Blame SOURCES/sqlite-3.26.0-CVE-2019-16168.patch

4bd5ce
From ab17169870e985b062e520ecf95e6c79ad784f38 Mon Sep 17 00:00:00 2001
4bd5ce
From: Ondrej Dubaj <odubaj@redhat.com>
4bd5ce
Date: Thu, 23 Apr 2020 11:25:13 +0200
4bd5ce
Subject: [PATCH] fixed CVE-2019-16168 (rhbz#1826897)
4bd5ce
4bd5ce
---
4bd5ce
 src/analyze.c      |  4 +++-
4bd5ce
 src/where.c        |  1 +
4bd5ce
 test/analyzeC.test | 13 +++++++++++++
4bd5ce
 3 files changed, 17 insertions(+), 1 deletion(-)
4bd5ce
4bd5ce
diff --git a/src/analyze.c b/src/analyze.c
4bd5ce
index 5075b57..e47c0f5 100644
4bd5ce
--- a/src/analyze.c
4bd5ce
+++ b/src/analyze.c
4bd5ce
@@ -1497,7 +1497,9 @@ static void decodeIntArray(
4bd5ce
       if( sqlite3_strglob("unordered*", z)==0 ){
4bd5ce
         pIndex->bUnordered = 1;
4bd5ce
       }else if( sqlite3_strglob("sz=[0-9]*", z)==0 ){
4bd5ce
-        pIndex->szIdxRow = sqlite3LogEst(sqlite3Atoi(z+3));
4bd5ce
+        int sz = sqlite3Atoi(z+3);
4bd5ce
+        if( sz<2 ) sz = 2;
4bd5ce
+        pIndex->szIdxRow = sqlite3LogEst(sz); 
4bd5ce
       }else if( sqlite3_strglob("noskipscan*", z)==0 ){
4bd5ce
         pIndex->noSkipScan = 1;
4bd5ce
       }
4bd5ce
diff --git a/src/where.c b/src/where.c
4bd5ce
index 8e01660..1a4fa51 100644
4bd5ce
--- a/src/where.c
4bd5ce
+++ b/src/where.c
4bd5ce
@@ -2655,6 +2655,7 @@ static int whereLoopAddBtreeIndex(
4bd5ce
     ** it to pNew->rRun, which is currently set to the cost of the index
4bd5ce
     ** seek only. Then, if this is a non-covering index, add the cost of
4bd5ce
     ** visiting the rows in the main table.  */
4bd5ce
+    assert( pSrc->pTab->szTabRow>0 );
4bd5ce
     rCostIdx = pNew->nOut + 1 + (15*pProbe->szIdxRow)/pSrc->pTab->szTabRow;
4bd5ce
     pNew->rRun = sqlite3LogEstAdd(rLogSize, rCostIdx);
4bd5ce
     if( (pNew->wsFlags & (WHERE_IDX_ONLY|WHERE_IPK))==0 ){
4bd5ce
diff --git a/test/analyzeC.test b/test/analyzeC.test
4bd5ce
index 02faa9c..3595c9d 100644
4bd5ce
--- a/test/analyzeC.test
4bd5ce
+++ b/test/analyzeC.test
4bd5ce
@@ -132,6 +132,19 @@ do_execsql_test 4.3 {
4bd5ce
   SELECT count(a) FROM t1;
4bd5ce
 } {/.*INDEX t1ca.*/}
4bd5ce
 
4bd5ce
+# 2019-08-15.
4bd5ce
+# Ticket https://www.sqlite.org/src/tktview/e4598ecbdd18bd82945f602901
4bd5ce
+# The sz=N parameter in the sqlite_stat1 table needs to have a value of
4bd5ce
+# 2 or more to avoid a division by zero in the query planner.
4bd5ce
+#
4bd5ce
+do_execsql_test 4.4 {
4bd5ce
+  DROP TABLE IF EXISTS t44;
4bd5ce
+  CREATE TABLE t44(a PRIMARY KEY);
4bd5ce
+  INSERT INTO sqlite_stat1 VALUES('t44',null,'sz=0');
4bd5ce
+  ANALYZE sqlite_master;
4bd5ce
+  SELECT 0 FROM t44 WHERE a IN(1,2,3);
4bd5ce
+} {} 
4bd5ce
+
4bd5ce
 
4bd5ce
 # The sz=NNN parameter works even if there is other extraneous text
4bd5ce
 # in the sqlite_stat1.stat column.
4bd5ce
-- 
4bd5ce
2.24.1
4bd5ce