Blame SOURCES/sqlite-3.26.0-CVE-2019-5018.patch

4bd5ce
Subject: [PATCH] Prevent aliases of window functions expressions from being
4bd5ce
 used as arguments to aggregate or other window functions.
4bd5ce
4bd5ce
---
4bd5ce
 src/resolve.c       |  21 ++++++---
4bd5ce
 src/sqliteInt.h     |   2 +
4bd5ce
 test/windowerr.tcl  |  59 ++++++++++++++++++++++++++
4bd5ce
 test/windowerr.test | 99 ++++++++++++++++++++++++++++++++++++++++++
4bd5ce
 4 files changed, 176 insertions(+), 5 deletions(-)
4bd5ce
 create mode 100644 test/windowerr.tcl
4bd5ce
 create mode 100644 test/windowerr.test
4bd5ce
4bd5ce
diff --git a/src/resolve.c b/src/resolve.c
4bd5ce
index 0c7dfc0..cdcf4d9 100644
4bd5ce
--- a/src/resolve.c
4bd5ce
+++ b/src/resolve.c
4bd5ce
@@ -436,6 +436,10 @@ static int lookupName(
4bd5ce
             sqlite3ErrorMsg(pParse, "misuse of aliased aggregate %s", zAs);
4bd5ce
             return WRC_Abort;
4bd5ce
           }
4bd5ce
+          if( (pNC->ncFlags&NC_AllowWin)==0 && ExprHasProperty(pOrig, EP_Win) ){
4bd5ce
+            sqlite3ErrorMsg(pParse, "misuse of aliased window function %s",zAs);
4bd5ce
+            return WRC_Abort;
4bd5ce
+          }
4bd5ce
           if( sqlite3ExprVectorSize(pOrig)!=1 ){
4bd5ce
             sqlite3ErrorMsg(pParse, "row value misused");
4bd5ce
             return WRC_Abort;
4bd5ce
@@ -707,6 +711,7 @@ static int resolveExprStep(Walker *pWalker, Expr *pExpr){
4bd5ce
       const char *zId;            /* The function name. */
4bd5ce
       FuncDef *pDef;              /* Information about the function */
4bd5ce
       u8 enc = ENC(pParse->db);   /* The database encoding */
4bd5ce
+      int savedAllowFlags = (pNC->ncFlags & (NC_AllowAgg | NC_AllowWin));
4bd5ce
 
4bd5ce
       assert( !ExprHasProperty(pExpr, EP_xIsSelect) );
4bd5ce
       zId = pExpr->u.zToken;
4bd5ce
@@ -828,8 +833,11 @@ static int resolveExprStep(Walker *pWalker, Expr *pExpr){
4bd5ce
           pNC->nErr++;
4bd5ce
         }
4bd5ce
         if( is_agg ){
4bd5ce
+          /* Window functions may not be arguments of aggregate functions.
4bd5ce
+          ** Or arguments of other window functions. But aggregate functions
4bd5ce
+          ** may be arguments for window functions.  */
4bd5ce
 #ifndef SQLITE_OMIT_WINDOWFUNC
4bd5ce
-          pNC->ncFlags &= ~(pExpr->y.pWin ? NC_AllowWin : NC_AllowAgg);
4bd5ce
+          pNC->ncFlags &= ~(NC_AllowWin | (!pExpr->y.pWin ? NC_AllowAgg : 0));
4bd5ce
 #else
4bd5ce
           pNC->ncFlags &= ~NC_AllowAgg;
4bd5ce
 #endif
4bd5ce
@@ -850,7 +858,7 @@ static int resolveExprStep(Walker *pWalker, Expr *pExpr){
4bd5ce
             pExpr->y.pWin->pNextWin = pSel->pWin;
4bd5ce
             pSel->pWin = pExpr->y.pWin;
4bd5ce
           }
4bd5ce
-          pNC->ncFlags |= NC_AllowWin;
4bd5ce
+          pNC->ncFlags |= NC_HasWin;
4bd5ce
         }else
4bd5ce
 #endif /* SQLITE_OMIT_WINDOWFUNC */
4bd5ce
         {
4bd5ce
