Fix a segfault that could occur if an indexed expression was used in a

comparison operation within the result-set of a SELECT statement.

FossilOrigin-Name: d6bb7c42ff6309ce168ccdcf03b4cdabfccfc9e2a911d254ac7dc4fea4aa2bc1

4 files changed, 46 insertions, 10 deletions

diff --git a/manifest b/manifest
index 944af9d4e..9c3dec299 100644
--- a/manifest
+++ b/manifest
@@ -1,5 +1,5 @@
-C When\susing\san\sindex\son\san\sexpression,\stry\sto\suse\sthe\scolumns\sof\sthe\sindex\nrather\sthan\spulling\scolumns\sfrom\sthe\stable\sand\sreevaluating\sthe\sexpression.
-D 2017-04-11T01:30:42.675
+C Fix\sa\ssegfault\sthat\scould\soccur\sif\san\sindexed\sexpression\swas\sused\sin\sa\ncomparison\soperation\swithin\sthe\sresult-set\sof\sa\sSELECT\sstatement.
+D 2017-04-11T11:52:25.960
 F Makefile.in 1cc758ce3374a32425e4d130c2fe7b026b20de5b8843243de75f087c0a2661fb
 F Makefile.linux-gcc 7bc79876b875010e8c8f9502eb935ca92aa3c434
 F Makefile.msc a4c0613a18663bda56d8cf76079ab6590a7c3602e54befb4bbdef76bcaa38b6a
@@ -354,7 +354,7 @@ F src/ctime.c 47d91a25ad8f199a71a5b1b7b169d6dd0d6e98c5719eca801568798743d1161c
 F src/date.c ee676e7694dfadbdd2fde1a258a71be8360ba5ae
 F src/dbstat.c 19ee7a4e89979d4df8e44cfac7a8f905ec89b77d
 F src/delete.c 0d9d5549d42e79ce4d82ff1db1e6c81e36d2f67c
-F src/expr.c 8fd6b7bc10c2c33e017b0f2715efdc83c01e348be27797022ed9eaa3002ca720
+F src/expr.c f6572c7690fa619e85b1192b683ccc30cd123363415963c061ada3770b18f6a7
 F src/fault.c 460f3e55994363812d9d60844b2a6de88826e007
 F src/fkey.c 2e9aabe1aee76273aff8a84ee92c464e095400ae
 F src/func.c 9d52522cc8ae7f5cdadfe14594262f1618bc1f86083c4cd6da861b4cf5af6174
@@ -878,6 +878,7 @@ F test/index7.test 7feababe16f2091b229c22aff2bcc1d4d6b9d2bb
 F test/index8.test bc2e3db70e8e62459aaa1bd7e4a9b39664f8f9d7
 F test/indexedby.test 9c4cd331224e57f79fbf411ae245e6272d415985
 F test/indexexpr1.test 038b3befa74e5a75126b6e9dd2ae5df61c1c7cf7
+F test/indexexpr2.test bcf694ae72efaaeb97691b990b61e39bf233884e27b9cc6b845a1f0c6bc9f0bb
 F test/indexfault.test 31d4ab9a7d2f6e9616933eb079722362a883eb1d
 F test/init.test 15c823093fdabbf7b531fe22cf037134d09587a7
 F test/insert.test 38742b5e9601c8f8d76e9b7555f7270288c2d371
@@ -1570,8 +1571,7 @@ F vsixtest/vsixtest.tcl 6a9a6ab600c25a91a7acc6293828957a386a8a93
 F vsixtest/vsixtest.vcxproj.data 2ed517e100c66dc455b492e1a33350c1b20fbcdc
 F vsixtest/vsixtest.vcxproj.filters 37e51ffedcdb064aad6ff33b6148725226cd608e
 F vsixtest/vsixtest_TemporaryKey.pfx e5b1b036facdb453873e7084e1cae9102ccc67a0
-P e052436d9f54b785facd661adc648512356b831c0547aa8f347ebf4bd8ef1254 c59eaf2b7cd2596733f349fc0fe979f71fd29bd73152a0c57066e0b69d5b7a4a
-R 1b0a9c05391f59848f876fd33c1876bb
-T +closed c59eaf2b7cd2596733f349fc0fe979f71fd29bd73152a0c57066e0b69d5b7a4a
-U drh
-Z d8fc420323e8e66f4fe145abb4c72eca
+P a47efb7c8520a01110ce3b3531ebe1bab6720780d67fba001992c44c5807d332
+R 23a3a6c1f1b033d4a8710b18c262d91a
+U dan
+Z ab01f2cb6410fac9d35417473ab077a6
diff --git a/manifest.uuid b/manifest.uuid
index 5aefa9452..c52fa5cd8 100644
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-a47efb7c8520a01110ce3b3531ebe1bab6720780d67fba001992c44c5807d332
\ No newline at end of file
+d6bb7c42ff6309ce168ccdcf03b4cdabfccfc9e2a911d254ac7dc4fea4aa2bc1
\ No newline at end of file
diff --git a/src/expr.c b/src/expr.c
index afdbbb127..f3135ccaa 100644
--- a/src/expr.c
+++ b/src/expr.c
@@ -58,7 +58,7 @@ char sqlite3ExprAffinity(Expr *pExpr){
     return sqlite3AffinityType(pExpr->u.zToken, 0);
   }
 #endif
-  if( op==TK_AGG_COLUMN || op==TK_COLUMN ){
+  if( (op==TK_AGG_COLUMN || op==TK_COLUMN) && pExpr->pTab ){
     return sqlite3TableColumnAffinity(pExpr->pTab, pExpr->iColumn);
   }
   if( op==TK_SELECT_COLUMN ){
diff --git a/test/indexexpr2.test b/test/indexexpr2.test
new file mode 100644
index 000000000..140498b12
--- /dev/null
+++ b/test/indexexpr2.test
@@ -0,0 +1,36 @@
+# 2017 April 11
+#
+# The author disclaims copyright to this source code.  In place of
+# a legal notice, here is a blessing:
+#
+#    May you do good and not evil.
+#    May you find forgiveness for yourself and forgive others.
+#    May you share freely, never taking more than you give.
+#
+#***********************************************************************
+# This file implements regression tests for SQLite library.
+#
+
+set testdir [file dirname $argv0]
+source $testdir/tester.tcl
+set testprefix indexexpr2
+
+do_execsql_test 1 {
+  CREATE TABLE t1(a, b);
+  INSERT INTO t1 VALUES(1, 'one');
+  INSERT INTO t1 VALUES(2, 'two');
+  INSERT INTO t1 VALUES(3, 'three');
+
+  CREATE INDEX i1 ON t1(b || 'x');
+}
+
+do_execsql_test 1.1 {
+  SELECT 'TWOX' == (b || 'x') FROM t1 WHERE (b || 'x')>'onex'
+} {0 0}
+
+do_execsql_test 1.2 {
+  SELECT 'TWOX' == (b || 'x') COLLATE nocase  FROM t1 WHERE (b || 'x')>'onex'
+} {0 1}
+
+finish_test
+