Fix a (almost always harmless) read past the end of a memory allocation
that comes about because the Expr.pTab field is checked on an
EXPR_REDUCEDSIZE Expr object before checking the Expr.op field to
know that the Expr.pTab field is meaningless.
FossilOrigin-Name: e098de691002a78270540430b0df1e120582b53f
diff --git a/src/expr.c b/src/expr.c
index 64fb3c5..25bd958 100644
--- a/src/expr.c
+++ b/src/expr.c
@@ -132,9 +132,9 @@
pColl = sqlite3GetCollSeq(pParse, ENC(db), 0, p->u.zToken);
break;
}
- if( p->pTab!=0
- && (op==TK_AGG_COLUMN || op==TK_COLUMN
+ if( (op==TK_AGG_COLUMN || op==TK_COLUMN
|| op==TK_REGISTER || op==TK_TRIGGER)
+ && p->pTab!=0
){
/* op==TK_REGISTER && p->pTab!=0 happens when pExpr was originally
** a TK_COLUMN but was previously evaluated and cached in a register */