(text/html)
<p>
In the <code>src/vtab.c</code> and the <code>sqlite3VtabSync</code> function, <code>pVtab->zErrMsg</code> is freed without then being zeroed. This leads to a double-free error condition when <code>pVtab->zErrMsg</code> is later examined, found non-zero and freed (again).
</p>
<p>
The simplest way to reproduce the problem is to create a virtual table implementation that implements <code>xSync</code>. In <code>xSync</code>, set <code>pVtab->zErrMsg</code> to an allocated string and return an error result. At the next callback opportunity (mine was in <code>xRollback</code>), <code>pVtab->zErrMsg</code> will still be set, when it should be zero.
</p>
|