1 /*
2 ** 2005 May 25
3 **
4 ** The author disclaims copyright to this source code.  In place of
5 ** a legal notice, here is a blessing:
6 **
7 **    May you do good and not evil.
8 **    May you find forgiveness for yourself and forgive others.
9 **    May you share freely, never taking more than you give.
10 **
11 *************************************************************************
12 ** This file contains the implementation of the sqlite3_prepare()
13 ** interface, and routines that contribute to loading the database schema
14 ** from disk.
15 */
16 #include "sqliteInt.h"
17 
18 /*
19 ** Fill the InitData structure with an error message that indicates
20 ** that the database is corrupt.
21 */
corruptSchema(InitData * pData,char ** azObj,const char * zExtra)22 static void corruptSchema(
23   InitData *pData,     /* Initialization context */
24   char **azObj,        /* Type and name of object being parsed */
25   const char *zExtra   /* Error information */
26 ){
27   sqlite3 *db = pData->db;
28   if( db->mallocFailed ){
29     pData->rc = SQLITE_NOMEM_BKPT;
30   }else if( pData->pzErrMsg[0]!=0 ){
31     /* A error message has already been generated.  Do not overwrite it */
32   }else if( pData->mInitFlags & (INITFLAG_AlterRename|INITFLAG_AlterDrop) ){
33     *pData->pzErrMsg = sqlite3MPrintf(db,
34         "error in %s %s after %s: %s", azObj[0], azObj[1],
35         (pData->mInitFlags & INITFLAG_AlterRename) ? "rename" : "drop column",
36         zExtra
37     );
38     pData->rc = SQLITE_ERROR;
39   }else if( db->flags & SQLITE_WriteSchema ){
40     pData->rc = SQLITE_CORRUPT_BKPT;
41   }else{
42     char *z;
43     const char *zObj = azObj[1] ? azObj[1] : "?";
44     z = sqlite3MPrintf(db, "malformed database schema (%s)", zObj);
45     if( zExtra && zExtra[0] ) z = sqlite3MPrintf(db, "%z - %s", z, zExtra);
46     *pData->pzErrMsg = z;
47     pData->rc = SQLITE_CORRUPT_BKPT;
48   }
49 }
50 
51 /*
52 ** Check to see if any sibling index (another index on the same table)
53 ** of pIndex has the same root page number, and if it does, return true.
54 ** This would indicate a corrupt schema.
55 */
sqlite3IndexHasDuplicateRootPage(Index * pIndex)56 int sqlite3IndexHasDuplicateRootPage(Index *pIndex){
57   Index *p;
58   for(p=pIndex->pTable->pIndex; p; p=p->pNext){
59     if( p->tnum==pIndex->tnum && p!=pIndex ) return 1;
60   }
61   return 0;
62 }
63 
64 /* forward declaration */
65 static int sqlite3Prepare(
66   sqlite3 *db,              /* Database handle. */
67   const char *zSql,         /* UTF-8 encoded SQL statement. */
68   int nBytes,               /* Length of zSql in bytes. */
69   u32 prepFlags,            /* Zero or more SQLITE_PREPARE_* flags */
70   Vdbe *pReprepare,         /* VM being reprepared */
71   sqlite3_stmt **ppStmt,    /* OUT: A pointer to the prepared statement */
72   const char **pzTail       /* OUT: End of parsed string */
73 );
74 
75 
76 /*
77 ** This is the callback routine for the code that initializes the
78 ** database.  See sqlite3Init() below for additional information.
79 ** This routine is also called from the OP_ParseSchema opcode of the VDBE.
80 **
81 ** Each callback contains the following information:
82 **
83 **     argv[0] = type of object: "table", "index", "trigger", or "view".
84 **     argv[1] = name of thing being created
85 **     argv[2] = associated table if an index or trigger
86 **     argv[3] = root page number for table or index. 0 for trigger or view.
87 **     argv[4] = SQL text for the CREATE statement.
88 **
89 */
sqlite3InitCallback(void * pInit,int argc,char ** argv,char ** NotUsed)90 int sqlite3InitCallback(void *pInit, int argc, char **argv, char **NotUsed){
91   InitData *pData = (InitData*)pInit;
92   sqlite3 *db = pData->db;
93   int iDb = pData->iDb;
94 
95   assert( argc==5 );
96   UNUSED_PARAMETER2(NotUsed, argc);
97   assert( sqlite3_mutex_held(db->mutex) );
98   db->mDbFlags |= DBFLAG_EncodingFixed;
99   pData->nInitRow++;
100   if( db->mallocFailed ){
101     corruptSchema(pData, argv, 0);
102     return 1;
103   }
104 
105   assert( iDb>=0 && iDb<db->nDb );
106   if( argv==0 ) return 0;   /* Might happen if EMPTY_RESULT_CALLBACKS are on */
107   if( argv[3]==0 ){
108     corruptSchema(pData, argv, 0);
109   }else if( argv[4]
110          && 'c'==sqlite3UpperToLower[(unsigned char)argv[4][0]]
111          && 'r'==sqlite3UpperToLower[(unsigned char)argv[4][1]] ){
112     /* Call the parser to process a CREATE TABLE, INDEX or VIEW.
113     ** But because db->init.busy is set to 1, no VDBE code is generated
114     ** or executed.  All the parser does is build the internal data
115     ** structures that describe the table, index, or view.
116     **
117     ** No other valid SQL statement, other than the variable CREATE statements,
118     ** can begin with the letters "C" and "R".  Thus, it is not possible run
119     ** any other kind of statement while parsing the schema, even a corrupt
120     ** schema.
