From 478000cf5cece578f3347d6f5395b81e569bfd84 Mon Sep 17 00:00:00 2001
From: drh <drh@noemail.net>
Date: Tue, 3 Feb 2009 13:10:54 +0000
Subject: [PATCH] Check-in (6230) introduced a bugs in SUBSTR() which was
 caught by the fuzz tester.  Fixed by this check-in.  Related to ticket #3628.
 (CVS 6234)

FossilOrigin-Name: cd2e7f6c0fe4c0c648f8ca21388ab0769164f5ef
---
 manifest         | 14 +++++++-------
 manifest.uuid    |  2 +-
 src/func.c       |  3 ++-
 test/substr.test |  6 +++++-
 4 files changed, 15 insertions(+), 10 deletions(-)

diff --git a/manifest b/manifest
index 11d0c21fe4..c9b7484d52 100644
--- a/manifest
+++ b/manifest
@@ -1,5 +1,5 @@
-C Make\sgroup_concat()\sa\s1-\sor\s2-value\sfunction,\sas\sthe\sdocumentation\ssays\sit\nshould\sbe.\s\sUse\sthe\smd5sum()\sfunction\sto\sverify\sticket\s#3179,\snot\ngroup_concat().\s\sThis\sundoes\sthe\sill-advised\sgroup_concat()\schange\sof\ncheck-in\s(5233).\s(CVS\s6233)
-D 2009-02-02T21:57:05
+C Check-in\s(6230)\sintroduced\sa\sbugs\sin\sSUBSTR()\swhich\swas\scaught\sby\sthe\sfuzz\ntester.\s\sFixed\sby\sthis\scheck-in.\s\sRelated\sto\sticket\s#3628.\s(CVS\s6234)
+D 2009-02-03T13:10:54
 F Makefile.arm-wince-mingw32ce-gcc fcd5e9cd67fe88836360bb4f9ef4cb7f8e2fb5a0
 F Makefile.in 3871d308188cefcb7c5ab20da4c7b6aad023bc52
 F Makefile.linux-gcc d53183f4aa6a9192d249731c90dbdffbd2c68654
@@ -113,7 +113,7 @@ F src/date.c 870770dde3fb56772ab247dfb6a6eda44d16cfbc
 F src/delete.c 6249005bdd8f85db6ec5f31ddb5c07de023693cc
 F src/expr.c 76dc3dc83b56ab8db50a772714fac49def8bbf12
 F src/fault.c dc88c821842157460750d2d61a8a8b4197d047ff
-F src/func.c b4fe7d6b815044b0c1e8bcff15fa75da4a71b985
+F src/func.c e8f46d1a8c101dacf510727815b4797df4f7bb67
 F src/global.c ab003581ea4ff193cfe17a00e1303bc51db619a5
 F src/hash.c 5824e6ff7ba78cd34c8d6cd724367713583e5b55
 F src/hash.h 28f38ebb1006a5beedcb013bcdfe31befe7437ae
@@ -539,7 +539,7 @@ F test/speed4p.test 0e51908951677de5a969b723e03a27a1c45db38b
 F test/sqllimits1.test 2f7ca3c7e7cef39a9c499e941e98b7f1708c4780
 F test/subquery.test b524f57c9574b2c0347045b4510ef795d4686796
 F test/subselect.test d24fd8757daf97dafd2e889c73ea4c4272dcf4e4
-F test/substr.test c23b84173371337f6b847ef2ede100bdded0fbec
+F test/substr.test 18f57c4ca8a598805c4d64e304c418734d843c1a
 F test/sync.test ded6b39d8d8ca3c0c5518516c6371b3316d3e3a3
 F test/table.test 0aac9468b69d2683e68ee2682cdae28d82a453ec
 F test/tableapi.test 505031f15b18a750184d967d2c896cf88fcc969c
@@ -695,7 +695,7 @@ F tool/speedtest16.c c8a9c793df96db7e4933f0852abb7a03d48f2e81
 F tool/speedtest2.tcl ee2149167303ba8e95af97873c575c3e0fab58ff
 F tool/speedtest8.c 2902c46588c40b55661e471d7a86e4dd71a18224
 F tool/speedtest8inst1.c 293327bc76823f473684d589a8160bde1f52c14e
-P 3b0a25548c4c15c86aadcd9a6c3af0adafb85c17
-R 3185b236f21f6eee6b41aaeb070f332d
+P f2ae82c4d46c2eca30fc60a50ab5064728f20739
+R 6f877daa2e1aedc363217668df247f58
 U drh
-Z 44f9b42ab38c7b10fb63da33c391c0f2
+Z a83094c726be5d79bab4fb1c65a291b4
diff --git a/manifest.uuid b/manifest.uuid
index 4385199c0b..1c7697b4f4 100644
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-f2ae82c4d46c2eca30fc60a50ab5064728f20739
\ No newline at end of file
+cd2e7f6c0fe4c0c648f8ca21388ab0769164f5ef
\ No newline at end of file
diff --git a/src/func.c b/src/func.c
index 8f7f66a78b..d366112a88 100644
--- a/src/func.c
+++ b/src/func.c
@@ -16,7 +16,7 @@
 ** sqliteRegisterBuildinFunctions() found at the bottom of the file.
 ** All other code has file scope.
 **
-** $Id: func.c,v 1.218 2009/02/02 21:57:05 drh Exp $
+** $Id: func.c,v 1.219 2009/02/03 13:10:54 drh Exp $
 */
 #include "sqliteInt.h"
 #include <stdlib.h>
@@ -224,6 +224,7 @@ static void substrFunc(
   assert( p1>=0 && p2>=0 );
   if( p1+p2>len ){
     p2 = len-p1;
+    if( p2<0 ) p2 = 0;
   }
   if( p0type!=SQLITE_BLOB ){
     while( *z && p1 ){
diff --git a/test/substr.test b/test/substr.test
index 0a3303d92e..bcd0588d2d 100644
--- a/test/substr.test
+++ b/test/substr.test
@@ -11,7 +11,7 @@
 # This file implements regression tests for SQLite library.  The
 # focus of this file is testing the built-in SUBSTR() functions.
 #
-# $Id: substr.test,v 1.6 2009/02/02 16:32:55 drh Exp $
+# $Id: substr.test,v 1.7 2009/02/03 13:10:54 drh Exp $
 
 set testdir [file dirname $argv0]
 source $testdir/tester.tcl
@@ -78,6 +78,8 @@ substr-test 1.13 abcdefg 5 -5 abcd
 substr-test 1.14 abcdefg -5 -1 b
 substr-test 1.15 abcdefg -5 -2 ab
 substr-test 1.16 abcdefg -5 -3 ab
+substr-test 1.17 abcdefg 100 200 {}
+substr-test 1.18 abcdefg 200 100 {}
 
 # Make sure NULL is returned if any parameter is NULL
 #
@@ -118,6 +120,8 @@ subblob-test 3.7 61626364656667 -1 10 67
 subblob-test 3.8 61626364656667 -5 3 636465
 subblob-test 3.9 61626364656667 -7 3 616263
 subblob-test 3.10 61626364656667 -100 98 6162636465
+subblob-test 3.11 61626364656667 100 200 {}
+subblob-test 3.12 61626364656667 200 100 {}
 
 # If these blobs were strings, then they would contain multi-byte
 # characters.  But since they are blobs, the substr indices refer