#99748 catch runtime errors occurring when user input for the MATCH operator is not a proper regex

lib/DBD/SQLite/VirtualTable/PerlData.pm

@@ -214,7 +214,14 @@ sub NEXT {
 
   do {
     $self->{row_ix} += 1
-  } until $self->EOF || $self->{is_wanted_row}->($self, $self->{row_ix});
+  } until $self->EOF
+       || eval {$self->{is_wanted_row}->($self, $self->{row_ix})};
+
+  # NOTE: the eval above is required for cases when user data, injected
+  # into Perl comparison operators, generates errors; for example
+  # WHERE col MATCH '(foo' will die because the regex is not well formed
+  # (no matching parenthesis). In such cases no row is selected and the
+  # query just returns an empty list.
 }
 
 

t/virtual_table/rt_99748.t

@@ -12,7 +12,8 @@ use Test::NoWarnings;
 # tests that the MATCH operator does not allow code injection
 my @interpolation_attempts = (
   '@{[die -1]}',
-  # '(?{die 999})', # Eval-group not allowed at runtime
+  '(foobar',      # will die - incorrect regex
+  '(?{die 999})', # will die - Eval-group not allowed at runtime
   '$foobar',
   '$self->{row_ix}',
   '$main::ARGV[ die 999 ]',