Fix a problem in fts3_write.c causing stack memory to be referenced after it is out of scope

third_party/sqlite/src/ext/fts3/fts3_write.c

 /*
 ** 2009 Oct 23
 **
 ** The author disclaims copyright to this source code.  In place of
 ** a legal notice, here is a blessing:
 **
 **    May you do good and not evil.
 **    May you find forgiveness for yourself and forgive others.
 **    May you share freely, never taking more than you give.
 **
@@ skipping 1220 matching lines @@
 ** a subset of the terms stored in the Fts3Table.pendingTerms array.
 */
 int sqlite3Fts3SegReaderPending(
   Fts3Table *p,                   /* Virtual table handle */
   const char *zTerm,              /* Term to search for */
   int nTerm,                      /* Size of buffer zTerm */
   int isPrefix,                   /* True for a term-prefix query */
   Fts3SegReader **ppReader        /* OUT: SegReader for pending-terms */
 ){
   Fts3SegReader *pReader = 0;     /* Fts3SegReader object to return */
+  Fts3HashElem *pE;               /* Iterator variable */
   Fts3HashElem **aElem = 0;       /* Array of term hash entries to scan */
   int nElem = 0;                  /* Size of array at aElem */
   int rc = SQLITE_OK;             /* Return Code */
 
   if( isPrefix ){
     int nAlloc = 0;               /* Size of allocated array at aElem */
-    Fts3HashElem *pE = 0;         /* Iterator variable */
 
     for(pE=fts3HashFirst(&p->pendingTerms); pE; pE=fts3HashNext(pE)){
       char *zKey = (char *)fts3HashKey(pE);
       int nKey = fts3HashKeysize(pE);
       if( nTerm==0 || (nKey>=nTerm && 0==memcmp(zKey, zTerm, nTerm)) ){
         if( nElem==nAlloc ){
           Fts3HashElem **aElem2;
           nAlloc += 16;
           aElem2 = (Fts3HashElem **)sqlite3_realloc(
               aElem, nAlloc*sizeof(Fts3HashElem *)
@@ skipping 11 matching lines @@
 
     /* If more than one term matches the prefix, sort the Fts3HashElem
     ** objects in term order using qsort(). This uses the same comparison
     ** callback as is used when flushing terms to disk.
     */
     if( nElem>1 ){
       qsort(aElem, nElem, sizeof(Fts3HashElem *), fts3CompareElemByTerm);
     }
 
   }else{
-    Fts3HashElem *pE = fts3HashFindElem(&p->pendingTerms, zTerm, nTerm);
+    pE = fts3HashFindElem(&p->pendingTerms, zTerm, nTerm);
     if( pE ){
       aElem = &pE;
       nElem = 1;
     }
   }
 
   if( nElem>0 ){
     int nByte = sizeof(Fts3SegReader) + (nElem+1)*sizeof(Fts3HashElem *);
     pReader = (Fts3SegReader *)sqlite3_malloc(nByte);
     if( !pReader ){
@@ skipping 1428 matching lines @@
     }else{
       sqlite3_exec(p->db, "ROLLBACK TO fts3", 0, 0, 0);
       sqlite3_exec(p->db, "RELEASE fts3", 0, 0, 0);
     }
   }
   sqlite3Fts3SegmentsClose(p);
   return rc;
 }
 
 #endif