Blame SOURCES/sqlite-3.26.0-CVE-2019-19923.patch

4bd5ce
From 7d47517d579601bb6e59e33bf0896f0ed36aa0aa Mon Sep 17 00:00:00 2001
4bd5ce
From: Ondrej Dubaj <odubaj@redhat.com>
4bd5ce
Date: Mon, 20 Jan 2020 09:34:41 +0100
4bd5ce
Subject: [PATCH] Continue to back away from the LEFT JOIN optimization of
4bd5ce
 check-in
4bd5ce
4bd5ce
by disallowing query flattening if the outer query is DISTINCT.  Without this fix,
4bd5ce
if an index scan is run on the table within the view on the right-hand side of the
4bd5ce
LEFT JOIN, stale result registers might be accessed yielding incorrect results,
4bd5ce
and/or an OP_IfNullRow opcode might be invoked on the un-opened table, resulting
4bd5ce
in a NULL-pointer dereference.  This problem was found by the Yongheng and Rui fuzzer.
4bd5ce
---
4bd5ce
 src/select.c   |  8 ++++++--
4bd5ce
 test/join.test | 13 +++++++++++++
4bd5ce
 2 files changed, 19 insertions(+), 2 deletions(-)
4bd5ce
4bd5ce
diff --git a/src/select.c b/src/select.c
4bd5ce
index c60ff27..0205a08 100644
4bd5ce
--- a/src/select.c
4bd5ce
+++ b/src/select.c
4bd5ce
@@ -3569,6 +3569,7 @@ static void substSelect(
4bd5ce
 **        (3b) the FROM clause of the subquery may not contain a virtual
4bd5ce
 **             table and
4bd5ce
 **        (3c) the outer query may not be an aggregate.
4bd5ce
+**        (3d) the outer query may not be DISTINCT.
4bd5ce
 **
4bd5ce
 **   (4)  The subquery can not be DISTINCT.
4bd5ce
 **
4bd5ce
@@ -3765,8 +3766,11 @@ static int flattenSubquery(
4bd5ce
   */
4bd5ce
   if( (pSubitem->fg.jointype & JT_OUTER)!=0 ){
4bd5ce
     isLeftJoin = 1;
4bd5ce
-    if( pSubSrc->nSrc>1 || isAgg || IsVirtual(pSubSrc->a[0].pTab) ){
4bd5ce
-      /*  (3a)             (3c)     (3b) */
4bd5ce
+    if( pSubSrc->nSrc>1                   /* (3a) */
4bd5ce
+     || isAgg                             /* (3b) */
4bd5ce
+     || IsVirtual(pSubSrc->a[0].pTab)     /* (3c) */
4bd5ce
+     || (p->selFlags & SF_Distinct)!=0    /* (3d) */
4bd5ce
+    ){
4bd5ce
       return 0;
4bd5ce
     }
4bd5ce
   }
4bd5ce
diff --git a/test/join.test b/test/join.test
4bd5ce
index 8c6f463..8c6a53d 100644
4bd5ce
--- a/test/join.test
4bd5ce
+++ b/test/join.test
4bd5ce
@@ -844,4 +844,17 @@ do_execsql_test join-15.110 {
4bd5ce
    ORDER BY a1, a2, a3, a4, a5;
4bd5ce
 } {1 {} {} {} {} 1 11 {} {} {} 1 12 {} {} {} 1 12 121 {} {} 1 13 {} {} {}}
4bd5ce
 
4bd5ce
+# 2019-12-18 problem with a LEFT JOIN where the RHS is a view.
4bd5ce
+# Detected by Yongheng and Rui.
4bd5ce
+# Follows from the optimization attempt of check-in 41c27bc0ff1d3135
4bd5ce
+# on 2017-04-18
4bd5ce
+#
4bd5ce
+reset_db
4bd5ce
+do_execsql_test join-22.10 {
4bd5ce
+  CREATE TABLE t0(a, b);
4bd5ce
+  CREATE INDEX t0a ON t0(a);
4bd5ce
+  INSERT INTO t0 VALUES(10,10),(10,11),(10,12);
4bd5ce
+  SELECT DISTINCT c FROM t0 LEFT JOIN (SELECT a+1 AS c FROM t0) ORDER BY c ;
4bd5ce
+} {11}
4bd5ce
+
4bd5ce
 finish_test
4bd5ce
-- 
4bd5ce
2.19.1
4bd5ce