diff options
| author | dan <Dan Kennedy> | 2024-07-20 16:11:12 +0000 |
|---|---|---|
| committer | dan <Dan Kennedy> | 2024-07-20 16:11:12 +0000 |
| commit | aecfb0a3b34894ddf9bc7411b89cc749f000d0b5 (patch) | |
| tree | 242f0019dda461bd55f3f1b425e4f0329ef28d77 /src | |
| parent | f73912694bd1671a664e3455524fc2821681c920 (diff) | |
| download | sqlite-aecfb0a3b34894ddf9bc7411b89cc749f000d0b5.tar.gz sqlite-aecfb0a3b34894ddf9bc7411b89cc749f000d0b5.zip | |
Fix an oversized allocation in sqlite3ExprCodeIN().
FossilOrigin-Name: d7be326a80e7b3aa8fd6e5e059c04e6ad3feaffcb20b1e3c251d7195ddc1be8b
Diffstat (limited to 'src')
| -rw-r--r-- | src/expr.c | 4 |
1 files changed, 1 insertions, 3 deletions
diff --git a/src/expr.c b/src/expr.c index b9310fb39..53b0170ab 100644 --- a/src/expr.c +++ b/src/expr.c @@ -3927,9 +3927,7 @@ static void sqlite3ExprCodeIN( if( sqlite3ExprCheckIN(pParse, pExpr) ) return; zAff = exprINAffinity(pParse, pExpr); nVector = sqlite3ExprVectorSize(pExpr->pLeft); - aiMap = (int*)sqlite3DbMallocZero( - pParse->db, nVector*(sizeof(int) + sizeof(char)) + 1 - ); + aiMap = (int*)sqlite3DbMallocZero(pParse->db, nVector*sizeof(int)); if( pParse->db->mallocFailed ) goto sqlite3ExprCodeIN_oom_error; /* Attempt to compute the RHS. After this step, if anything other than |