121     */
122     int rc;
123     u8 saved_iDb = db->init.iDb;
124     sqlite3_stmt *pStmt;
125     TESTONLY(int rcp);            /* Return code from sqlite3_prepare() */
126 
127     assert( db->init.busy );
128     db->init.iDb = iDb;
129     if( sqlite3GetUInt32(argv[3], &db->init.newTnum)==0
130      || (db->init.newTnum>pData->mxPage && pData->mxPage>0)
131     ){
132       if( sqlite3Config.bExtraSchemaChecks ){
133         corruptSchema(pData, argv, "invalid rootpage");
134       }
135     }
136     db->init.orphanTrigger = 0;
137     db->init.azInit = argv;
138     pStmt = 0;
139     TESTONLY(rcp = ) sqlite3Prepare(db, argv[4], -1, 0, 0, &pStmt, 0);
140     rc = db->errCode;
141     assert( (rc&0xFF)==(rcp&0xFF) );
142     db->init.iDb = saved_iDb;
143     /* assert( saved_iDb==0 || (db->mDbFlags & DBFLAG_Vacuum)!=0 ); */
144     if( SQLITE_OK!=rc ){
145       if( db->init.orphanTrigger ){
146         assert( iDb==1 );
147       }else{
148         if( rc > pData->rc ) pData->rc = rc;
149         if( rc==SQLITE_NOMEM ){
150           sqlite3OomFault(db);
151         }else if( rc!=SQLITE_INTERRUPT && (rc&0xFF)!=SQLITE_LOCKED ){
152           corruptSchema(pData, argv, sqlite3_errmsg(db));
153         }
154       }
155     }
156     sqlite3_finalize(pStmt);
157   }else if( argv[1]==0 || (argv[4]!=0 && argv[4][0]!=0) ){
158     corruptSchema(pData, argv, 0);
159   }else{
160     /* If the SQL column is blank it means this is an index that
161     ** was created to be the PRIMARY KEY or to fulfill a UNIQUE
162     ** constraint for a CREATE TABLE.  The index should have already
163     ** been created when we processed the CREATE TABLE.  All we have
164     ** to do here is record the root page number for that index.
165     */
166     Index *pIndex;
167     pIndex = sqlite3FindIndex(db, argv[1], db->aDb[iDb].zDbSName);
168     if( pIndex==0 ){
169       corruptSchema(pData, argv, "orphan index");
170     }else
171     if( sqlite3GetUInt32(argv[3],&pIndex->tnum)==0
172      || pIndex->tnum<2
173      || pIndex->tnum>pData->mxPage
174      || sqlite3IndexHasDuplicateRootPage(pIndex)
175     ){
176       if( sqlite3Config.bExtraSchemaChecks ){
177         corruptSchema(pData, argv, "invalid rootpage");
178       }
179     }
180   }
181   return 0;
182 }
183 
184 /*
185 ** Attempt to read the database schema and initialize internal
186 ** data structures for a single database file.  The index of the
187 ** database file is given by iDb.  iDb==0 is used for the main
188 ** database.  iDb==1 should never be used.  iDb>=2 is used for
189 ** auxiliary databases.  Return one of the SQLITE_ error codes to
190 ** indicate success or failure.
191 */
sqlite3InitOne(sqlite3 * db,int iDb,char ** pzErrMsg,u32 mFlags)192 int sqlite3InitOne(sqlite3 *db, int iDb, char **pzErrMsg, u32 mFlags){
193   int rc;
194   int i;
195 #ifndef SQLITE_OMIT_DEPRECATED
196   int size;
197 #endif
198   Db *pDb;
199   char const *azArg[6];
200   int meta[5];
201   InitData initData;
202   const char *zSchemaTabName;
203   int openedTransaction = 0;
204   int mask = ((db->mDbFlags & DBFLAG_EncodingFixed) | ~DBFLAG_EncodingFixed);
205 
206   assert( (db->mDbFlags & DBFLAG_SchemaKnownOk)==0 );
207   assert( iDb>=0 && iDb<db->nDb );
208   assert( db->aDb[iDb].pSchema );
209   assert( sqlite3_mutex_held(db->mutex) );
210   assert( iDb==1 || sqlite3BtreeHoldsMutex(db->aDb[iDb].pBt) );
211 
212   db->init.busy = 1;
213 
214   /* Construct the in-memory representation schema tables (sqlite_schema or
215   ** sqlite_temp_schema) by invoking the parser directly.  The appropriate
216   ** table name will be inserted automatically by the parser so we can just
217   ** use the abbreviation "x" here.  The parser will also automatically tag
218   ** the schema table as read-only. */
219   azArg[0] = "table";
220   azArg[1] = zSchemaTabName = SCHEMA_TABLE(iDb);
221   azArg[2] = azArg[1];
222   azArg[3] = "1";
223   azArg[4] = "CREATE TABLE x(type text,name text,tbl_name text,"
224                             "rootpage int,sql text)";
225   azArg[5] = 0;
226   initData.db = db;
227   initData.iDb = iDb;
228   initData.rc = SQLITE_OK;
229   initData.pzErrMsg = pzErrMsg;
230   initData.mInitFlags = mFlags;
231   initData.nInitRow = 0;
232   initData.mxPage = 0;
233   sqlite3InitCallback(&initData, 5, (char **)azArg, 0);
234   db->mDbFlags &= mask;
235   if( initData.rc ){
236     rc = initData.rc;
237     goto error_out;
238   }
239 
240   /* Create a cursor to hold the database open
241   */
242   pDb = &db->aDb[iDb];
243   if( pDb->pBt==0 ){
244     assert( iDb==1 );
245     DbSetProperty(db, 1, DB_SchemaLoaded);
246     rc = SQLITE_OK;
247     goto error_out;
248   }
249 
250   /* If there is not already a read-only (or read-write) transaction opened
251   ** on the b-tree database, open one now. If a transaction is opened, it
252   ** will be closed before this function returns.  */
253   sqlite3BtreeEnter(pDb->pBt);
254   if( sqlite3BtreeTxnState(pDb->pBt)==SQLITE_TXN_NONE ){
255     rc = sqlite3BtreeBeginTrans(pDb->pBt, 0, 0);
256     if( rc!=SQLITE_OK ){
257       sqlite3SetString(pzErrMsg, db, sqlite3ErrStr(rc));
258       goto initone_error_out;
259     }
260     openedTransaction = 1;
261   }
262 
263   /* Get the database meta information.
264   **
265   ** Meta values are as follows:
266   **    meta[0]   Schema cookie.  Changes with each schema change.
267   **    meta[1]   File format of schema layer.
268   **    meta[2]   Size of the page cache.