@@ -868,8 +876,8 @@ static int resolveExprStep(Walker *pWalker, Expr *pExpr){
4bd5ce
             pNC2->ncFlags |= NC_HasAgg | (pDef->funcFlags & SQLITE_FUNC_MINMAX);
4bd5ce
 
4bd5ce
           }
4bd5ce
-          pNC->ncFlags |= NC_AllowAgg;
4bd5ce
         }
4bd5ce
+        pNC->ncFlags |= savedAllowFlags;
4bd5ce
       }
4bd5ce
       /* FIX ME:  Compute pExpr->affinity based on the expected return
4bd5ce
       ** type of the function 
4bd5ce
@@ -1573,8 +1581,8 @@ int sqlite3ResolveExprNames(
4bd5ce
   Walker w;
4bd5ce
 
4bd5ce
   if( pExpr==0 ) return SQLITE_OK;
4bd5ce
-  savedHasAgg = pNC->ncFlags & (NC_HasAgg|NC_MinMaxAgg);
4bd5ce
-  pNC->ncFlags &= ~(NC_HasAgg|NC_MinMaxAgg);
4bd5ce
+  savedHasAgg = pNC->ncFlags & (NC_HasAgg|NC_MinMaxAgg|NC_HasWin);
4bd5ce
+  pNC->ncFlags &= ~(NC_HasAgg|NC_MinMaxAgg|NC_HasWin);
4bd5ce
   w.pParse = pNC->pParse;
4bd5ce
   w.xExprCallback = resolveExprStep;
4bd5ce
   w.xSelectCallback = resolveSelectStep;
4bd5ce
@@ -1593,6 +1601,9 @@ int sqlite3ResolveExprNames(
4bd5ce
   if( pNC->ncFlags & NC_HasAgg ){
4bd5ce
     ExprSetProperty(pExpr, EP_Agg);
4bd5ce
   }
4bd5ce
+  if( pNC->ncFlags & NC_HasWin ){
4bd5ce
+    ExprSetProperty(pExpr, EP_Win);
4bd5ce
+  }
4bd5ce
   pNC->ncFlags |= savedHasAgg;
4bd5ce
   return pNC->nErr>0 || w.pParse->nErr>0;
4bd5ce
 }
4bd5ce
diff --git a/src/sqliteInt.h b/src/sqliteInt.h
4bd5ce
index 5f5f3cc..b7d3571 100644
4bd5ce
--- a/src/sqliteInt.h
4bd5ce
+++ b/src/sqliteInt.h
4bd5ce
@@ -2517,6 +2517,7 @@ struct Expr {
4bd5ce
 #define EP_Alias     0x400000 /* Is an alias for a result set column */
4bd5ce
 #define EP_Leaf      0x800000 /* Expr.pLeft, .pRight, .u.pSelect all NULL */
4bd5ce
 #define EP_WinFunc  0x1000000 /* TK_FUNCTION with Expr.y.pWin set */
4bd5ce
+#define EP_Win      0x8000000 /* Contains window functions */
4bd5ce
 
4bd5ce
 /*
4bd5ce
 ** The EP_Propagate mask is a set of properties that automatically propagate
4bd5ce
@@ -2773,6 +2774,7 @@ struct NameContext {
4bd5ce
 #define NC_MinMaxAgg 0x1000  /* min/max aggregates seen.  See note above */
4bd5ce
 #define NC_Complex   0x2000  /* True if a function or subquery seen */
4bd5ce
 #define NC_AllowWin  0x4000  /* Window functions are allowed here */
4bd5ce
+#define NC_HasWin    0x8000  /* One or more window functions seen */
4bd5ce
 
4bd5ce
 /*
4bd5ce
 ** An instance of the following object describes a single ON CONFLICT
4bd5ce
diff --git a/test/windowerr.tcl b/test/windowerr.tcl
4bd5ce
new file mode 100644
4bd5ce
index 0000000..80f464d
4bd5ce
--- /dev/null
4bd5ce
+++ b/test/windowerr.tcl
4bd5ce
@@ -0,0 +1,59 @@
4bd5ce
+# 2018 May 19
4bd5ce
+#
4bd5ce
+# The author disclaims copyright to this source code.  In place of
4bd5ce
+# a legal notice, here is a blessing:
4bd5ce
+#
4bd5ce
+#    May you do good and not evil.
4bd5ce
+#    May you find forgiveness for yourself and forgive others.
4bd5ce
+#    May you share freely, never taking more than you give.
