Fossil SCM

Cherry-pick [http://www.sqlite.org/src/info/ac760db0727209db|ac760db072] from SQLite: Fix a use-after-free problem in the shell tool code that could occur if an SQL statement were executed after an ".open" command with invalid options.

jan.nijtmans 2017-03-02 16:20 trunk
Commit 69b9b9563fd471936d8591fd2f7e79b3e4abe497
Parent 8a76861556c3ee1…
1 file changed +4 -3
~ src/shell.c
M src/shell.c
+4 -3
--- src/shell.c
+++ src/shell.c
@@ -2210,11 +2210,11 @@
22102210
 " csv Comma-separated values\n"
22112211
 " column Left-aligned columns. (See .width)\n"
22122212
 " html HTML <table> code\n"
22132213
 " insert SQL insert statements for TABLE\n"
22142214
 " line One value per line\n"
2215
- " list Values delimited by .separator strings\n"
2215
+ " list Values delimited by \"|\"\n"
22162216
 " quote Escape answers as for SQL\n"
22172217
 " tabs Tab-separated values\n"
22182218
 " tcl TCL list elements\n"
22192219
 ".nullvalue STRING Use STRING in place of NULL values\n"
22202220
 ".once FILENAME Output for the next SQL command only to FILENAME\n"
@@ -4342,10 +4342,11 @@
43424342
 int newFlag = 0; /* True to delete file before opening */
43434343
 /* Close the existing database */
43444344
 session_close_all(p);
43454345
 sqlite3_close(p->db);
43464346
 p->db = 0;
4347
+ p->zDbFilename = 0;
43474348
 sqlite3_free(p->zFreeOnClose);
43484349
 p->zFreeOnClose = 0;
43494350
 /* Check for command-line arguments */
43504351
 for(iName=1; iName<nArg && azArg[iName][0]=='-'; iName++){
43514352
 const char *z = azArg[iName];
@@ -4612,11 +4613,11 @@
46124613
 }
46134614
 }else
46144615
46154616
 #if defined(SQLITE_DEBUG) && defined(SQLITE_ENABLE_SELECTTRACE)
46164617
 if( c=='s' && n==11 && strncmp(azArg[0], "selecttrace", n)==0 ){
4617
- sqlite3SelectTrace = integerValue(azArg[1]);
4618
+ sqlite3SelectTrace = (int)integerValue(azArg[1]);
46184619
 }else
46194620
 #endif
46204621
46214622
 #if defined(SQLITE_ENABLE_SESSION)
46224623
 if( c=='s' && strncmp(azArg[0],"session",n)==0 && n>=3 ){
@@ -5190,10 +5191,11 @@
51905191
 azArg[1]);
51915192
 break;
51925193
 }
51935194
 }
51945195
 }else
5196
+#endif /* !defined(SQLITE_UNTESTABLE) */
51955197
51965198
 if( c=='t' && n>4 && strncmp(azArg[0], "timeout", n)==0 ){
51975199
 open_db(p, 0);
51985200
 sqlite3_busy_timeout(p->db, nArg>=2 ? (int)integerValue(azArg[1]) : 0);
51995201
 }else
@@ -5226,11 +5228,10 @@
52265228
 }else{
52275229
 sqlite3_trace_v2(p->db, SQLITE_TRACE_STMT, sql_trace_callback,p->traceOut);
52285230
 }
52295231
 #endif
52305232
 }else
5231
-#endif /* !defined(SQLITE_UNTESTABLE) */
52325233
52335234
 #if SQLITE_USER_AUTHENTICATION
52345235
 if( c=='u' && strncmp(azArg[0], "user", n)==0 ){
52355236
 if( nArg<2 ){
52365237
 raw_printf(stderr, "Usage: .user SUBCOMMAND ...\n");
52375238
--- src/shell.c
+++ src/shell.c
@@ -2210,11 +2210,11 @@
2210 " csv Comma-separated values\n"
2211 " column Left-aligned columns. (See .width)\n"
2212 " html HTML <table> code\n"
2213 " insert SQL insert statements for TABLE\n"
2214 " line One value per line\n"
2215 " list Values delimited by .separator strings\n"
2216 " quote Escape answers as for SQL\n"
2217 " tabs Tab-separated values\n"
2218 " tcl TCL list elements\n"
2219 ".nullvalue STRING Use STRING in place of NULL values\n"
2220 ".once FILENAME Output for the next SQL command only to FILENAME\n"
@@ -4342,10 +4342,11 @@
4342 int newFlag = 0; /* True to delete file before opening */
4343 /* Close the existing database */
4344 session_close_all(p);
4345 sqlite3_close(p->db);
4346 p->db = 0;
 
