From: drh <>
Date: Sun, 2 Aug 2026 16:32:28 +0000 (+0000)
Subject: Do not allow the (obsolete and unsupported) closure extension to use itself
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=c59cf28db7eb7da5cce0933d77f339d8726a386f;p=thirdparty%2Fsqlite.git

Do not allow the (obsolete and unsupported) closure extension to use itself
as its own reference table.
[bugs:/info/2026-08-02T13:07:40Z|Bug 2026-08-02T13:07:40Z].

FossilOrigin-Name: 5e347561c3f8d271bf47c44473fa4b51b87ccab91b40c33f5aad28990a26e9ba
---

diff --git a/ext/misc/closure.c b/ext/misc/closure.c
index 6271a359d4..16ac9a9c26 100644
--- a/ext/misc/closure.c
+++ b/ext/misc/closure.c
@@ -10,18 +10,26 @@
 **
 *************************************************************************
 **
-** WARNING:  Experimental and obsolete.  Demonstration and testing only.
+** WARNING:  Experimental and obsolete.  Demonstration and testing use only.
 **
 ** This virtual table was created prior to the addition of support for
 ** common table expressions in SQLite.  Common table expressions are a
 ** better and more portable solution to any problem that this virtual
-** table solves.
+** table solves.  Common table expressions where added to SQLite in
+** version 3.8.3 (2014-02-02), less than 10 months after this extension
+** was created.  Hence this extension was only useful for a small
+** 10-month window of time in 2013 and early 2014.
+**
+** The continued use of this extension in any real-world application should
+** be considered a bug in that application.
 **
 ** Given its experimental and testing-only status, the code here is
 ** deactivated unless compiled with -DSQLITE_TEST=1
 **
 ** DEMONSTRATION AND TESTING USE ONLY.
 **
+*************************************************************************
+**
 ** This file contains code for a virtual table that finds the transitive
 ** closure of a parent/child relationship in a real table.  The virtual 
 ** table is called "transitive_closure".
@@ -544,6 +552,11 @@ static int closureConnect(
       sqlite3_free(pNew->zTableName);
       pNew->zTableName = closureDequote(zVal);
       if( pNew->zTableName==0 ) goto closureConnectError;
+      if( sqlite3_stricmp(pNew->zTableName, argv[2])==0 ){
+        *pzErr = sqlite3_mprintf("self-referential closure table");
+        rc = SQLITE_ERROR;
+        goto closureConnectError;
+      }
       continue;
     }
     zVal = closureValueOfKey("idcolumn", argv[i]);
diff --git a/manifest b/manifest
index 178940f0b7..62bc7c5210 100644
--- a/manifest
+++ b/manifest
@@ -1,5 +1,5 @@
-C Updates\sto\sbuild\sinstructions,\sespecially\son\sWindows.\s\sFix\sa\sharmless\ncompiler\sworking\sin\sdebug\sbuilds\son\sWindows.
-D 2026-08-01T15:08:48.942
+C Do\snot\sallow\sthe\s(obsolete\sand\sunsupported)\sclosure\sextension\sto\suse\sitself\nas\sits\sown\sreference\stable.\n[bugs:/info/2026-08-02T13:07:40Z|Bug\s2026-08-02T13:07:40Z].
+D 2026-08-02T16:32:28.704
 F .fossil-settings/binary-glob 61195414528fb3ea9693577e1980230d78a1f8b0a54c78cf1b9b24d0a409ed6a x
 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
