SQLite

In the src/vtab.c and the sqlite3VtabSync function, pVtab->zErrMsg is freed without then being zeroed. This leads to a double-free error condition when pVtab->zErrMsg is later examined, found non-zero and freed (again).

The simplest way to reproduce the problem is to create a virtual table implementation that implements xSync. In xSync, set pVtab->zErrMsg to an allocated string and return an error result. At the next callback opportunity (mine was in xRollback), pVtab->zErrMsg will still be set, when it should be zero.