Initialize all constants at the very beginning of a prepared statement.

Do not allow constant initialization to occur once control flow has a chance
to diverge, to avoid the possibility of having uninitialized registers.
Ticket [80ba201079ea60807].

FossilOrigin-Name: c5c53152d68218bb5e7f922271dd7c50da2361c1

1 files changed, 15 insertions, 1 deletions

diff --git a/src/expr.c b/src/expr.c
index a88208bd9..d2fa68250 100644
--- a/src/expr.c
+++ b/src/expr.c
@@ -1655,6 +1655,7 @@ int sqlite3CodeSubselect(
         sqlite3SelectDestInit(&dest, SRT_Set, pExpr->iTable);
         dest.affinity = (u8)affinity;
         assert( (pExpr->iTable&0x0000FFFF)==pExpr->iTable );
+        pExpr->x.pSelect->iLimit = 0;
         if( sqlite3Select(pParse, pExpr->x.pSelect, &dest) ){
           return 0;
         }
@@ -1755,6 +1756,7 @@ int sqlite3CodeSubselect(
       sqlite3ExprDelete(pParse->db, pSel->pLimit);
       pSel->pLimit = sqlite3PExpr(pParse, TK_INTEGER, 0, 0,
                                   &sqlite3IntTokens[1]);
+      pSel->iLimit = 0;
       if( sqlite3Select(pParse, pSel, &dest) ){
         return 0;
       }
@@ -3034,6 +3036,17 @@ static int evalConstExpr(Walker *pWalker, Expr *pExpr){
   return WRC_Continue;
 }
 
+/* This routine is part of the parse-tree walker for
+** sqlite3ExprCodeConstants().  Simply return WRC_Continue so that
+** tree walker logic will extend constant extraction and precoding
+** into subqueires.
+*/
+static int evalConstSelect(Walker *pNotUsed1, Select *pNotUsed2){
+  UNUSED_PARAMETER(pNotUsed1);
+  UNUSED_PARAMETER(pNotUsed2);
+  return WRC_Continue;
+}
+
 /*
 ** Preevaluate constant subexpressions within pExpr and store the
 ** results in registers.  Modify pExpr so that the constant subexpresions
@@ -3041,8 +3054,9 @@ static int evalConstExpr(Walker *pWalker, Expr *pExpr){
 */
 void sqlite3ExprCodeConstants(Parse *pParse, Expr *pExpr){
   Walker w;
+  if( pParse->cookieGoto ) return;
   w.xExprCallback = evalConstExpr;
-  w.xSelectCallback = 0;
+  w.xSelectCallback = evalConstSelect;
   w.pParse = pParse;
   sqlite3WalkExpr(&w, pExpr);
 }