| Fix CVE-2017-15286 |
| |
| SQLite 3.20.1 has a NULL pointer dereference in tableColumnList in shell.c |
| because it fails to consider certain cases where |
| `sqlite3_step(pStmt)==SQLITE_ROW` is false and a data structure is never |
| initialized. |
| |
| https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=878680 |
| |
| Upstream commit: http://www.sqlite.org/src/info/5d0ceb8dcdef92cd |
| |
| Index: src/shell.c |
| ================================================================== |
| --- src/shell.c |
| +++ src/shell.c |
| @@ -3807,10 +3807,11 @@ |
| isIPK = 0; |
| } |
| } |
| } |
| sqlite3_finalize(pStmt); |
| + if( azCol==0 ) return 0; |
| azCol[0] = 0; |
| azCol[nCol+1] = 0; |
| |
| /* The decision of whether or not a rowid really needs to be preserved |
| ** is tricky. We never need to preserve a rowid for a WITHOUT ROWID table |
| |