269   **    meta[3]   Largest rootpage (auto/incr_vacuum mode)
270   **    meta[4]   Db text encoding. 1:UTF-8 2:UTF-16LE 3:UTF-16BE
271   **    meta[5]   User version
272   **    meta[6]   Incremental vacuum mode
273   **    meta[7]   unused
274   **    meta[8]   unused
275   **    meta[9]   unused
276   **
277   ** Note: The #defined SQLITE_UTF* symbols in sqliteInt.h correspond to
278   ** the possible values of meta[4].
279   */
280   for(i=0; i<ArraySize(meta); i++){
281     sqlite3BtreeGetMeta(pDb->pBt, i+1, (u32 *)&meta[i]);
282   }
283   if( (db->flags & SQLITE_ResetDatabase)!=0 ){
284     memset(meta, 0, sizeof(meta));
285   }
286   pDb->pSchema->schema_cookie = meta[BTREE_SCHEMA_VERSION-1];
287 
288   /* If opening a non-empty database, check the text encoding. For the
289   ** main database, set sqlite3.enc to the encoding of the main database.
290   ** For an attached db, it is an error if the encoding is not the same
291   ** as sqlite3.enc.
292   */
293   if( meta[BTREE_TEXT_ENCODING-1] ){  /* text encoding */
294     if( iDb==0 && (db->mDbFlags & DBFLAG_EncodingFixed)==0 ){
295       u8 encoding;
296 #ifndef SQLITE_OMIT_UTF16
297       /* If opening the main database, set ENC(db). */
298       encoding = (u8)meta[BTREE_TEXT_ENCODING-1] & 3;
299       if( encoding==0 ) encoding = SQLITE_UTF8;
300 #else
301       encoding = SQLITE_UTF8;
302 #endif
303       sqlite3SetTextEncoding(db, encoding);
304     }else{
305       /* If opening an attached database, the encoding much match ENC(db) */
306       if( (meta[BTREE_TEXT_ENCODING-1] & 3)!=ENC(db) ){
307         sqlite3SetString(pzErrMsg, db, "attached databases must use the same"
308             " text encoding as main database");
309         rc = SQLITE_ERROR;
310         goto initone_error_out;
311       }
312     }
313   }
314   pDb->pSchema->enc = ENC(db);
315 
316   if( pDb->pSchema->cache_size==0 ){
317 #ifndef SQLITE_OMIT_DEPRECATED
318     size = sqlite3AbsInt32(meta[BTREE_DEFAULT_CACHE_SIZE-1]);
319     if( size==0 ){ size = SQLITE_DEFAULT_CACHE_SIZE; }
320     pDb->pSchema->cache_size = size;
321 #else
322     pDb->pSchema->cache_size = SQLITE_DEFAULT_CACHE_SIZE;
323 #endif
324     sqlite3BtreeSetCacheSize(pDb->pBt, pDb->pSchema->cache_size);
325   }
326 
327   /*
328   ** file_format==1    Version 3.0.0.
329   ** file_format==2    Version 3.1.3.  // ALTER TABLE ADD COLUMN
330   ** file_format==3    Version 3.1.4.  // ditto but with non-NULL defaults
331   ** file_format==4    Version 3.3.0.  // DESC indices.  Boolean constants
332   */
333   pDb->pSchema->file_format = (u8)meta[BTREE_FILE_FORMAT-1];
334   if( pDb->pSchema->file_format==0 ){
335     pDb->pSchema->file_format = 1;
336   }
337   if( pDb->pSchema->file_format>SQLITE_MAX_FILE_FORMAT ){
338     sqlite3SetString(pzErrMsg, db, "unsupported file format");
339     rc = SQLITE_ERROR;
340     goto initone_error_out;
341   }
342 
343   /* Ticket #2804:  When we open a database in the newer file format,
344   ** clear the legacy_file_format pragma flag so that a VACUUM will
345   ** not downgrade the database and thus invalidate any descending
346   ** indices that the user might have created.
347   */
348   if( iDb==0 && meta[BTREE_FILE_FORMAT-1]>=4 ){
349     db->flags &= ~(u64)SQLITE_LegacyFileFmt;
350   }
351 
352   /* Read the schema information out of the schema tables
353   */
354   assert( db->init.busy );
355   initData.mxPage = sqlite3BtreeLastPage(pDb->pBt);
356   {
357     char *zSql;
358     zSql = sqlite3MPrintf(db,
359         "SELECT*FROM\"%w\".%s ORDER BY rowid",
360         db->aDb[iDb].zDbSName, zSchemaTabName);
361 #ifndef SQLITE_OMIT_AUTHORIZATION
362     {
363       sqlite3_xauth xAuth;
364       xAuth = db->xAuth;
365       db->xAuth = 0;
366 #endif
367       rc = sqlite3_exec(db, zSql, sqlite3InitCallback, &initData, 0);
368 #ifndef SQLITE_OMIT_AUTHORIZATION
369       db->xAuth = xAuth;
370     }
371 #endif
372     if( rc==SQLITE_OK ) rc = initData.rc;
373     sqlite3DbFree(db, zSql);
374 #ifndef SQLITE_OMIT_ANALYZE
375     if( rc==SQLITE_OK ){
376       sqlite3AnalysisLoad(db, iDb);
377     }
378 #endif
379   }
380   if( db->mallocFailed ){
381     rc = SQLITE_NOMEM_BKPT;
382     sqlite3ResetAllSchemasOfConnection(db);
383   }
384   if( rc==SQLITE_OK || (db->flags&SQLITE_NoSchemaError)){
385     /* Black magic: If the SQLITE_NoSchemaError flag is set, then consider
386     ** the schema loaded, even if errors occurred. In this situation the
387     ** current sqlite3_prepare() operation will fail, but the following one
388     ** will attempt to compile the supplied statement against whatever subset
389     ** of the schema was loaded before the error occurred. The primary
390     ** purpose of this is to allow access to the sqlite_schema table
391     ** even when its contents have been corrupted.