@@ -369,7 +369,7 @@ F ext/misc/base85.c c713c7c81b05558c488cbdd8c68d612d5a97f9f0b8adf1167148dd7c89ce
 F ext/misc/basexx.c 89ad6b76558efbceb627afd5e2ef1d84b2e96d9aaf9b7ecb20e3d00b51be6fcf
 F ext/misc/btreeinfo.c 5fe97f798a9ee90e92b3031ed7969ec3f558661bb36b821c3ba045a17cfb951c
 F ext/misc/cksumvfs.c 83414e220e6cdfb29929f3154a24f32ff219d9794690bcb1b2db48f668651b35
-F ext/misc/closure.c 6166746f1537a65e82ecc58e64e182f368006d1fe4c5b075a7558cb72ca3c57f
+F ext/misc/closure.c fb13ff55ff19de5e35e08021afeae8d1ff2e1c1f46ff97cb765f26d17c940a3b
 F ext/misc/completion.c 3f5db28e88c3313103b2dd86d910a2944fd500c46754e473493968ce81e994a4
 F ext/misc/compress.c 5cc142aa82d1589a31c384657d0418c0eb0871348a2201e5dca32d24a0dd6654
 F ext/misc/csv.c 5ca451b9ce77322c4ce8476766e7ed18160e5c8b19e7cab76e13006d631b9e8f
@@ -977,7 +977,7 @@ F test/checkfault.test da6cb3d50247169efcb20bdf57863a3ccfa1d27d9e55cd324f0680096
 F test/chunksize.test faea11c5d6df9d392252a8dd879e1b1d68c9d3e8b7909cbed8bcec3b60c706f1
 F test/cksumvfs.test f9639eac08c06485ecf62eed3c558521d2ffe62de0774248d6862826740fe433
 F test/close.test eccbad8ecd611d974cbf47278c3d4e5874faf02d811338d5d348af42d56d647c
-F test/closure01.test d3b90cc67744921a32a2421bb9f590fb6c8d2f14fbb1d7733ec0b2c37d45cab1
+F test/closure01.test 4e9b77fd90e143b44862c752599fe6c9c94a5996cea6953048a713ccfc27f97f
 F test/coalesce.test cee0dccb9fbd2d494b77234bccf9dc6c6786eb91
 F test/collate1.test 0890fa372753b59eba53832d37328af815f6b8e4b16761823180eeb62c8e8f64
 F test/collate2.test 471c6f74573382b89b0f8b88a05256faa52f7964f9e4799e76708a3b1ece6ba4
@@ -2218,8 +2218,8 @@ F tool/warnings-clang.sh bbf6a1e685e534c92ec2bfba5b1745f34fb6f0bc2a362850723a9ee
 F tool/warnings.sh a554d13f6e5cf3760f041b87939e3d616ec6961859c3245e8ef701d1eafc2ca2
 F tool/win/sqlite.vsix deb315d026cc8400325c5863eef847784a219a2f
 F tool/winmain.c 00c8fb88e365c9017db14c73d3c78af62194d9644feaf60e220ab0f411f3604c
-P bf44a08adc94b8c7c69921a1292d56bec0cbd9f3ac772e31d8ea5866e9f46063
-R c754dcf7739c1f4243cfe1763468ec65
+P be245e136a550faa7c84694156c40dc9778f50b00016892c29a2314bef14b6b7
+R 477404288df8619c8c1a404eae12e3af
 U drh
-Z e200f72878b5b96a81f656ca3cb9100b
+Z 32dff29b9a839514932f6aa2d100f0ae
 # Remove this line to create a well-formed Fossil manifest.
diff --git a/manifest.uuid b/manifest.uuid
index 54c97868c1..b62d7d202a 100644
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-be245e136a550faa7c84694156c40dc9778f50b00016892c29a2314bef14b6b7
+5e347561c3f8d271bf47c44473fa4b51b87ccab91b40c33f5aad28990a26e9ba
diff --git a/test/closure01.test b/test/closure01.test
index a2f9cf88a9..e4632cf8de 100644
--- a/test/closure01.test
+++ b/test/closure01.test
@@ -308,4 +308,17 @@ do_execsql_test 7.3 {
   SELECT * FROM c WHERE root=1;
 } {1 0 2 1}
 
+# Bug 2026-08-02T13:07:40Z
+#
+do_catchsql_test 8.1 {
+  CREATE VIRTUAL TABLE ct1 USING transitive_closure(
+    tablename='ct1',
+    idcolumn='id',
+    parentcolumn='root'
+  );
+} {1 {self-referential closure table}}
+do_catchsql_test 8.2 {
+  SELECT id, depth FROM ct1 WHERE root=1 LIMIT 5;
+} {1 {no such table: ct1}}
+
 finish_test