a1f7dd9b533bcd04160a5eaf2ae93cf7c64f3744
 F ext/misc/nextchar.c 35c8b8baacb96d92abbb34a83a997b797075b342
 F ext/misc/percentile.c bcbee3c061b884eccb80e21651daaae8e1e43c63
 F ext/misc/regexp.c af92cdaa5058fcec1451e49becc7ba44dba023dc
@@ -815,7 +815,7 @@ F test/journal3.test ff8af941f9e06161d3db1b46bb9f965ff0e7f307
 F test/jrnlmode.test 7864d59cf7f6e552b9b99ba0f38acd167edc10fa
 F test/jrnlmode2.test 81610545a4e6ed239ea8fa661891893385e23a1d
 F test/jrnlmode3.test 556b447a05be0e0963f4311e95ab1632b11c9eaa
-F test/json101.test e20d2421c531db32fad59c5e06e80af0b1b002c8
+F test/json101.test b33f38882794a3e3f6f1c39f2f1c55a0e8aaf56d
 F test/json102.test 796b1c59894c6e0f38fc1a3acb0e690573b952a3
 F test/keyword1.test 37ef6bba5d2ed5b07ecdd6810571de2956599dff
 F test/lastinsert.test 42e948fd6442f07d60acbd15d33fb86473e0ef63
@@ -1387,7 +1387,7 @@ F tool/vdbe_profile.tcl 67746953071a9f8f2f668b73fe899074e2c6d8c1
 F tool/warnings-clang.sh f6aa929dc20ef1f856af04a730772f59283631d4
 F tool/warnings.sh 48bd54594752d5be3337f12c72f28d2080cb630b
 F tool/win/sqlite.vsix deb315d026cc8400325c5863eef847784a219a2f
-P 5c31ee62a196b914673384a611534fd778dc64b0
-R 4ce047a31774a6a4781364ff4ecf8f55
-U dan
-Z 15395d5bafcc929901d2af1e98ec30be
+P 40fce67ecf0e71db3c8f3da3f72cc80a3d0f8fb2
+R 6ee97186014c02a7619b2c663f4e3b82
+U drh
+Z 8aa08af4f5f205f4477c5ca72006e16f
diff --git a/manifest.uuid b/manifest.uuid
index a9d23a9229..f3323c6dcd 100644
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-40fce67ecf0e71db3c8f3da3f72cc80a3d0f8fb2
\ No newline at end of file
+394b81b11f261a9b179a034bc2a2d2dff0765e3b
\ No newline at end of file
diff --git a/test/json101.test b/test/json101.test
index 9543ccfd24..762e708ec9 100644
--- a/test/json101.test
+++ b/test/json101.test
@@ -35,7 +35,7 @@ do_execsql_test json1-1.2 {
   SELECT hex(json_array('String "\ Test'));
 } {5B22537472696E67205C225C5C2054657374225D}
 do_catchsql_test json1-1.3 {
-  SELECT json_array(1,2,x'abcd',3);
+  SELECT json_array(1,printf('%.1000c','x'),x'abcd',3);
 } {1 {JSON cannot hold BLOB values}}
 do_execsql_test json1-1.4 {
   SELECT json_array(-9223372036854775808,9223372036854775807,0,1,-1,
@@ -53,13 +53,13 @@ do_execsql_test json1-2.1 {
   SELECT json_object('a',1,'b',2.5,'c',null,'d','String Test');
 } {{{"a":1,"b":2.5,"c":null,"d":"String Test"}}}
 do_catchsql_test json1-2.2 {
-  SELECT json_object('a',1,2,2.5);
+  SELECT json_object('a',printf('%.1000c','x'),2,2.5);
 } {1 {json_object() labels must be TEXT}}
 do_catchsql_test json1-2.3 {
   SELECT json_object('a',1,'b');
 } {1 {json_object() requires an even number of arguments}}
 do_catchsql_test json1-2.4 {
-  SELECT json_object('a',1,'b',x'abcd');
+  SELECT json_object('a',printf('%.1000c','x'),'b',x'abcd');
 } {1 {JSON cannot hold BLOB values}}
 
 do_execsql_test json1-3.1 {