From: dan <Dan Kennedy>
Date: Wed, 29 Jul 2026 19:17:40 +0000 (+0000)
Subject: Avoid assuming that cursor numbers were allocated in order for all SrcList objects... 
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=817458fe70c78aa45116d56cf9b3416f312ea7bc;p=thirdparty%2Fsqlite.git

Avoid assuming that cursor numbers were allocated in order for all SrcList objects when detecting ON clauses that refer to tables to their right. Possible fix for [bugs:/info/2026-07-29T17:50:40Z | 2026-07-29T17:50:40Z].

FossilOrigin-Name: ebfea8cfb03e0578364bb1f5f8f44c55127f2155d9a0999865a811098f69e9f4
---

diff --git a/manifest b/manifest
index 80bafe69b4..fd61140c0a 100644
--- a/manifest
+++ b/manifest
@@ -1,5 +1,5 @@
-C Return\san\sempty\sstring\sif\san\sfts3\ssnippet()\sis\srequested\sfor\san\sout-of-range\scolumn\sindex.\sBug\s[bugs:/info/2026-07-29T06:30:35Z\s|\s2026-07-29T06:30:35Z].
-D 2026-07-29T16:55:36.511
+C Avoid\sassuming\sthat\scursor\snumbers\swere\sallocated\sin\sorder\sfor\sall\sSrcList\sobjects\swhen\sdetecting\sON\sclauses\sthat\srefer\sto\stables\sto\stheir\sright.\sPossible\sfix\sfor\s[bugs:/info/2026-07-29T17:50:40Z\s|\s2026-07-29T17:50:40Z].
+D 2026-07-29T19:17:40.185
 F .fossil-settings/binary-glob 61195414528fb3ea9693577e1980230d78a1f8b0a54c78cf1b9b24d0a409ed6a x
 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
@@ -742,7 +742,7 @@ F src/printf.c b480176bd0aaed9d64e804cfa3ca27fc585f65a73e7c7ca2fe9b9016db2cf6d5
 F src/random.c 606b00941a1d7dd09c381d3279a058d771f406c5213c9932bbd93d5587be4b9c
 F src/resolve.c 7145e41ad75e04a811b326aa5faf83c2e071480fabd9fc825055a6b889e6cb86
 F src/rowset.c 8432130e6c344b3401a8874c3cb49fefe6873fec593294de077afea2dce5ec97
-F src/select.c 6e3ee525a82bb1800b0b464bc6ed5532e97e484eec336004ab1842cb298be61c
+F src/select.c ab057deee79badfb48e1ed7c2181b81be93b030627fdbc7e90c690afbc39fe50
 F src/shell.c.in 773fc57916edeacef3f314e4dc285f250e17086284cc7a2d382d01f06f160084
 F src/sqlite.h.in 2101a2b494cbc282d0dc1c3f631c4fb83060c52876cc9d7615b091ad66d932b1
 F src/sqlite3.rc 015537e6ac1eec6c7050e17b616c2ffe6f70fca241835a84a4f0d5937383c479
@@ -2105,7 +2105,7 @@ F test/with1.test c416097db4ead936b98a76ff3069f76a6009c5aaec5ff2b2c5ca210bc595ad
 F test/with2.test 181674a6cc86a601ca2ac052741cdfad5b529e07e870435d2f6cdb92d589ff17
 F test/with3.test e30369ea27aa27eb1bda4c5e510c8a9f782c8afd2ab99d1a02b8a7f25a5d3e65
 F test/with4.test 257be66c0c67fee1defbbac0f685c3465e2cad037f21ce65f23f86084f198205
-F test/with5.test 0e5e141fee75aa170289467542a2ffd71933d4fb006bfb135275b1787bdc8fbe
+F test/with5.test d7552ca90d20fc168d77029a1ea34e5214952e7f4dc1402dd1da4ebc7df768a7
 F test/with6.test 281e4861b5e517f6c3c2f08517a520c1e2ee7c11966545d3901f258a4fe8ef76
 F test/withM.test 693b61765f2b387b5e3e24a4536e2e82de15ff64
 F test/without_rowid1.test f6e75e32821eb423ac3812434d12bdd8098f17e3b2206da61575e1db77f82428