392     */
393     DbSetProperty(db, iDb, DB_SchemaLoaded);
394     rc = SQLITE_OK;
395   }
396 
397   /* Jump here for an error that occurs after successfully allocating
398   ** curMain and calling sqlite3BtreeEnter(). For an error that occurs
399   ** before that point, jump to error_out.
400   */
401 initone_error_out:
402   if( openedTransaction ){
403     sqlite3BtreeCommit(pDb->pBt);
404   }
405   sqlite3BtreeLeave(pDb->pBt);
406 
407 error_out:
408   if( rc ){
409     if( rc==SQLITE_NOMEM || rc==SQLITE_IOERR_NOMEM ){
410       sqlite3OomFault(db);
411     }
412     sqlite3ResetOneSchema(db, iDb);
413   }
414   db->init.busy = 0;
415   return rc;
416 }
417 
418 /*
419 ** Initialize all database files - the main database file, the file
420 ** used to store temporary tables, and any additional database files
421 ** created using ATTACH statements.  Return a success code.  If an
422 ** error occurs, write an error message into *pzErrMsg.
423 **
424 ** After a database is initialized, the DB_SchemaLoaded bit is set
425 ** bit is set in the flags field of the Db structure.
426 */
sqlite3Init(sqlite3 * db,char ** pzErrMsg)427 int sqlite3Init(sqlite3 *db, char **pzErrMsg){
428   int i, rc;
429   int commit_internal = !(db->mDbFlags&DBFLAG_SchemaChange);
430 
431   assert( sqlite3_mutex_held(db->mutex) );
432   assert( sqlite3BtreeHoldsMutex(db->aDb[0].pBt) );
433   assert( db->init.busy==0 );
434   ENC(db) = SCHEMA_ENC(db);
435   assert( db->nDb>0 );
436   /* Do the main schema first */
437   if( !DbHasProperty(db, 0, DB_SchemaLoaded) ){
438     rc = sqlite3InitOne(db, 0, pzErrMsg, 0);
439     if( rc ) return rc;
440   }
441   /* All other schemas after the main schema. The "temp" schema must be last */
442   for(i=db->nDb-1; i>0; i--){
443     assert( i==1 || sqlite3BtreeHoldsMutex(db->aDb[i].pBt) );
444     if( !DbHasProperty(db, i, DB_SchemaLoaded) ){
445       rc = sqlite3InitOne(db, i, pzErrMsg, 0);
446       if( rc ) return rc;
447     }
448   }
449   if( commit_internal ){
450     sqlite3CommitInternalChanges(db);
451   }
452   return SQLITE_OK;
453 }
454 
455 /*
456 ** This routine is a no-op if the database schema is already initialized.
457 ** Otherwise, the schema is loaded. An error code is returned.
458 */
sqlite3ReadSchema(Parse * pParse)459 int sqlite3ReadSchema(Parse *pParse){
460   int rc = SQLITE_OK;
461   sqlite3 *db = pParse->db;
462   assert( sqlite3_mutex_held(db->mutex) );
463   if( !db->init.busy ){
464     rc = sqlite3Init(db, &pParse->zErrMsg);
465     if( rc!=SQLITE_OK ){
466       pParse->rc = rc;
467       pParse->nErr++;
468     }else if( db->noSharedCache ){
469       db->mDbFlags |= DBFLAG_SchemaKnownOk;
470     }
471   }
472   return rc;
473 }
474 
475 
476 /*
477 ** Check schema cookies in all databases.  If any cookie is out
478 ** of date set pParse->rc to SQLITE_SCHEMA.  If all schema cookies
479 ** make no changes to pParse->rc.
480 */
schemaIsValid(Parse * pParse)481 static void schemaIsValid(Parse *pParse){
482   sqlite3 *db = pParse->db;
483   int iDb;
484   int rc;
485   int cookie;
486 
487   assert( pParse->checkSchema );
488   assert( sqlite3_mutex_held(db->mutex) );
489   for(iDb=0; iDb<db->nDb; iDb++){
490     int openedTransaction = 0;         /* True if a transaction is opened */
491     Btree *pBt = db->aDb[iDb].pBt;     /* Btree database to read cookie from */
492     if( pBt==0 ) continue;
493 
494     /* If there is not already a read-only (or read-write) transaction opened
495     ** on the b-tree database, open one now. If a transaction is opened, it
496     ** will be closed immediately after reading the meta-value. */
497     if( sqlite3BtreeTxnState(pBt)==SQLITE_TXN_NONE ){
498       rc = sqlite3BtreeBeginTrans(pBt, 0, 0);
499       if( rc==SQLITE_NOMEM || rc==SQLITE_IOERR_NOMEM ){
500         sqlite3OomFault(db);
501       }
502       if( rc!=SQLITE_OK ) return;
503       openedTransaction = 1;
504     }
505 
506     /* Read the schema cookie from the database. If it does not match the
507     ** value stored as part of the in-memory schema representation,
508     ** set Parse.rc to SQLITE_SCHEMA. */
509     sqlite3BtreeGetMeta(pBt, BTREE_SCHEMA_VERSION, (u32 *)&cookie);
510     assert( sqlite3SchemaMutexHeld(db, iDb, 0) );
511     if( cookie!=db->aDb[iDb].pSchema->schema_cookie ){
512       sqlite3ResetOneSchema(db, iDb);
513       pParse->rc = SQLITE_SCHEMA;
514     }
515 
516     /* Close the transaction, if one was opened. */
517     if( openedTransaction ){
518       sqlite3BtreeCommit(pBt);
519     }
520   }
521 }
522 
523 /*
524 ** Convert a schema pointer into the iDb index that indicates
525 ** which database file in db->aDb[] the schema refers to.
526 **
527 ** If the same database is attached more than once, the first
528 ** attached database is returned.
529 */
sqlite3SchemaToIndex(sqlite3 * db,Schema * pSchema)530 int sqlite3SchemaToIndex(sqlite3 *db, Schema *pSchema){
531   int i = -32768;
532 
533   /* If pSchema is NULL, then return -32768. This happens when code in
534   ** expr.c is trying to resolve a reference to a transient table (i.e. one
535   ** created by a sub-select). In this case the return value of this
536   ** function should never be used.
