From 7d47517d579601bb6e59e33bf0896f0ed36aa0aa Mon Sep 17 00:00:00 2001

From: Ondrej Dubaj <odubaj@redhat.com>

Date: Mon, 20 Jan 2020 09:34:41 +0100

Subject: [PATCH] Continue to back away from the LEFT JOIN optimization of

 check-in

by disallowing query flattening if the outer query is DISTINCT.  Without this fix,

if an index scan is run on the table within the view on the right-hand side of the

LEFT JOIN, stale result registers might be accessed yielding incorrect results,

and/or an OP_IfNullRow opcode might be invoked on the un-opened table, resulting

in a NULL-pointer dereference.  This problem was found by the Yongheng and Rui fuzzer.

---

 src/select.c   |  8 ++++++--

 test/join.test | 13 +++++++++++++

 2 files changed, 19 insertions(+), 2 deletions(-)

diff --git a/src/select.c b/src/select.c

index c60ff27..0205a08 100644

--- a/src/select.c

+++ b/src/select.c

@@ -3569,6 +3569,7 @@ static void substSelect(

 **        (3b) the FROM clause of the subquery may not contain a virtual

 **             table and

 **        (3c) the outer query may not be an aggregate.

+**        (3d) the outer query may not be DISTINCT.

 **

 **   (4)  The subquery can not be DISTINCT.

 **

@@ -3765,8 +3766,11 @@ static int flattenSubquery(

   */

   if( (pSubitem->fg.jointype & JT_OUTER)!=0 ){

     isLeftJoin = 1;

-    if( pSubSrc->nSrc>1 || isAgg || IsVirtual(pSubSrc->a[0].pTab) ){

-      /*  (3a)             (3c)     (3b) */

+    if( pSubSrc->nSrc>1                   /* (3a) */

+     || isAgg                             /* (3b) */

+     || IsVirtual(pSubSrc->a[0].pTab)     /* (3c) */

+     || (p->selFlags & SF_Distinct)!=0    /* (3d) */

+    ){

       return 0;

     }

   }

diff --git a/test/join.test b/test/join.test

index 8c6f463..8c6a53d 100644

--- a/test/join.test

+++ b/test/join.test

@@ -844,4 +844,17 @@ do_execsql_test join-15.110 {

    ORDER BY a1, a2, a3, a4, a5;

 } {1 {} {} {} {} 1 11 {} {} {} 1 12 {} {} {} 1 12 121 {} {} 1 13 {} {} {}}

+# 2019-12-18 problem with a LEFT JOIN where the RHS is a view.

+# Detected by Yongheng and Rui.

+# Follows from the optimization attempt of check-in 41c27bc0ff1d3135

+# on 2017-04-18

+#

+reset_db

+do_execsql_test join-22.10 {

+  CREATE TABLE t0(a, b);

+  CREATE INDEX t0a ON t0(a);

+  INSERT INTO t0 VALUES(10,10),(10,11),(10,12);

+  SELECT DISTINCT c FROM t0 LEFT JOIN (SELECT a+1 AS c FROM t0) ORDER BY c ;

+} {11}

+

 finish_test

-- 

2.19.1