Fix an issue where malloc could be used to fulfill a small allocation when a large lookaside slot could have beeen used instead.

FossilOrigin-Name: 611020e3378f4c81c277cccd84807ae51a816bbab6c3d887c91c5e5af3b5225f

3 files changed, 13 insertions, 10 deletions

diff --git a/manifest b/manifest
index d0515a9c8..5f8fb620c 100644
--- a/manifest
+++ b/manifest
@@ -1,5 +1,5 @@
-C Change\sthe\sname\sof\sthe\sExpr.a.zName\sfield\sto\szEName,\sso\sthat\sit\shas\sa\sname\nthat\sis\sdistinct\sfrom\sother\sfields\sand\svariables\sand\sis\shence\seasier\sto\ngrep\sfor.
-D 2019-12-12T20:22:34.557
+C Fix\san\sissue\swhere\smalloc\scould\sbe\sused\sto\sfulfill\sa\ssmall\sallocation\swhen\sa\slarge\slookaside\sslot\scould\shave\sbeeen\sused\sinstead.
+D 2019-12-12T20:39:47.705
 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
 F LICENSE.md df5091916dbb40e6e9686186587125e1b2ff51f022cc334e886c19a0e9982724
@@ -492,7 +492,7 @@ F src/insert.c 276463aa7a26ee73958b9f4bcbef4eaec516f22bf6b8d7d2428f39c8dea90840
 F src/legacy.c d7874bc885906868cd51e6c2156698f2754f02d9eee1bae2d687323c3ca8e5aa
 F src/loadext.c d74f5e7bd51f3c9d283442473eb65aef359664efd6513591c03f01881c4ae2da
 F src/main.c 94bf8b6a283914cc8fa8743b3db5350206a4be5cccfd9c84d53409ca5d8bd1c1
-F src/malloc.c 8a907f9e802ff517acb5e9edc13798428fd7668136456d9432a884a7fe5680f5
+F src/malloc.c cae32705aad5549e46687b48f8e5c6f8d045dfeec95b0ad30c295be4773b7c7c
 F src/mem0.c 6a55ebe57c46ca1a7d98da93aaa07f99f1059645
 F src/mem1.c c12a42539b1ba105e3707d0e628ad70e611040d8f5e38cf942cee30c867083de
 F src/mem2.c f1940d9e91948dd6a908fbb9ce3835c36b5d83c3
@@ -1852,7 +1852,7 @@ F vsixtest/vsixtest.tcl 6a9a6ab600c25a91a7acc6293828957a386a8a93
 F vsixtest/vsixtest.vcxproj.data 2ed517e100c66dc455b492e1a33350c1b20fbcdc
 F vsixtest/vsixtest.vcxproj.filters 37e51ffedcdb064aad6ff33b6148725226cd608e
 F vsixtest/vsixtest_TemporaryKey.pfx e5b1b036facdb453873e7084e1cae9102ccc67a0
-P 5e1949bca998f3c8c23a8ebf01c7a2e7a2af1fdad43886271e1fe0f25411551d
-R 251e88e80ae4e78253d2ec11ee9fa128
-U drh
-Z c4130ee4f36c72a8f85ea58dbfd139dc
+P d3783357f8fa76c42a86f12b214522f0388c37773c36ab8c5ce0623abbc4436a
+R 419a6defa175975b0c1f1ba26db0be60
+U numist
+Z c7e98609c62b97e8952867680421d71f
diff --git a/manifest.uuid b/manifest.uuid
index 17e6a5e49..50a02db88 100644
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-d3783357f8fa76c42a86f12b214522f0388c37773c36ab8c5ce0623abbc4436a
\ No newline at end of file
+611020e3378f4c81c277cccd84807ae51a816bbab6c3d887c91c5e5af3b5225f
\ No newline at end of file
diff --git a/src/malloc.c b/src/malloc.c
index 8f77c9643..79cdcbcb2 100644
--- a/src/malloc.c
+++ b/src/malloc.c
@@ -582,8 +582,10 @@ void *sqlite3DbMallocRawNN(sqlite3 *db, u64 n){
       return db->mallocFailed ? 0 : dbMallocRawFinish(db, n);
     }
     db->lookaside.anStat[1]++;
+    return dbMallocRawFinish(db, n);
+  }
 # ifndef SQLITE_OMIT_MINI_LOOKASIDE
-  }else if( n<=MINI_SZ ){
+  if( n<=MINI_SZ ){
     if( (pBuf = db->lookaside.pMiniFree)!=0 ){
       db->lookaside.pMiniFree = pBuf->pNext;
       db->lookaside.anStat[0]++;
@@ -593,8 +595,9 @@ void *sqlite3DbMallocRawNN(sqlite3 *db, u64 n){
       db->lookaside.anStat[0]++;
       return (void*)pBuf;
     }
+  }
 # endif
-  }else if( (pBuf = db->lookaside.pFree)!=0 ){
+  if( (pBuf = db->lookaside.pFree)!=0 ){
     db->lookaside.pFree = pBuf->pNext;
     db->lookaside.anStat[0]++;
     return (void*)pBuf;