In the function sqlite3VdbeMemReleaseExternal calls sqlite3DbFree
which is passed into the function as the xDel component of the Mem
argument to the function (p):

if( p->flags&MEM_Dyn && p->xDel ){
    assert( (p->flags&MEM_RowSet)==0 );
    p->xDel((void *)p->z);
    p->xDel = 0;
  }

sqlite3DbFree is declared to take two parameters, a database and a
point to the memory to be freed:
    SQLITE_PRIVATE void sqlite3DbFree(sqlite3*, void*);

But the xDel component is set in a number of functions to
SQLITE_DYNAMIC which is a cast of sqlite3DbFree to a function taking
only one parameter:

typedef void (*sqlite3_destructor_type)(void*);
#define SQLITE_STATIC      ((sqlite3_destructor_type)0)
#define SQLITE_TRANSIENT   ((sqlite3_destructor_type)-1)
#define SQLITE_DYNAMIC   ((sqlite3_destructor_type)sqlite3DbFree)

This can cause a memory exception when sqlite3DbFree is called with
the wrong number of parameters pushed to the stack.

I suggest that this be fixed by creating a function that takes the
pointer to the Mem structure and passes the db and z components of
this structure to sqlite3DbFree. This would allow the use of a single
argument function to free the dynamic memory held in a Mem structure
while retaining the single void * argument for the xDel values to be
consistent with the API functions.

Thank you,
Donald Rich
_______________________________________________
sqlite-users mailing list
sqlite-users@sqlite.org
http://sqlite.org:8080/cgi-bin/mailman/listinfo/sqlite-users

Reply via email to