diff options
| author | dan <Dan Kennedy> | 2021-07-07 15:52:44 +0000 |
|---|---|---|
| committer | dan <Dan Kennedy> | 2021-07-07 15:52:44 +0000 |
| commit | 2931a66ecebd60277efe019b920e0e1e96721aee (patch) | |
| tree | c6756f0c8baf959e95e6512641a8defc703854b9 /src/expr.c | |
| parent | 74777f994d5735e0fb3020ef24f3d0229cdc7ca2 (diff) | |
| download | sqlite-2931a66ecebd60277efe019b920e0e1e96721aee.tar.gz sqlite-2931a66ecebd60277efe019b920e0e1e96721aee.zip | |
Fix a recently introduced segfault that might occur if a sub-select were used as a term on the RHS of an IN(...) operator for which the LHS is a row-value.
FossilOrigin-Name: f586c06a5d03943db32add4d3d058a5aa09c819870b29cd8b54cf69433a8cdb1
Diffstat (limited to 'src/expr.c')
| -rw-r--r-- | src/expr.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/src/expr.c b/src/expr.c index 44abb58e5..4ad1902d2 100644 --- a/src/expr.c +++ b/src/expr.c @@ -967,10 +967,11 @@ void sqlite3PExprAddSelect(Parse *pParse, Expr *pExpr, Select *pSelect){ Select *sqlite3ExprListToValues(Parse *pParse, int nElem, ExprList *pEList){ int ii; Select *pRet = 0; + assert( nElem>1 ); for(ii=0; ii<pEList->nExpr; ii++){ Select *pSel; Expr *pExpr = pEList->a[ii].pExpr; - int nExprElem = sqlite3ExprVectorSize(pExpr); + int nExprElem = (pExpr->op==TK_VECTOR ? pExpr->x.pList->nExpr : 1); if( nExprElem!=nElem ){ sqlite3ErrorMsg(pParse, "IN(...) element has %d term%s - expected %d", nExprElem, nExprElem>1?"s":"", nElem |