4347 sqlite3_free(p->zFreeOnClose);
4348 p->zFreeOnClose = 0;
4349 /* Check for command-line arguments */
4350 for(iName=1; iName<nArg && azArg[iName][0]=='-'; iName++){
4351 const char *z = azArg[iName];
@@ -4612,11 +4613,11 @@
4612 }
4613 }else
4614
4615 #if defined(SQLITE_DEBUG) && defined(SQLITE_ENABLE_SELECTTRACE)
4616 if( c=='s' && n==11 && strncmp(azArg[0], "selecttrace", n)==0 ){
4617 sqlite3SelectTrace = integerValue(azArg[1]);
4618 }else
4619 #endif
4620
4621 #if defined(SQLITE_ENABLE_SESSION)
4622 if( c=='s' && strncmp(azArg[0],"session",n)==0 && n>=3 ){
@@ -5190,10 +5191,11 @@
5190 azArg[1]);
5191 break;
5192 }
5193 }
5194 }else
 
5195
5196 if( c=='t' && n>4 && strncmp(azArg[0], "timeout", n)==0 ){
5197 open_db(p, 0);
5198 sqlite3_busy_timeout(p->db, nArg>=2 ? (int)integerValue(azArg[1]) : 0);
5199 }else
@@ -5226,11 +5228,10 @@
5226 }else{
5227 sqlite3_trace_v2(p->db, SQLITE_TRACE_STMT, sql_trace_callback,p->traceOut);
5228 }
5229 #endif
5230 }else
5231 #endif /* !defined(SQLITE_UNTESTABLE) */
5232
5233 #if SQLITE_USER_AUTHENTICATION
5234 if( c=='u' && strncmp(azArg[0], "user", n)==0 ){
5235 if( nArg<2 ){
5236 raw_printf(stderr, "Usage: .user SUBCOMMAND ...\n");
5237
--- src/shell.c
+++ src/shell.c
@@ -2210,11 +2210,11 @@
2210 " csv Comma-separated values\n"
2211 " column Left-aligned columns. (See .width)\n"
2212 " html HTML <table> code\n"
2213 " insert SQL insert statements for TABLE\n"
2214 " line One value per line\n"
2215 " list Values delimited by \"|\"\n"
2216 " quote Escape answers as for SQL\n"
2217 " tabs Tab-separated values\n"
2218 " tcl TCL list elements\n"
2219 ".nullvalue STRING Use STRING in place of NULL values\n"
2220 ".once FILENAME Output for the next SQL command only to FILENAME\n"
@@ -4342,10 +4342,11 @@
4342 int newFlag = 0; /* True to delete file before opening */
4343 /* Close the existing database */
4344 session_close_all(p);
4345 sqlite3_close(p->db);
4346 p->db = 0;
4347 p->zDbFilename = 0;
4348 sqlite3_free(p->zFreeOnClose);
4349 p->zFreeOnClose = 0;
4350 /* Check for command-line arguments */
4351 for(iName=1; iName<nArg && azArg[iName][0]=='-'; iName++){
4352 const char *z = azArg[iName];
@@ -4612,11 +4613,11 @@
4613 }
4614 }else
4615
4616 #if defined(SQLITE_DEBUG) && defined(SQLITE_ENABLE_SELECTTRACE)
4617 if( c=='s' && n==11 && strncmp(azArg[0], "selecttrace", n)==0 ){
4618 sqlite3SelectTrace = (int)integerValue(azArg[1]);
4619 }else
4620 #endif
4621
4622 #if defined(SQLITE_ENABLE_SESSION)
4623 if( c=='s' && strncmp(azArg[0],"session",n)==0 && n>=3 ){
@@ -5190,10 +5191,11 @@
5191 azArg[1]);
5192 break;
5193 }
5194 }
5195 }else
5196 #endif /* !defined(SQLITE_UNTESTABLE) */
5197
5198 if( c=='t' && n>4 && strncmp(azArg[0], "timeout", n)==0 ){
5199 open_db(p, 0);
5200 sqlite3_busy_timeout(p->db, nArg>=2 ? (int)integerValue(azArg[1]) : 0);
5201 }else
@@ -5226,11 +5228,10 @@
5228 }else{
5229 sqlite3_trace_v2(p->db, SQLITE_TRACE_STMT, sql_trace_callback,p->traceOut);
5230 }
5231 #endif
5232 }else
 
5233
5234 #if SQLITE_USER_AUTHENTICATION
5235 if( c=='u' && strncmp(azArg[0], "user", n)==0 ){
5236 if( nArg<2 ){
5237 raw_printf(stderr, "Usage: .user SUBCOMMAND ...\n");
5238

Keyboard Shortcuts

Open search /
Next entry (timeline) j
Previous entry (timeline) k
Open focused entry Enter
Show this help ?
Toggle theme Top nav button