537   **
538   ** We return -32768 instead of the more usual -1 simply because using
539   ** -32768 as the incorrect index into db->aDb[] is much
540   ** more likely to cause a segfault than -1 (of course there are assert()
541   ** statements too, but it never hurts to play the odds) and
542   ** -32768 will still fit into a 16-bit signed integer.
543   */
544   assert( sqlite3_mutex_held(db->mutex) );
545   if( pSchema ){
546     for(i=0; 1; i++){
547       assert( i<db->nDb );
548       if( db->aDb[i].pSchema==pSchema ){
549         break;
550       }
551     }
552     assert( i>=0 && i<db->nDb );
553   }
554   return i;
555 }
556 
557 /*
558 ** Free all memory allocations in the pParse object
559 */
sqlite3ParserReset(Parse * pParse)560 void sqlite3ParserReset(Parse *pParse){
561   sqlite3 *db = pParse->db;
562   while( pParse->pCleanup ){
563     ParseCleanup *pCleanup = pParse->pCleanup;
564     pParse->pCleanup = pCleanup->pNext;
565     pCleanup->xCleanup(db, pCleanup->pPtr);
566     sqlite3DbFreeNN(db, pCleanup);
567   }
568   sqlite3DbFree(db, pParse->aLabel);
569   if( pParse->pConstExpr ){
570     sqlite3ExprListDelete(db, pParse->pConstExpr);
571   }
572   if( db ){
573     assert( db->lookaside.bDisable >= pParse->disableLookaside );
574     db->lookaside.bDisable -= pParse->disableLookaside;
575     db->lookaside.sz = db->lookaside.bDisable ? 0 : db->lookaside.szTrue;
576   }
577   pParse->disableLookaside = 0;
578 }
579 
580 /*
581 ** Add a new cleanup operation to a Parser.  The cleanup should happen when
582 ** the parser object is destroyed.  But, beware: the cleanup might happen
583 ** immediately.
584 **
585 ** Use this mechanism for uncommon cleanups.  There is a higher setup
586 ** cost for this mechansim (an extra malloc), so it should not be used
587 ** for common cleanups that happen on most calls.  But for less
588 ** common cleanups, we save a single NULL-pointer comparison in
589 ** sqlite3ParserReset(), which reduces the total CPU cycle count.
590 **
591 ** If a memory allocation error occurs, then the cleanup happens immediately.
592 ** When either SQLITE_DEBUG or SQLITE_COVERAGE_TEST are defined, the
593 ** pParse->earlyCleanup flag is set in that case.  Calling code show verify
594 ** that test cases exist for which this happens, to guard against possible
595 ** use-after-free errors following an OOM.  The preferred way to do this is
596 ** to immediately follow the call to this routine with:
597 **
598 **       testcase( pParse->earlyCleanup );
599 **
600 ** This routine returns a copy of its pPtr input (the third parameter)
601 ** except if an early cleanup occurs, in which case it returns NULL.  So
602 ** another way to check for early cleanup is to check the return value.
603 ** Or, stop using the pPtr parameter with this call and use only its
604 ** return value thereafter.  Something like this:
605 **
606 **       pObj = sqlite3ParserAddCleanup(pParse, destructor, pObj);
607 */
sqlite3ParserAddCleanup(Parse * pParse,void (* xCleanup)(sqlite3 *,void *),void * pPtr)608 void *sqlite3ParserAddCleanup(
609   Parse *pParse,                      /* Destroy when this Parser finishes */
610   void (*xCleanup)(sqlite3*,void*),   /* The cleanup routine */
611   void *pPtr                          /* Pointer to object to be cleaned up */
612 ){
613   ParseCleanup *pCleanup = sqlite3DbMallocRaw(pParse->db, sizeof(*pCleanup));
614   if( pCleanup ){
615     pCleanup->pNext = pParse->pCleanup;
616     pParse->pCleanup = pCleanup;
617     pCleanup->pPtr = pPtr;
618     pCleanup->xCleanup = xCleanup;
619   }else{
620     xCleanup(pParse->db, pPtr);
621     pPtr = 0;
622 #if defined(SQLITE_DEBUG) || defined(SQLITE_COVERAGE_TEST)
623     pParse->earlyCleanup = 1;
624 #endif
625   }
626   return pPtr;
627 }
628 
629 /*
630 ** Compile the UTF-8 encoded SQL statement zSql into a statement handle.
631 */
sqlite3Prepare(sqlite3 * db,const char * zSql,int nBytes,u32 prepFlags,Vdbe * pReprepare,sqlite3_stmt ** ppStmt,const char ** pzTail)632 static int sqlite3Prepare(
633   sqlite3 *db,              /* Database handle. */
634   const char *zSql,         /* UTF-8 encoded SQL statement. */
635   int nBytes,               /* Length of zSql in bytes. */
636   u32 prepFlags,            /* Zero or more SQLITE_PREPARE_* flags */
637   Vdbe *pReprepare,         /* VM being reprepared */
638   sqlite3_stmt **ppStmt,    /* OUT: A pointer to the prepared statement */
639   const char **pzTail       /* OUT: End of parsed string */
640 ){
641   char *zErrMsg = 0;        /* Error message */
642   int rc = SQLITE_OK;       /* Result code */
643   int i;                    /* Loop counter */
644   Parse sParse;             /* Parsing context */
645 
646   memset(&sParse, 0, PARSE_HDR_SZ);
647   memset(PARSE_TAIL(&sParse), 0, PARSE_TAIL_SZ);
648   sParse.pReprepare = pReprepare;
649   assert( ppStmt && *ppStmt==0 );
650   /* assert( !db->mallocFailed ); // not true with SQLITE_USE_ALLOCA */
651   assert( sqlite3_mutex_held(db->mutex) );
652 
653   /* For a long-term use prepared statement avoid the use of
654   ** lookaside memory.
655   */
656   if( prepFlags & SQLITE_PREPARE_PERSISTENT ){
657     sParse.disableLookaside++;
658     DisableLookaside;
659   }
660   sParse.disableVtab = (prepFlags & SQLITE_PREPARE_NO_VTAB)!=0;
661 
662   /* Check to verify that it is possible to get a read lock on all
663   ** database schemas.  The inability to get a read lock indicates that
664   ** some other database connection is holding a write-lock, which in
665   ** turn means that the other connection has made uncommitted changes
666   ** to the schema.
