From cee98b4ced6efc30f6f161d6b74acadff7e01c0e Mon Sep 17 00:00:00 2001
From: drh <>
Date: Sat, 29 Nov 2025 18:18:15 +0000
Subject: [PATCH] Handle empty string values in columnar modes without NULL
 pointer dereferences.

FossilOrigin-Name: 7927dbc5ebc76233325e45bd24181dbc5c3636e271f9352cf530f41dad6ba66d
---
 ext/qrf/qrf.c   |  8 ++++++--
 manifest        | 14 +++++++-------
 manifest.uuid   |  2 +-
 test/qrf01.test | 11 +++++++++++
 4 files changed, 25 insertions(+), 10 deletions(-)

diff --git a/ext/qrf/qrf.c b/ext/qrf/qrf.c
index 846f7652c5..172b56ee22 100644
--- a/ext/qrf/qrf.c
+++ b/ext/qrf/qrf.c
@@ -577,11 +577,14 @@ static int qrfDisplayLength(const char *zIn){
 ** it will need to be split.
 */
 static int qrfDisplayWidth(const char *zIn, sqlite3_int64 nByte, int *pnNL){
-  const unsigned char *z = (const unsigned char*)zIn;
-  const unsigned char *zEnd = &z[nByte];
+  const unsigned char *z;
+  const unsigned char *zEnd;
   int mx = 0;
   int n = 0;
   int nNL = 0;
+  if( zIn==0 ) zIn = "";
+  z = (const unsigned char*)zIn;
+  zEnd = &z[nByte];
   while( z<zEnd ){
     if( z[0]<' ' ){
       int k;
@@ -1934,6 +1937,7 @@ static void qrfColumnar(Qrf *p){
     */
     for(j=0; j<nColumn; j++){
       data.a[j].z = data.az[i+j];
+      if( data.a[j].z==0 ) data.a[j].z = "";
       data.a[j].bNum = data.abNum[i+j];
     }
     do{
diff --git a/manifest b/manifest
index 4adc8024a5..bd24be49c6 100644
--- a/manifest
+++ b/manifest
@@ -1,5 +1,5 @@
-C Fix\san\sassertion\sfault\sin\ssqlite3Dequote()\sthat\scan\soccur\swith\nALTER\sTABLE\sDROP\sCONSTRAINT\son\sa\scorrupt\sschema.\ndbsqlfuzz\s509a778e8a0c21a6448003feb773a1e55ed751e7.\s\sTest\scase\sin\sTH3.
-D 2025-11-29T12:06:12.932
+C Handle\sempty\sstring\svalues\sin\scolumnar\smodes\swithout\sNULL\spointer\ndereferences.
+D 2025-11-29T18:18:15.607
 F .fossil-settings/binary-glob 61195414528fb3ea9693577e1980230d78a1f8b0a54c78cf1b9b24d0a409ed6a x
 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
@@ -417,7 +417,7 @@ F ext/misc/windirent.h 02211ce51f3034c675f2dbf4d228194d51b3ee05734678bad5106fff6
 F ext/misc/zipfile.c 09e6e3a3ff40a99677de3c0bc6569bd5f4709b1844ac3d1c1452a456c5a62f1c
 F ext/misc/zorder.c bddff2e1b9661a90c95c2a9a9c7ecd8908afab5763256294dd12d609d4664eee
 F ext/qrf/README.md 86fc5c3c5e3eddbe54fc1235cbdc52b8c2c0732791d224345c3014cd45c4c0e7
-F ext/qrf/qrf.c 1e2d384f76cdc12f05ca9177116926d9f42eaf04ad8e44d16a7ca1e40fba45fd
+F ext/qrf/qrf.c 32b5e5a189dde20117210d385abae48e08b5f111f302a8803cffffb8f79a7cdb
 F ext/qrf/qrf.h 322d48537a5aa39c206c2ec0764a7938ea7662a8c25be1c4e9d742789609ba1e
 F ext/rbu/rbu.c 801450b24eaf14440d8fd20385aacc751d5c9d6123398df41b1b5aa804bf4ce8
 F ext/rbu/rbu1.test 25870dd7db7eb5597e2b4d6e29e7a7e095abf332660f67d89959552ce8f8f255
@@ -1510,7 +1510,7 @@ F test/printf2.test 3f55c1871a5a65507416076f6eb97e738d5210aeda7595a74ee895f2224c
 F test/progress.test ebab27f670bd0d4eb9d20d49cef96e68141d92fb
 F test/ptrchng.test ef1aa72d6cf35a2bbd0869a649b744e9d84977fc
 F test/pushdown.test 46a626ef1c0ca79b85296ff2e078b9da20a50e9b804b38f441590c3987580ddd
-F test/qrf01.test ee91b69592705d6b1a2e64968cdbff695bcb1eea5bf218a742e4b6dfcc1c4771
+F test/qrf01.test 48c86e90f606739e67b73937babb662ef0edf1ede06954489c588815fa17b560
 F test/qrf02.test 39b4afdc000bedccdafc0aecf17638df67a67aaa2d2942865ae6abcc48ba0e92
 F test/qrf03.test ad7fa339fb46b26b08625f3a77a4827bdee9f0dad402d8ddc1fcb8f05aa64a54
 F test/qrf04.test 0894692c998d2401dcc33449c02051b503ecce0c94217be54fb007c82d2d1379
@@ -2180,8 +2180,8 @@ F tool/version-info.c 33d0390ef484b3b1cb685d59362be891ea162123cea181cb8e6d2cf6dd
 F tool/warnings-clang.sh bbf6a1e685e534c92ec2bfba5b1745f34fb6f0bc2a362850723a9ee87c1b31a7
 F tool/warnings.sh d924598cf2f55a4ecbc2aeb055c10bd5f48114793e7ba25f9585435da29e7e98
 F tool/win/sqlite.vsix deb315d026cc8400325c5863eef847784a219a2f
-P 4384c9a108b58a0b8c38c51678aad871f088358b9bff3922299cc7ddb3d247ce
-R 7319a92f6ed0f94183ac2bcfe4bf386d
+P 2dc73eb2d215178c448b182ebb227bc4753ad7baf46c8bd58f20a2b22e998726
+R 6f3572511e9a44e28580898f1eb685ed
 U drh
-Z 43127c85d2631bbec7cc913abbee76ec
+Z 77357314f64ea8ae54c0fdf8979130c7
 # Remove this line to create a well-formed Fossil manifest.
diff --git a/manifest.uuid b/manifest.uuid
index c211e023f7..1586ea4fa7 100644
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-2dc73eb2d215178c448b182ebb227bc4753ad7baf46c8bd58f20a2b22e998726
+7927dbc5ebc76233325e45bd24181dbc5c3636e271f9352cf530f41dad6ba66d
diff --git a/test/qrf01.test b/test/qrf01.test
index 0896fa9032..635a5a26c9 100644
--- a/test/qrf01.test
+++ b/test/qrf01.test
@@ -1020,6 +1020,17 @@ do_test 11.1 {
 +------------------+
 }
 
+do_test 12.1 {
+  set result "\n[db format -style box -text html \
+                  {SELECT 'abc','','xyz'}]"
+} {
+┌───────┬────┬───────┐
+│ 'abc' │ '' │ 'xyz' │
+├───────┼────┼───────┤
+│ abc   │    │ xyz   │
+└───────┴────┴───────┘
+}
+
 db close
 
 finish_test
-- 
2.47.3