SQLite3漏洞分析（CVE-2022-3039）

SQLITE_PRIVATE int sqlite3Select(  Parse *pParse,         /* The parser context */  Select *p,             /* The SELECT statement being coded. */  SelectDest *pDest      /* What to do with the query results */){            sqlite3ExprAnalyzeAggList(&sNC, pEList);      sqlite3ExprAnalyzeAggList(&sNC, sSort.pOrderBy);      ...      sqlite3ExprAnalyzeAggregates(&sNC, pHaving);      ...
      finalizeAggFunctions(pParse, pAggInfo);      sqlite3ExprIfFalse(pParse, pHaving, addrOutputRow+1, SQLITE_JUMPIFNULL);
}
static int addAggInfoColumn(sqlite3 *db, AggInfo *pInfo){  int i;  pInfo->aCol = sqlite3ArrayAllocate(       db,       pInfo->aCol,       sizeof(pInfo->aCol[0]),       &pInfo->nColumn,       &i  );  return i;}
static int addAggInfoFunc(sqlite3 *db, AggInfo *pInfo){  int i;  pInfo->aFunc = sqlite3ArrayAllocate(       db,       pInfo->aFunc,       sizeof(pInfo->aFunc[0]),       &pInfo->nFunc,       &i  );  return i;}

SQLITE_PRIVATE int sqlite3Select(  Parse *pParse,         /* The parser context */  Select *p,             /* The SELECT statement being coded. */  SelectDest *pDest      /* What to do with the query results */){...    if( pSub->pOrderBy!=0     && (p->pOrderBy!=0 || pTabList->nSrc>1)      /* Condition (5) */     && pSub->pLimit==0                           /* Condition (1) */     && (pSub->selFlags & SF_OrderByReqd)==0      /* Condition (2) */     && (p->selFlags & SF_OrderByReqd)==0         /* Condition (3) and (4) */     && OptimizationEnabled(db, SQLITE_OmitOrderBy)    ){      SELECTTRACE(0x100,pParse,p,                ("omit superfluous ORDER BY on %r FROM-clause subqueryn",i+1));      sqlite3ExprListDelete(db, pSub->pOrderBy);      pSub->pOrderBy = 0;    }...}

SQLITE_PRIVATE int sqlite3Select(  Parse *pParse,         /* The parser context */  Select *p,             /* The SELECT statement being coded. */  SelectDest *pDest      /* What to do with the query results */){
      ...      sqlite3VdbeResolveLabel(v, addrReset);      resetAccumulator(pParse, pAggInfo);      sqlite3VdbeAddOp2(v, OP_Integer, 0, iUseFlag);      VdbeComment((v, "indicate accumulator empty"));      ....
}