667   **
668   ** Were we to proceed and prepare the statement against the uncommitted
669   ** schema changes and if those schema changes are subsequently rolled
670   ** back and different changes are made in their place, then when this
671   ** prepared statement goes to run the schema cookie would fail to detect
672   ** the schema change.  Disaster would follow.
673   **
674   ** This thread is currently holding mutexes on all Btrees (because
675   ** of the sqlite3BtreeEnterAll() in sqlite3LockAndPrepare()) so it
676   ** is not possible for another thread to start a new schema change
677   ** while this routine is running.  Hence, we do not need to hold
678   ** locks on the schema, we just need to make sure nobody else is
679   ** holding them.
680   **
681   ** Note that setting READ_UNCOMMITTED overrides most lock detection,
682   ** but it does *not* override schema lock detection, so this all still
683   ** works even if READ_UNCOMMITTED is set.
684   */
685   if( !db->noSharedCache ){
686     for(i=0; i<db->nDb; i++) {
687       Btree *pBt = db->aDb[i].pBt;
688       if( pBt ){
689         assert( sqlite3BtreeHoldsMutex(pBt) );
690         rc = sqlite3BtreeSchemaLocked(pBt);
691         if( rc ){
692           const char *zDb = db->aDb[i].zDbSName;
693           sqlite3ErrorWithMsg(db, rc, "database schema is locked: %s", zDb);
694           testcase( db->flags & SQLITE_ReadUncommit );
695           goto end_prepare;
696         }
697       }
698     }
699   }
700 
701   sqlite3VtabUnlockList(db);
702 
703   sParse.db = db;
704   if( nBytes>=0 && (nBytes==0 || zSql[nBytes-1]!=0) ){
705     char *zSqlCopy;
706     int mxLen = db->aLimit[SQLITE_LIMIT_SQL_LENGTH];
707     testcase( nBytes==mxLen );
708     testcase( nBytes==mxLen+1 );
709     if( nBytes>mxLen ){
710       sqlite3ErrorWithMsg(db, SQLITE_TOOBIG, "statement too long");
711       rc = sqlite3ApiExit(db, SQLITE_TOOBIG);
712       goto end_prepare;
713     }
714     zSqlCopy = sqlite3DbStrNDup(db, zSql, nBytes);
715     if( zSqlCopy ){
716       sqlite3RunParser(&sParse, zSqlCopy, &zErrMsg);
717       sParse.zTail = &zSql[sParse.zTail-zSqlCopy];
718       sqlite3DbFree(db, zSqlCopy);
719     }else{
720       sParse.zTail = &zSql[nBytes];
721     }
722   }else{
723     sqlite3RunParser(&sParse, zSql, &zErrMsg);
724   }
725   assert( 0==sParse.nQueryLoop );
726 
727   if( pzTail ){
728     *pzTail = sParse.zTail;
729   }
730 
731   if( db->init.busy==0 ){
732     sqlite3VdbeSetSql(sParse.pVdbe, zSql, (int)(sParse.zTail-zSql), prepFlags);
733   }
734   if( db->mallocFailed ){
735     sParse.rc = SQLITE_NOMEM_BKPT;
736   }
737   if( sParse.rc!=SQLITE_OK && sParse.rc!=SQLITE_DONE ){
738     if( sParse.checkSchema ){
739       schemaIsValid(&sParse);
740     }
741     if( sParse.pVdbe ){
742       sqlite3VdbeFinalize(sParse.pVdbe);
743     }
744     assert( 0==(*ppStmt) );
745     rc = sParse.rc;
746     if( zErrMsg ){
747       sqlite3ErrorWithMsg(db, rc, "%s", zErrMsg);
748       sqlite3DbFree(db, zErrMsg);
749     }else{
750       sqlite3Error(db, rc);
751     }
752   }else{
753     assert( zErrMsg==0 );
754     *ppStmt = (sqlite3_stmt*)sParse.pVdbe;
755     rc = SQLITE_OK;
756     sqlite3ErrorClear(db);
757   }
758 
759 
760   /* Delete any TriggerPrg structures allocated while parsing this statement. */
761   while( sParse.pTriggerPrg ){
762     TriggerPrg *pT = sParse.pTriggerPrg;
763     sParse.pTriggerPrg = pT->pNext;
764     sqlite3DbFree(db, pT);
765   }
766 
767 end_prepare:
768 
769   sqlite3ParserReset(&sParse);
770   return rc;
771 }
sqlite3LockAndPrepare(sqlite3 * db,const char * zSql,int nBytes,u32 prepFlags,Vdbe * pOld,sqlite3_stmt ** ppStmt,const char ** pzTail)772 static int sqlite3LockAndPrepare(
773   sqlite3 *db,              /* Database handle. */
774   const char *zSql,         /* UTF-8 encoded SQL statement. */
775   int nBytes,               /* Length of zSql in bytes. */
776   u32 prepFlags,            /* Zero or more SQLITE_PREPARE_* flags */
777   Vdbe *pOld,               /* VM being reprepared */
778   sqlite3_stmt **ppStmt,    /* OUT: A pointer to the prepared statement */
779   const char **pzTail       /* OUT: End of parsed string */
780 ){
781   int rc;
782   int cnt = 0;
783 
784 #ifdef SQLITE_ENABLE_API_ARMOR
785   if( ppStmt==0 ) return SQLITE_MISUSE_BKPT;
786 #endif
787   *ppStmt = 0;
788   if( !sqlite3SafetyCheckOk(db)||zSql==0 ){
789     return SQLITE_MISUSE_BKPT;
790   }
791   sqlite3_mutex_enter(db->mutex);
792   sqlite3BtreeEnterAll(db);
793   do{
794     /* Make multiple attempts to compile the SQL, until it either succeeds
795     ** or encounters a permanent error.  A schema problem after one schema
796     ** reset is considered a permanent error. */
797     rc = sqlite3Prepare(db, zSql, nBytes, prepFlags, pOld, ppStmt, pzTail);
798     assert( rc==SQLITE_OK || *ppStmt==0 );
799   }while( rc==SQLITE_ERROR_RETRY
800        || (rc==SQLITE_SCHEMA && (sqlite3ResetOneSchema(db,-1), cnt++)==0) );
801   sqlite3BtreeLeaveAll(db);
802   rc = sqlite3ApiExit(db, rc);
803   assert( (rc&db->errMask)==rc );
804   db->busyHandler.nBusy = 0;
805   sqlite3_mutex_leave(db->mutex);
806   return rc;
807 }
808 
809 
810 /*
811 ** Rerun the compilation of a statement after a schema change.
