Fix an out-of-bounds array reference in the generated column logic.

Problem discovered by valgrind.

FossilOrigin-Name: a0ab42f779b9a96f4e43879210dfaba8fa593de77fc0ec0e2e6f116d9301ea59

1 files changed, 3 insertions, 2 deletions

diff --git a/src/insert.c b/src/insert.c
index 73f6bdb3e..482a2aff7 100644
--- a/src/insert.c
+++ b/src/insert.c
@@ -202,10 +202,11 @@ static int readsTable(Parse *p, int iDb, Table *pTab){
 }
 
 /* This walker callback will compute the union of colFlags flags for all
-** references columns in a CHECK constraint or generated column expression.
+** referenced columns in a CHECK constraint or generated column expression.
 */
 static int exprColumnFlagUnion(Walker *pWalker, Expr *pExpr){
-  if( pExpr->op==TK_COLUMN ){
+  if( pExpr->op==TK_COLUMN && pExpr->iColumn>=0 ){
+    assert( pExpr->iColumn < pWalker->u.pTab->nCol );
     pWalker->eCode |= pWalker->u.pTab->aCol[pExpr->iColumn].colFlags;
   }
   return WRC_Continue;