blob: 1838d06957cd36e0e4f6ec036cf4c306c56ba0db [file] [log] [blame]
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Darwin Huang <huangdarwin@chromium.org>
Date: Wed, 1 May 2019 14:47:06 -0700
Subject: [PATCH 2/8] Fix use-after-free xDestroy error
This backports https://www.sqlite.org/src/info/1dbbb0101e8213b9
Bug: https://crbug.com/956851
---
third_party/sqlite/patched/src/vtab.c | 2 +
.../sqlite/patched/test/fts4rename.test | 43 +++++++++++++++++++
2 files changed, 45 insertions(+)
create mode 100644 third_party/sqlite/patched/test/fts4rename.test
diff --git a/third_party/sqlite/patched/src/vtab.c b/third_party/sqlite/patched/src/vtab.c
index 34ee6c5554e9..a25c06653666 100644
--- a/third_party/sqlite/patched/src/vtab.c
+++ b/third_party/sqlite/patched/src/vtab.c
@@ -841,6 +841,7 @@ int sqlite3VtabCallDestroy(sqlite3 *db, int iDb, const char *zTab){
p = vtabDisconnectAll(db, pTab);
xDestroy = p->pMod->pModule->xDestroy;
assert( xDestroy!=0 ); /* Checked before the virtual table is created */
+ pTab->nTabRef++;
rc = xDestroy(p->pVtab);
/* Remove the sqlite3_vtab* from the aVTrans[] array, if applicable */
if( rc==SQLITE_OK ){
@@ -849,6 +850,7 @@ int sqlite3VtabCallDestroy(sqlite3 *db, int iDb, const char *zTab){
pTab->pVTable = 0;
sqlite3VtabUnlock(p);
}
+ sqlite3DeleteTable(db, pTab);
}
return rc;
diff --git a/third_party/sqlite/patched/test/fts4rename.test b/third_party/sqlite/patched/test/fts4rename.test
new file mode 100644
index 000000000000..289ede9bfe73
--- /dev/null
+++ b/third_party/sqlite/patched/test/fts4rename.test
@@ -0,0 +1,43 @@
+ 2019 April 30
+#
+# The author disclaims copyright to this source code. In place of
+# a legal notice, here is a blessing:
+#
+# May you do good and not evil.
+# May you find forgiveness for yourself and forgive others.
+# May you share freely, never taking more than you give.
+#
+#*************************************************************************
+#
+
+set testdir [file dirname $argv0]
+source $testdir/tester.tcl
+source $testdir/fts3_common.tcl
+set ::testprefix fts4rename
+
+# If SQLITE_ENABLE_FTS3 is defined, omit this file.
+ifcapable !fts3 {
+ finish_test
+ return
+}
+
+do_execsql_test 1.0 {
+ CREATE VIRTUAL TABLE temp.t1 USING fts3(a);
+ BEGIN;
+ CREATE TABLE t2(x);
+} {}
+
+do_catchsql_test 1.1 {
+ ALTER TABLE t1_content RENAME c0a TO docid;
+} {1 {duplicate column name: docid}}
+
+do_catchsql_test 1.2 {
+ UPDATE t1 SET Col0 = 1 ;
+} {1 {no such column: Col0}}
+
+do_catchsql_test 1.3 {
+ ROLLBACK;
+ DROP TABLE t1;
+} {0 {}}
+
+finish_test
--
2.21.0