812 **
813 ** If the statement is successfully recompiled, return SQLITE_OK. Otherwise,
814 ** if the statement cannot be recompiled because another connection has
815 ** locked the sqlite3_schema table, return SQLITE_LOCKED. If any other error
816 ** occurs, return SQLITE_SCHEMA.
817 */
sqlite3Reprepare(Vdbe * p)818 int sqlite3Reprepare(Vdbe *p){
819   int rc;
820   sqlite3_stmt *pNew;
821   const char *zSql;
822   sqlite3 *db;
823   u8 prepFlags;
824 
825   assert( sqlite3_mutex_held(sqlite3VdbeDb(p)->mutex) );
826   zSql = sqlite3_sql((sqlite3_stmt *)p);
827   assert( zSql!=0 );  /* Reprepare only called for prepare_v2() statements */
828   db = sqlite3VdbeDb(p);
829   assert( sqlite3_mutex_held(db->mutex) );
830   prepFlags = sqlite3VdbePrepareFlags(p);
831   rc = sqlite3LockAndPrepare(db, zSql, -1, prepFlags, p, &pNew, 0);
832   if( rc ){
833     if( rc==SQLITE_NOMEM ){
834       sqlite3OomFault(db);
835     }
836     assert( pNew==0 );
837     return rc;
838   }else{
839     assert( pNew!=0 );
840   }
841   sqlite3VdbeSwap((Vdbe*)pNew, p);
842   sqlite3TransferBindings(pNew, (sqlite3_stmt*)p);
843   sqlite3VdbeResetStepResult((Vdbe*)pNew);
844   sqlite3VdbeFinalize((Vdbe*)pNew);
845   return SQLITE_OK;
846 }
847 
848 
849 /*
850 ** Two versions of the official API.  Legacy and new use.  In the legacy
851 ** version, the original SQL text is not saved in the prepared statement
852 ** and so if a schema change occurs, SQLITE_SCHEMA is returned by
853 ** sqlite3_step().  In the new version, the original SQL text is retained
854 ** and the statement is automatically recompiled if an schema change
855 ** occurs.
856 */
sqlite3_prepare(sqlite3 * db,const char * zSql,int nBytes,sqlite3_stmt ** ppStmt,const char ** pzTail)857 int sqlite3_prepare(
858   sqlite3 *db,              /* Database handle. */
859   const char *zSql,         /* UTF-8 encoded SQL statement. */
860   int nBytes,               /* Length of zSql in bytes. */
861   sqlite3_stmt **ppStmt,    /* OUT: A pointer to the prepared statement */
862   const char **pzTail       /* OUT: End of parsed string */
863 ){
864   int rc;
865   rc = sqlite3LockAndPrepare(db,zSql,nBytes,0,0,ppStmt,pzTail);
866   assert( rc==SQLITE_OK || ppStmt==0 || *ppStmt==0 );  /* VERIFY: F13021 */
867   return rc;
868 }
sqlite3_prepare_v2(sqlite3 * db,const char * zSql,int nBytes,sqlite3_stmt ** ppStmt,const char ** pzTail)869 int sqlite3_prepare_v2(
870   sqlite3 *db,              /* Database handle. */
871   const char *zSql,         /* UTF-8 encoded SQL statement. */
872   int nBytes,               /* Length of zSql in bytes. */
873   sqlite3_stmt **ppStmt,    /* OUT: A pointer to the prepared statement */
874   const char **pzTail       /* OUT: End of parsed string */
875 ){
876   int rc;
877   /* EVIDENCE-OF: R-37923-12173 The sqlite3_prepare_v2() interface works
878   ** exactly the same as sqlite3_prepare_v3() with a zero prepFlags
879   ** parameter.
880   **
881   ** Proof in that the 5th parameter to sqlite3LockAndPrepare is 0 */
882   rc = sqlite3LockAndPrepare(db,zSql,nBytes,SQLITE_PREPARE_SAVESQL,0,
883                              ppStmt,pzTail);
884   assert( rc==SQLITE_OK || ppStmt==0 || *ppStmt==0 );
885   return rc;
886 }
sqlite3_prepare_v3(sqlite3 * db,const char * zSql,int nBytes,unsigned int prepFlags,sqlite3_stmt ** ppStmt,const char ** pzTail)887 int sqlite3_prepare_v3(
888   sqlite3 *db,              /* Database handle. */
889   const char *zSql,         /* UTF-8 encoded SQL statement. */
890   int nBytes,               /* Length of zSql in bytes. */
891   unsigned int prepFlags,   /* Zero or more SQLITE_PREPARE_* flags */
892   sqlite3_stmt **ppStmt,    /* OUT: A pointer to the prepared statement */
893   const char **pzTail       /* OUT: End of parsed string */
894 ){
895   int rc;
896   /* EVIDENCE-OF: R-56861-42673 sqlite3_prepare_v3() differs from
897   ** sqlite3_prepare_v2() only in having the extra prepFlags parameter,
898   ** which is a bit array consisting of zero or more of the
899   ** SQLITE_PREPARE_* flags.
900   **
901   ** Proof by comparison to the implementation of sqlite3_prepare_v2()
902   ** directly above. */
903   rc = sqlite3LockAndPrepare(db,zSql,nBytes,
904                  SQLITE_PREPARE_SAVESQL|(prepFlags&SQLITE_PREPARE_MASK),
905                  0,ppStmt,pzTail);
906   assert( rc==SQLITE_OK || ppStmt==0 || *ppStmt==0 );
907   return rc;
908 }
909 
910 
911 #ifndef SQLITE_OMIT_UTF16
912 /*
913 ** Compile the UTF-16 encoded SQL statement zSql into a statement handle.
