processes the correct entry in the sqlite_master table even if there is
a second entry with the same name and table values due to database corruption
and the use of writable_schema=ON. Dbsqlfuzz find.
FossilOrigin-Name: 4dbb6e1cb094f3428c74ea8bdd86ab63341fecce978a062968ca01423f382e90
(or other expressions in the table definition) might not be fully resolved.
Ensure that the code generator can deal with this if the table is subsequently
used in a DML statement. dbsqlfuzz find.
FossilOrigin-Name: ea721b34477ab8b49d182352c4bc198245933b850e9b6248b4f97600e80bb44b
sequence for the generated column is non-standard.
Part 2 of ticket [e0a8120553f4b082]
FossilOrigin-Name: 056bb8dcbdc45989c5c6e86d2966200062e3c01c382ec52aae37c828104b4496
account the FILTER clause of aggregate functions. Problem reported by
Manuel Rigger.
FossilOrigin-Name: 3cc2b5709e66ef605c3b85ed13ae6cc9c3090e864ebc18859db36284b8f715b6
is seen in the tree. Report the problem immediately, without continuing.
FossilOrigin-Name: 01ca865f31c0c817ede7f357401ef76cf311ae662397908464f53e1c147f5b6b
in the sqlite3WindowRewrite() routine, make sure that pParse->nErr is set,
and make sure that this shuts down any subsequent code generation that might
depend on the transformations that were implemented. This fixes a problem
discovered by the Yongheng and Rui fuzzer.
FossilOrigin-Name: e2bddcd4c55ba3cbe0130332679ff4b048630d0ced9a8899982edb5a3569ba7f
the file being inserted is a NULL. Bug discovered by the
Yongheng and Rui fuzzer.
FossilOrigin-Name: a80f84b511231204658304226de3e075a55afc2e3f39ac063716f7a57f585c06
by disallowing query flattening if the outer query is DISTINCT. Without this fix,
if an index scan is run on the table within the view on the right-hand side of the
LEFT JOIN, stale result registers might be accessed yielding incorrect results,
and/or an OP_IfNullRow opcode might be invoked on the un-opened table, resulting
in a NULL-pointer dereference. This problem was found by the Yongheng and Rui fuzzer.
FossilOrigin-Name: 862974312edf00e9d1068115d1a39b7235b7db68b6d86b81d38a12f025a4748e
INSERT statement. The same assert() appears again in the VDBE and will fire
there if the problem persists in an SQL statement that does not contain
errors. Gramfuzz find.
FossilOrigin-Name: 9bdd57cb9ad8ac1f4a0f1a3942d94ca5193109eeb1975343c4f0c7abf7135946
definitions (see check-in [7e4809eadfe99ebf]) be sure to fully disable
the constant value to avoid an invalid pointer dereference if the expression
is ever duplicated. This fixes a crash report from Yongheng and Rui.
FossilOrigin-Name: 1ca0bd982ab1183bbafce0d260e4dceda5eb766ed2e7793374a88d1ae0bdd2ca
the semantics of a LEFT JOIN, make sure any generated columns on that row
evaluate to NULL. Ticket [3b84b42943644d6f]
FossilOrigin-Name: 0271491438ad2a985aeff355173a8d0f1e5813954c82147bc68cb26cca5804c8
of indexes for a table, even for weird cases where the same UNIQUE constraint
occurs twice with the ON CONFLICT REPLACE clause only on the second one. This
avoids an out-of-order contraint processing problem that can arise due
to the optimization of check-in [469a62ca33081854].
FossilOrigin-Name: 1e3918ca2f2c1cfcfa44249b1d7b847d52cbb8d302a8d4a335c090cfdf22d7a1
convert the expression to a simple NULL. This prevents additional pieces of
the expression tree that are allocated from lookaside from leaking into the
schema, where lookaside allocations are not allowed.
FossilOrigin-Name: a89b38605661e36d192df1d074383b704b34a959fcbc169837c0d4f6848f3208
contains extraneous bits, so change a testcase() into an assert() to show
as much.
FossilOrigin-Name: 5b4a88cd3b3a32b1242e0eb733cc0bc4becb830a887b8e6604a4c7452050e163
sqlite3ExprCodeGetColumn() if the opcode generated is not really an
OP_Column, which might happen if the column is virtual.
Fix for ticket [b439bfcfb7deedc6]
FossilOrigin-Name: 2401e04730a156aa48787b91af4e516406cb7635145e430be62fd16481816237
in the STD-C spec is technically UB. This is to fix a harmless UBSAN
complaint that OSSFuzz is hitting.
FossilOrigin-Name: c29fc21288e37f81a1617c5e2961c575d3bca6a1d1b013b2e0a99774afb1dcdb
notValid() function in resolve.c, for a performance improvement and size
reduction. Also cause failures to set the Expr node to a NULL operator so
that it does not cause problems later in case PRAGMA writable_schema=ON has
been set. Test cases in TH3.
FossilOrigin-Name: c6af9f655b73200ecc0c4189698e421af6ca584babdc76e73a36d468b2eea1f9