4bd5ce
+#
4bd5ce
+#***********************************************************************
4bd5ce
+#
4bd5ce
+
4bd5ce
+source [file join [file dirname $argv0] pg_common.tcl]
4bd5ce
+
4bd5ce
+#=========================================================================
4bd5ce
+
4bd5ce
+start_test windowerr "2019 March 01"
4bd5ce
+ifcapable !windowfunc
4bd5ce
+
4bd5ce
+execsql_test 1.0 {
4bd5ce
+  DROP TABLE IF EXISTS t1;
4bd5ce
+  CREATE TABLE t1(a INTEGER, b INTEGER);
4bd5ce
+  INSERT INTO t1 VALUES(1, 1);
4bd5ce
+  INSERT INTO t1 VALUES(2, 2);
4bd5ce
+  INSERT INTO t1 VALUES(3, 3);
4bd5ce
+  INSERT INTO t1 VALUES(4, 4);
4bd5ce
+  INSERT INTO t1 VALUES(5, 5);
4bd5ce
+}
4bd5ce
+
4bd5ce
+foreach {tn frame} {
4bd5ce
+  1 "ORDER BY a ROWS BETWEEN -1 PRECEDING AND 1 FOLLOWING"
4bd5ce
+  2 "ORDER BY a ROWS BETWEEN  1 PRECEDING AND -1 FOLLOWING"
4bd5ce
+
4bd5ce
+  3 "ORDER BY a RANGE BETWEEN -1 PRECEDING AND 1 FOLLOWING"
4bd5ce
+  4 "ORDER BY a RANGE BETWEEN  1 PRECEDING AND -1 FOLLOWING"
4bd5ce
+
4bd5ce
+  5 "ORDER BY a GROUPS BETWEEN -1 PRECEDING AND 1 FOLLOWING"
4bd5ce
+  6 "ORDER BY a GROUPS BETWEEN  1 PRECEDING AND -1 FOLLOWING"
4bd5ce
+
4bd5ce
+  7 "ORDER BY a,b RANGE BETWEEN  1 PRECEDING AND 1 FOLLOWING"
4bd5ce
+
4bd5ce
+  8 "PARTITION BY a RANGE BETWEEN  1 PRECEDING AND 1 FOLLOWING"
4bd5ce
+} {
4bd5ce
+  errorsql_test 1.$tn "
4bd5ce
+  SELECT a, sum(b) OVER (
4bd5ce
+    $frame
4bd5ce
+  ) FROM t1 ORDER BY 1
4bd5ce
+  "
4bd5ce
+}
4bd5ce
+errorsql_test 2.1 {
4bd5ce
+  SELECT sum( sum(a) OVER () ) FROM t1;
4bd5ce
+}
4bd5ce
+
4bd5ce
+errorsql_test 2.2 {
4bd5ce
+  SELECT sum(a) OVER () AS xyz FROM t1 ORDER BY sum(xyz);
4bd5ce
+}
4bd5ce
+
4bd5ce
+
4bd5ce
+finish_test
4bd5ce
diff --git a/test/windowerr.test b/test/windowerr.test
4bd5ce
new file mode 100644
4bd5ce
index 0000000..97dae64
4bd5ce
--- /dev/null
4bd5ce
+++ b/test/windowerr.test
4bd5ce
@@ -0,0 +1,99 @@
4bd5ce
+# 2019 March 01
4bd5ce
+#
4bd5ce
+# The author disclaims copyright to this source code.  In place of
4bd5ce
+# a legal notice, here is a blessing:
4bd5ce
+#
4bd5ce
+#    May you do good and not evil.
4bd5ce
+#    May you find forgiveness for yourself and forgive others.
4bd5ce
+#    May you share freely, never taking more than you give.
4bd5ce
+#
4bd5ce
+#***********************************************************************
4bd5ce
+# This file implements regression tests for SQLite library.
4bd5ce
+#
4bd5ce
+
4bd5ce
+####################################################
4bd5ce
+# DO NOT EDIT! THIS FILE IS AUTOMATICALLY GENERATED!