914 */
sqlite3Prepare16(sqlite3 * db,const void * zSql,int nBytes,u32 prepFlags,sqlite3_stmt ** ppStmt,const void ** pzTail)915 static int sqlite3Prepare16(
916   sqlite3 *db,              /* Database handle. */
917   const void *zSql,         /* UTF-16 encoded SQL statement. */
918   int nBytes,               /* Length of zSql in bytes. */
919   u32 prepFlags,            /* Zero or more SQLITE_PREPARE_* flags */
920   sqlite3_stmt **ppStmt,    /* OUT: A pointer to the prepared statement */
921   const void **pzTail       /* OUT: End of parsed string */
922 ){
923   /* This function currently works by first transforming the UTF-16
924   ** encoded string to UTF-8, then invoking sqlite3_prepare(). The
925   ** tricky bit is figuring out the pointer to return in *pzTail.
926   */
927   char *zSql8;
928   const char *zTail8 = 0;
929   int rc = SQLITE_OK;
930 
931 #ifdef SQLITE_ENABLE_API_ARMOR
932   if( ppStmt==0 ) return SQLITE_MISUSE_BKPT;
933 #endif
934   *ppStmt = 0;
935   if( !sqlite3SafetyCheckOk(db)||zSql==0 ){
936     return SQLITE_MISUSE_BKPT;
937   }
938   if( nBytes>=0 ){
939     int sz;
940     const char *z = (const char*)zSql;
941     for(sz=0; sz<nBytes && (z[sz]!=0 || z[sz+1]!=0); sz += 2){}
942     nBytes = sz;
943   }
944   sqlite3_mutex_enter(db->mutex);
945   zSql8 = sqlite3Utf16to8(db, zSql, nBytes, SQLITE_UTF16NATIVE);
946   if( zSql8 ){
947     rc = sqlite3LockAndPrepare(db, zSql8, -1, prepFlags, 0, ppStmt, &zTail8);
948   }
949 
950   if( zTail8 && pzTail ){
951     /* If sqlite3_prepare returns a tail pointer, we calculate the
952     ** equivalent pointer into the UTF-16 string by counting the unicode
953     ** characters between zSql8 and zTail8, and then returning a pointer
954     ** the same number of characters into the UTF-16 string.
955     */
956     int chars_parsed = sqlite3Utf8CharLen(zSql8, (int)(zTail8-zSql8));
957     *pzTail = (u8 *)zSql + sqlite3Utf16ByteLen(zSql, chars_parsed);
958   }
959   sqlite3DbFree(db, zSql8);
960   rc = sqlite3ApiExit(db, rc);
961   sqlite3_mutex_leave(db->mutex);
962   return rc;
963 }
964 
965 /*
966 ** Two versions of the official API.  Legacy and new use.  In the legacy
967 ** version, the original SQL text is not saved in the prepared statement
968 ** and so if a schema change occurs, SQLITE_SCHEMA is returned by
969 ** sqlite3_step().  In the new version, the original SQL text is retained
970 ** and the statement is automatically recompiled if an schema change
971 ** occurs.
972 */
sqlite3_prepare16(sqlite3 * db,const void * zSql,int nBytes,sqlite3_stmt ** ppStmt,const void ** pzTail)973 int sqlite3_prepare16(
974   sqlite3 *db,              /* Database handle. */
975   const void *zSql,         /* UTF-16 encoded SQL statement. */
976   int nBytes,               /* Length of zSql in bytes. */
977   sqlite3_stmt **ppStmt,    /* OUT: A pointer to the prepared statement */
978   const void **pzTail       /* OUT: End of parsed string */
979 ){
980   int rc;
981   rc = sqlite3Prepare16(db,zSql,nBytes,0,ppStmt,pzTail);
982   assert( rc==SQLITE_OK || ppStmt==0 || *ppStmt==0 );  /* VERIFY: F13021 */
983   return rc;
984 }
sqlite3_prepare16_v2(sqlite3 * db,const void * zSql,int nBytes,sqlite3_stmt ** ppStmt,const void ** pzTail)985 int sqlite3_prepare16_v2(
986   sqlite3 *db,              /* Database handle. */
987   const void *zSql,         /* UTF-16 encoded SQL statement. */
988   int nBytes,               /* Length of zSql in bytes. */
989   sqlite3_stmt **ppStmt,    /* OUT: A pointer to the prepared statement */
990   const void **pzTail       /* OUT: End of parsed string */
991 ){
992   int rc;
993   rc = sqlite3Prepare16(db,zSql,nBytes,SQLITE_PREPARE_SAVESQL,ppStmt,pzTail);
994   assert( rc==SQLITE_OK || ppStmt==0 || *ppStmt==0 );  /* VERIFY: F13021 */
995   return rc;
996 }
sqlite3_prepare16_v3(sqlite3 * db,const void * zSql,int nBytes,unsigned int prepFlags,sqlite3_stmt ** ppStmt,const void ** pzTail)997 int sqlite3_prepare16_v3(
998   sqlite3 *db,              /* Database handle. */
999   const void *zSql,         /* UTF-16 encoded SQL statement. */
1000   int nBytes,               /* Length of zSql in bytes. */
1001   unsigned int prepFlags,   /* Zero or more SQLITE_PREPARE_* flags */
1002   sqlite3_stmt **ppStmt,    /* OUT: A pointer to the prepared statement */
1003   const void **pzTail       /* OUT: End of parsed string */
1004 ){
1005   int rc;
1006   rc = sqlite3Prepare16(db,zSql,nBytes,
1007          SQLITE_PREPARE_SAVESQL|(prepFlags&SQLITE_PREPARE_MASK),
1008          ppStmt,pzTail);
1009   assert( rc==SQLITE_OK || ppStmt==0 || *ppStmt==0 );  /* VERIFY: F13021 */
1010   return rc;
1011 }
1012 
1013 #endif /* SQLITE_OMIT_UTF16 */
1014