diff options
| author | dan <Dan Kennedy> | 2021-04-12 16:59:28 +0000 |
|---|---|---|
| committer | dan <Dan Kennedy> | 2021-04-12 16:59:28 +0000 |
| commit | d487e37367036387b92d47acd0b749bd36915b1f (patch) | |
| tree | 46cb416ecd479fac6b5b3ee1c7783b0abaf3fbec /src | |
| parent | ff37491874f609588c3974a5c6e154ba6b25efaa (diff) | |
| download | sqlite-d487e37367036387b92d47acd0b749bd36915b1f.tar.gz sqlite-d487e37367036387b92d47acd0b749bd36915b1f.zip | |
Fix a segfault that could occur if the ORDER BY clause of a compound SELECT contains a sub-select that uses one or more window functions.
FossilOrigin-Name: 5ba15ebb34c3af85ef6c54bbb3acb57176d629cda83774881b2a6467e138e904
Diffstat (limited to 'src')
| -rw-r--r-- | src/resolve.c | 4 | ||||
| -rw-r--r-- | src/sqliteInt.h | 1 |
2 files changed, 3 insertions, 2 deletions
diff --git a/src/resolve.c b/src/resolve.c index 09108e3de..c564b8175 100644 --- a/src/resolve.c +++ b/src/resolve.c @@ -1257,7 +1257,7 @@ static int resolveOrderByTermToExprList( nc.pParse = pParse; nc.pSrcList = pSelect->pSrc; nc.uNC.pEList = pEList; - nc.ncFlags = NC_AllowAgg|NC_UEList; + nc.ncFlags = NC_AllowAgg|NC_UEList|NC_NoSelect; nc.nNcErr = 0; db = pParse->db; savedSuppErr = db->suppressErr; @@ -1864,7 +1864,7 @@ int sqlite3ResolveExprNames( pNC->ncFlags &= ~(NC_HasAgg|NC_MinMaxAgg|NC_HasWin); w.pParse = pNC->pParse; w.xExprCallback = resolveExprStep; - w.xSelectCallback = resolveSelectStep; + w.xSelectCallback = (pNC->ncFlags & NC_NoSelect) ? 0 : resolveSelectStep; w.xSelectCallback2 = 0; w.u.pNC = pNC; #if SQLITE_MAX_EXPR_DEPTH>0 diff --git a/src/sqliteInt.h b/src/sqliteInt.h index c90f4cac5..f4944c2ed 100644 --- a/src/sqliteInt.h +++ b/src/sqliteInt.h @@ -3098,6 +3098,7 @@ struct NameContext { #define NC_IsDDL 0x10000 /* Resolving names in a CREATE statement */ #define NC_InAggFunc 0x20000 /* True if analyzing arguments to an agg func */ #define NC_FromDDL 0x40000 /* SQL text comes from sqlite_schema */ +#define NC_NoSelect 0x80000 /* Do not descend into sub-selects */ /* ** An instance of the following object describes a single ON CONFLICT |