Bug fix in sqlite3SelectDup(). Make sure the pNext pointer is valid.
FossilOrigin-Name: 7e5b56b1c602d4adfd4496a9c877f3b685b2d360
diff --git a/src/expr.c b/src/expr.c
index 0d217ed..09f07ab 100644
--- a/src/expr.c
+++ b/src/expr.c
@@ -940,7 +940,7 @@
return pNew;
}
Select *sqlite3SelectDup(sqlite3 *db, Select *p, int flags){
- Select *pNew;
+ Select *pNew, *pPrior;
if( p==0 ) return 0;
pNew = sqlite3DbMallocRaw(db, sizeof(*p) );
if( pNew==0 ) return 0;
@@ -951,7 +951,9 @@
pNew->pHaving = sqlite3ExprDup(db, p->pHaving, flags);
pNew->pOrderBy = sqlite3ExprListDup(db, p->pOrderBy, flags);
pNew->op = p->op;
- pNew->pPrior = sqlite3SelectDup(db, p->pPrior, flags);
+ pNew->pPrior = pPrior = sqlite3SelectDup(db, p->pPrior, flags);
+ if( pPrior ) pPrior->pNext = pNew;
+ pNew->pNext = 0;
pNew->pLimit = sqlite3ExprDup(db, p->pLimit, flags);
pNew->pOffset = sqlite3ExprDup(db, p->pOffset, flags);
pNew->iLimit = 0;