From: drh <>
Date: Tue, 23 Jun 2026 11:16:22 +0000 (+0000)
Subject: Fix a NULL pointer dereference that can occur when misusing a extension
X-Git-Tag: release~21
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=703395c39e0c3c86728fd257b92efd85eee771e4;p=thirdparty%2Fsqlite.git

Fix a NULL pointer dereference that can occur when misusing a extension
virtual table that was created for testing purposes.

FossilOrigin-Name: ee4f5d82a3347863f2eb544c780d3efcc00bb43d7ea2495aaf21099f73cf800f
---

diff --git a/ext/misc/explain.c b/ext/misc/explain.c
index 132041882c..3083ccd39f 100644
--- a/ext/misc/explain.c
+++ b/ext/misc/explain.c
@@ -199,7 +199,7 @@ static int explainFilter(
   int rc;
   sqlite3_finalize(pCur->pExplain);
   pCur->pExplain = 0;
-  if( sqlite3_value_type(argv[0])!=SQLITE_TEXT ){
+  if( argc<=0 || sqlite3_value_type(argv[0])!=SQLITE_TEXT ){
     pCur->rc = SQLITE_DONE;
     return SQLITE_OK;
   }
diff --git a/manifest b/manifest
index 8d739b823f..b06fb5d1c3 100644
--- a/manifest
+++ b/manifest
@@ -1,5 +1,5 @@
-C Fixes\sfor\sthree\sseparate\sAI-discovered\sbugs\sin\snon-deliverable\sextensions.
-D 2026-06-23T10:56:26.976
+C Fix\sa\sNULL\spointer\sdereference\sthat\scan\soccur\swhen\smisusing\sa\sextension\nvirtual\stable\sthat\swas\screated\sfor\stesting\spurposes.
+D 2026-06-23T11:16:22.602
 F .fossil-settings/binary-glob 61195414528fb3ea9693577e1980230d78a1f8b0a54c78cf1b9b24d0a409ed6a x
 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
@@ -374,7 +374,7 @@ F ext/misc/csv.c 5e9d4dd749e762c144104c0f01db5bf4458735b19081ebe481a64e589a66687
 F ext/misc/dbdump.c 678f1b9ae2317b4473f65d03132a2482c3f4b08920799ed80feedd2941a06680
 F ext/misc/decimal.c f6770efd3cd4242932274e38bfc3e264308556d42fb909e1f50fed2cdb733ca0
 F ext/misc/eval.c 04bc9aada78c888394204b4ed996ab834b99726fb59603b0ee3ed6e049755dc1
-F ext/misc/explain.c 9670c8ff7b255eea7845abc5123a4958e74016c16990b10497e56380f91704b9
+F ext/misc/explain.c 04c9270fd8cf93a9bceb12d2f5f67e3f09a4e58b3e0efe14d24531444d2fffdf
 F ext/misc/fileio.c e72033f987894ed821bf324a426ed462743399c274f1290dcb646349b6d7548f
 F ext/misc/fossildelta.c 356682c1df24806ed186ded6998a71ba4db4945b707a457f0b8e7e7674cb20c9
 F ext/misc/fuzzer.c e916972f69ea1d275a33c5b72ab8cea0e68ae3871fafdc10260df9688140d3c5
@@ -1303,7 +1303,7 @@ F test/index9.test 2ac891806a4136ef3e91280477e23114e67575207dc331e6797fa0ed9379f
 F test/indexA.test 11d84f6995e6e5b9d8315953fb1b6d29772ee7c7803ee9112715e7e4dd3e4974
 F test/indexedby.test 444fb04ce0b21a3daf79f84e6735b49e5a5b3396623b37df5431eb09c8b8f557
 F test/indexexpr1.test d32dba192b8a566a81bb437ee8b6219931458e010c2d94610da775fa9d318f17
-F test/indexexpr2.test 1c382e81ef996d8ae8b834a74f2a9013dddf59214c32201d7c8a656d739f999a
+F test/indexexpr2.test 60b364492af311e931615fbece279fc463b281fc1ecfced762b0d33053c82f3f
 F test/indexexpr3.test 47b91bc7999805c9a34d356f672259bc49295ecc797448511cae554a309b47cd
 F test/indexfault.test 98d78a8ff1f5335628b62f886a1cb7c7dac1ef6d48fa39c51ec871c87dce9811
 F test/init.test 15c823093fdabbf7b531fe22cf037134d09587a7
@@ -2200,11 +2200,9 @@ F tool/warnings-clang.sh bbf6a1e685e534c92ec2bfba5b1745f34fb6f0bc2a362850723a9ee
 F tool/warnings.sh a554d13f6e5cf3760f041b87939e3d616ec6961859c3245e8ef701d1eafc2ca2
 F tool/win/sqlite.vsix deb315d026cc8400325c5863eef847784a219a2f
 F tool/winmain.c 00c8fb88e365c9017db14c73d3c78af62194d9644feaf60e220ab0f411f3604c
-P 4c773f5d64246c7c47a569218215787ba2104bc2966c4bbd8907b936e396f6ea
-Q +21b2692c8363f2c0629beef4860400a1d27f499a3f27745c23391bcfa09da898
-Q +410045796b4486fc2d301e661bf9fce3ca3a1ba61c72fe5d6c5d59a330443dd5
-Q +6ede22e13f8e85c1a341c9a80a3be2f2677baee897c659af4ca43a04698e29a5
-R bbb0ee12fb996048323fe52ed267765d
+P c980094956a348423469015952455a97df3ca08709338aa03ea8bbb418e8af24
+Q +256d5cd478b83b1371ce24c9702f732cddb4dd4e06c238fc1a1b853b02ffc1f1
+R 8458221b28f7b4b2f37b79770002c27c
 U drh
-Z af16eb528dbe504918ec7c0d80ed28d9
+Z c4bccc1aa169b382a862f5b56f2b4045
 # Remove this line to create a well-formed Fossil manifest.
diff --git a/manifest.uuid b/manifest.uuid
index 0b221f58d4..55e505f5ce 100644
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-c980094956a348423469015952455a97df3ca08709338aa03ea8bbb418e8af24
+ee4f5d82a3347863f2eb544c780d3efcc00bb43d7ea2495aaf21099f73cf800f
diff --git a/test/indexexpr2.test b/test/indexexpr2.test
index 4c21421e8e..5b0ea199b9 100644
--- a/test/indexexpr2.test
+++ b/test/indexexpr2.test
@@ -229,6 +229,14 @@ ifcapable vtab {
        AND sqlite_master.rootpage=explain.p2
      ORDER BY 1;
   } {t2 t2abc t2cd t2def}
+
+  # Bug 2026-06-23T05:32:49Z
+  #
+  unset -nocomplain ::abc
+  set ::abc 0
+  do_catchsql_test 4.900 {
+    SELECT * FROM explain WHERE rowid = $abc
+  } {0 {}}
 }
 
 #-------------------------------------------------------------------------