From: dan <Dan Kennedy>
Date: Tue, 23 Jun 2026 20:12:17 +0000 (+0000)
Subject: Merge the fixes for the use-after-free problem caused by executing an ATTACH when... 
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=99a92ee66d80d519851015cf27def1c54e7a2037;p=thirdparty%2Fsqlite.git

Merge the fixes for the use-after-free problem caused by executing an ATTACH when a backup operation was active, and for the OOB read in the unused spellfix1 extension.

FossilOrigin-Name: e458ed9cc9d46dfdade3b4e99eb209d8aefd40a245e002d68df1813f9f99e2d7
---

99a92ee66d80d519851015cf27def1c54e7a2037
diff --cc manifest
index 0ebe804215,65f70de8e3..2c03820a42
--- a/manifest
+++ b/manifest
@@@ -1,5 -1,5 +1,5 @@@
- C Do\snot\sallow\sinternal-use-only\sfunctions\sto\sbe\scoded,\sanywhere,\sunless\ninside\sof\sa\snested\sparse\s(which\sis\sthe\scase\sfor\sALTER\sTABLE)\sor\sif\nthe\sappropriate\stest-control\sis\sactivated.\n[bugs:/info/2026-06-23T15:49:27Z|Bug\s2026-06-23T15:49:27Z].
- D 2026-06-23T19:08:18.383
 -C Fix\ssqlite3_backup_init()\sto\scorrectly\shandle\sthe\scase\swhere\sopening\sthe\stemp\sdatabase\sfails.
 -D 2026-06-23T19:46:48.852
++C Merge\sthe\sfixes\sfor\sthe\suse-after-free\sproblem\scaused\sby\sexecuting\san\sATTACH\swhen\sa\sbackup\soperation\swas\sactive,\sand\sfor\sthe\sOOB\sread\sin\sthe\sunused\sspellfix1\sextension.
++D 2026-06-23T20:12:17.985
  F .fossil-settings/binary-glob 61195414528fb3ea9693577e1980230d78a1f8b0a54c78cf1b9b24d0a409ed6a x
  F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
  F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
@@@ -674,7 -674,7 +674,7 @@@ F src/alter.c da59ac700b52ba5d0e4dd099f
  F src/analyze.c 73162482c656187823217f4c00758c9ee13a420c8745bc542129e0279b792287
  F src/attach.c c58278c7d2d954785591c4fde81669ec3e4d52f348c453b028a19ae8adf4f338
  F src/auth.c b5ece4e1edccad082c0332fa0087df225473bae0feea9269f824312201377185
- F src/backup.c 6ebe22ccbedfcb92423833992130e8d65824be4e6599c3a03f540ab38fc7d13c
 -F src/backup.c 16ef48ecec03cd5f657f434303a5e1d6023369274e68b641c0e693bfaa672c40
++F src/backup.c 2f5f350c714407a04fadc9c812b8fcbb47d472c543c492f9fc03043c94255406
  F src/bitvec.c e242d4496774dfc88fa278177dd23b607dce369ccafb3f61b41638eea2c9b399
  F src/btmutex.c 30dada73a819a1ef5b7583786370dce1842e12e1ad941e4d05ac29695528daea
  F src/btree.c 515cf62220ceb483ba9a31ebb3d7565ea9d63ffc3d61bb974b2815fef393df0e
@@@ -2208,8 -2208,8 +2208,8 @@@ F tool/warnings-clang.sh bbf6a1e685e534
  F tool/warnings.sh a554d13f6e5cf3760f041b87939e3d616ec6961859c3245e8ef701d1eafc2ca2
  F tool/win/sqlite.vsix deb315d026cc8400325c5863eef847784a219a2f
  F tool/winmain.c 00c8fb88e365c9017db14c73d3c78af62194d9644feaf60e220ab0f411f3604c
- P 8a535a36a90cf12b783469289a882d1313038d444b4a7f04e3495ae9bdec416d
- R bdcde85ab85e1f4afa8f626c7e398d47
- U drh
- Z 99855b74f04f71968ba1547588fd3439
 -P e58d5efc7b3387566661475e1a9afb6b94388a835cfb178999603135d57280fa
 -R df60cc2defed7e9cd1ad0e00165cde93
++P a145307e4d0b621c5493cecc7c826e8422cbd8dbc8cd9a042b8ec9e05d389eb6 c08bb97f399447be767ca2932858d88db5c1ba6ba29a68b1def23957206f9883
++R 8a4bcddd80eeb20a01677ea35c3f4e1e
+ U dan
 -Z c2c68d227570b5b89e22d4c92e5142dd
++Z e588bc6f748f638589bb041cdbd85aac
  # Remove this line to create a well-formed Fossil manifest.
diff --cc manifest.uuid
index 37513c06a4,9b3fb51fba..fc84490837
--- a/manifest.uuid
+++ b/manifest.uuid
@@@ -1,1 -1,1 +1,1 @@@
- a145307e4d0b621c5493cecc7c826e8422cbd8dbc8cd9a042b8ec9e05d389eb6
 -c08bb97f399447be767ca2932858d88db5c1ba6ba29a68b1def23957206f9883
++e458ed9cc9d46dfdade3b4e99eb209d8aefd40a245e002d68df1813f9f99e2d7
diff --cc src/backup.c
index 77c0959e2e,3b4375baf7..0a20ae4cf9
--- a/src/backup.c
+++ b/src/backup.c
@@@ -20,7 -20,7 +20,7 @@@
  */
  struct sqlite3_backup {
    sqlite3* pDestDb;        /* Destination database handle */
-   Db *pDest;               /* Destination db file */
 -  int iDest;
++  int iDest;               /* Destination db file */
    u32 iDestSchema;         /* Original schema cookie in destination */
    int bDestLocked;         /* True once a write-transaction is open on pDest */