4bd5ce
+####################################################
4bd5ce
+
4bd5ce
+set testdir [file dirname $argv0]
4bd5ce
+source $testdir/tester.tcl
4bd5ce
+set testprefix windowerr
4bd5ce
+
4bd5ce
+ifcapable !windowfunc { finish_test ; return }
4bd5ce
+do_execsql_test 1.0 {
4bd5ce
+  DROP TABLE IF EXISTS t1;
4bd5ce
+  CREATE TABLE t1(a INTEGER, b INTEGER);
4bd5ce
+  INSERT INTO t1 VALUES(1, 1);
4bd5ce
+  INSERT INTO t1 VALUES(2, 2);
4bd5ce
+  INSERT INTO t1 VALUES(3, 3);
4bd5ce
+  INSERT INTO t1 VALUES(4, 4);
4bd5ce
+  INSERT INTO t1 VALUES(5, 5);
4bd5ce
+} {}
4bd5ce
+
4bd5ce
+# PG says ERROR:  frame starting offset must not be negative
4bd5ce
+do_test 1.1 { catch { execsql {
4bd5ce
+  SELECT a, sum(b) OVER (
4bd5ce
+    ORDER BY a ROWS BETWEEN -1 PRECEDING AND 1 FOLLOWING
4bd5ce
+  ) FROM t1 ORDER BY 1
4bd5ce
+} } } 1
4bd5ce
+
4bd5ce
+# PG says ERROR:  frame ending offset must not be negative
4bd5ce
+do_test 1.2 { catch { execsql {
4bd5ce
+  SELECT a, sum(b) OVER (
4bd5ce
+    ORDER BY a ROWS BETWEEN  1 PRECEDING AND -1 FOLLOWING
4bd5ce
+  ) FROM t1 ORDER BY 1
4bd5ce
+} } } 1
4bd5ce
+
4bd5ce
+# PG says ERROR:  invalid preceding or following size in window function
4bd5ce
+do_test 1.3 { catch { execsql {
4bd5ce
+  SELECT a, sum(b) OVER (
4bd5ce
+    ORDER BY a RANGE BETWEEN -1 PRECEDING AND 1 FOLLOWING
4bd5ce
+  ) FROM t1 ORDER BY 1
4bd5ce
+} } } 1
4bd5ce
+
4bd5ce
+# PG says ERROR:  invalid preceding or following size in window function
4bd5ce
+do_test 1.4 { catch { execsql {
4bd5ce
+  SELECT a, sum(b) OVER (
4bd5ce
+    ORDER BY a RANGE BETWEEN  1 PRECEDING AND -1 FOLLOWING
4bd5ce
+  ) FROM t1 ORDER BY 1
4bd5ce
+} } } 1
4bd5ce
+
4bd5ce
+# PG says ERROR:  frame starting offset must not be negative
4bd5ce
+do_test 1.5 { catch { execsql {
4bd5ce
+  SELECT a, sum(b) OVER (
4bd5ce
+    ORDER BY a GROUPS BETWEEN -1 PRECEDING AND 1 FOLLOWING
4bd5ce
+  ) FROM t1 ORDER BY 1
4bd5ce
+} } } 1
4bd5ce
+
4bd5ce
+# PG says ERROR:  frame ending offset must not be negative
4bd5ce
+do_test 1.6 { catch { execsql {
4bd5ce
+  SELECT a, sum(b) OVER (
4bd5ce
+    ORDER BY a GROUPS BETWEEN  1 PRECEDING AND -1 FOLLOWING
4bd5ce
+  ) FROM t1 ORDER BY 1
4bd5ce
+} } } 1
4bd5ce
+
4bd5ce
+# PG says ERROR:  RANGE with offset PRECEDING/FOLLOWING requires exactly one ORDER BY column
4bd5ce
+do_test 1.7 { catch { execsql {
4bd5ce
+  SELECT a, sum(b) OVER (
4bd5ce
+    ORDER BY a,b RANGE BETWEEN  1 PRECEDING AND 1 FOLLOWING
4bd5ce
+  ) FROM t1 ORDER BY 1
4bd5ce
+} } } 1
4bd5ce
+
4bd5ce
+# PG says ERROR:  RANGE with offset PRECEDING/FOLLOWING requires exactly one ORDER BY column
4bd5ce
+do_test 1.8 { catch { execsql {
4bd5ce
+  SELECT a, sum(b) OVER (
4bd5ce
+    PARTITION BY a RANGE BETWEEN  1 PRECEDING AND 1 FOLLOWING
4bd5ce
+  ) FROM t1 ORDER BY 1
4bd5ce
+} } } 1
4bd5ce
+
4bd5ce
+# PG says ERROR:  aggregate function calls cannot contain window function calls
4bd5ce
+do_test 2.1 { catch { execsql {
4bd5ce
+  SELECT sum( sum(a) OVER () ) FROM t1;
4bd5ce
+} } } 1
4bd5ce
+
4bd5ce
+# PG says ERROR:  column "xyz" does not exist
4bd5ce
+do_test 2.2 { catch { execsql {
4bd5ce
+  SELECT sum(a) OVER () AS xyz FROM t1 ORDER BY sum(xyz);
4bd5ce
+} } } 1
4bd5ce
+
4bd5ce
+finish_test
4bd5ce
-- 
4bd5ce
2.24.1
4bd5ce