@@ -2218,8 +2218,11 @@ F tool/warnings-clang.sh bbf6a1e685e534c92ec2bfba5b1745f34fb6f0bc2a362850723a9ee
 F tool/warnings.sh a554d13f6e5cf3760f041b87939e3d616ec6961859c3245e8ef701d1eafc2ca2
 F tool/win/sqlite.vsix deb315d026cc8400325c5863eef847784a219a2f
 F tool/winmain.c 00c8fb88e365c9017db14c73d3c78af62194d9644feaf60e220ab0f411f3604c
-P 8d626b31ae058de1eebb50d9b6e777318bd9d3a4c75e9f5ada4faba88a1e0188
-R d2dfac96739eeb8afbd1a65c9ac3bd93
+P 5c645d5e241f6055c8dd45936a52245ecb2476a6603e06b793912bf897e42239
+R 894c91486b33001a9fd13d6bf48a7379
+T *branch * bug-2026-07-29T17:50:40Z
+T *sym-bug-2026-07-29T17:50:40Z *
+T -sym-trunk *
 U dan
-Z 0a7132d17118bfa7812fb5bfe1401ece
+Z 5cc8db10fc8e51668dc6e669ab9534bf
 # Remove this line to create a well-formed Fossil manifest.
diff --git a/manifest.tags b/manifest.tags
index bec971799f..f9540e467d 100644
--- a/manifest.tags
+++ b/manifest.tags
@@ -1,2 +1,2 @@
-branch trunk
-tag trunk
+branch bug-2026-07-29T17:50:40Z
+tag bug-2026-07-29T17:50:40Z
diff --git a/manifest.uuid b/manifest.uuid
index bbfe4fafd7..289bd59f84 100644
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-5c645d5e241f6055c8dd45936a52245ecb2476a6603e06b793912bf897e42239
+ebfea8cfb03e0578364bb1f5f8f44c55127f2155d9a0999865a811098f69e9f4
diff --git a/src/select.c b/src/select.c
index 364da8b798..d0e44bd1c7 100644
--- a/src/select.c
+++ b/src/select.c
@@ -7492,12 +7492,17 @@ static int selectCheckOnClausesExpr(Walker *pWalker, Expr *pExpr){
       int ii;
       for(ii=0; ii<nSrc && pSrc->a[ii].iCursor!=iTab; ii++){}
       if( ii<nSrc ){
-        if( pCtx->iJoin && iTab>pCtx->iJoin ){
-          sqlite3ErrorMsg(pWalker->pParse, 
-              "%s references tables to its right",
-              (pCtx->bFuncArg ? "table-function argument" : "ON clause")
-          );
-          return WRC_Abort;
+        if( pCtx->iJoin ){
+          for(ii--; ii>=0 && pSrc->a[ii].iCursor!=pCtx->iJoin; ii--){}
+          if( ii>=0 ){
+            /* Table iJoin appears to the left of table iTab in the SrcList.
+            ** Therefore the expression refers to a table to its right. */
+            sqlite3ErrorMsg(pWalker->pParse, 
+                "%s references tables to its right",
+                (pCtx->bFuncArg ? "table-function argument" : "ON clause")
+            );
+            return WRC_Abort;
+          }
         }
         break;
       }
diff --git a/test/with5.test b/test/with5.test
index d5c89efcf3..27bf28f0ea 100644
--- a/test/with5.test
+++ b/test/with5.test
@@ -212,4 +212,19 @@ do_execsql_test 310 {
   SELECT * FROM tt ORDER BY ii;
 } {1 2 3}
 
+#-------------------------------------------------------------------------
+reset_db
+do_execsql_test 400 {
+  CREATE TABLE t(a);
+}
+
+do_execsql_test 410 {
+  WITH RECURSIVE c(x) AS (
+      SELECT 1
+      UNION ALL
+      SELECT c.x + 1 FROM t LEFT JOIN c ON t.a = 5 WHERE c.x < 3
+  )
+  SELECT * FROM c;
+} {1}
+
 finish_test