Blame SOURCES/sqlite-3.26.0-CVE-2019-19923.patch

032533
From 7d47517d579601bb6e59e33bf0896f0ed36aa0aa Mon Sep 17 00:00:00 2001
032533
From: Ondrej Dubaj <odubaj@redhat.com>
032533
Date: Mon, 20 Jan 2020 09:34:41 +0100
032533
Subject: [PATCH] Continue to back away from the LEFT JOIN optimization of
032533
 check-in
032533
032533
by disallowing query flattening if the outer query is DISTINCT.  Without this fix,
032533
if an index scan is run on the table within the view on the right-hand side of the
032533
LEFT JOIN, stale result registers might be accessed yielding incorrect results,
032533
and/or an OP_IfNullRow opcode might be invoked on the un-opened table, resulting
032533
in a NULL-pointer dereference.  This problem was found by the Yongheng and Rui fuzzer.
032533
---
032533
 src/select.c   |  8 ++++++--
032533
 test/join.test | 13 +++++++++++++
032533
 2 files changed, 19 insertions(+), 2 deletions(-)
032533
032533
diff --git a/src/select.c b/src/select.c
032533
index c60ff27..0205a08 100644
032533
--- a/src/select.c
032533
+++ b/src/select.c
032533
@@ -3569,6 +3569,7 @@ static void substSelect(
032533
 **        (3b) the FROM clause of the subquery may not contain a virtual
032533
 **             table and
032533
 **        (3c) the outer query may not be an aggregate.
032533
+**        (3d) the outer query may not be DISTINCT.
032533
 **
032533
 **   (4)  The subquery can not be DISTINCT.
032533
 **
032533
@@ -3765,8 +3766,11 @@ static int flattenSubquery(
032533
   */
032533
   if( (pSubitem->fg.jointype & JT_OUTER)!=0 ){
032533
     isLeftJoin = 1;
032533
-    if( pSubSrc->nSrc>1 || isAgg || IsVirtual(pSubSrc->a[0].pTab) ){
032533
-      /*  (3a)             (3c)     (3b) */
032533
+    if( pSubSrc->nSrc>1                   /* (3a) */
032533
+     || isAgg                             /* (3b) */
032533
+     || IsVirtual(pSubSrc->a[0].pTab)     /* (3c) */
032533
+     || (p->selFlags & SF_Distinct)!=0    /* (3d) */
032533
+    ){
032533
       return 0;
032533
     }
032533
   }
032533
diff --git a/test/join.test b/test/join.test
032533
index 8c6f463..8c6a53d 100644
032533
--- a/test/join.test
032533
+++ b/test/join.test
032533
@@ -844,4 +844,17 @@ do_execsql_test join-15.110 {
032533
    ORDER BY a1, a2, a3, a4, a5;
032533
 } {1 {} {} {} {} 1 11 {} {} {} 1 12 {} {} {} 1 12 121 {} {} 1 13 {} {} {}}
032533
 
032533
+# 2019-12-18 problem with a LEFT JOIN where the RHS is a view.
032533
+# Detected by Yongheng and Rui.
032533
+# Follows from the optimization attempt of check-in 41c27bc0ff1d3135
032533
+# on 2017-04-18
032533
+#
032533
+reset_db
032533
+do_execsql_test join-22.10 {
032533
+  CREATE TABLE t0(a, b);
032533
+  CREATE INDEX t0a ON t0(a);
032533
+  INSERT INTO t0 VALUES(10,10),(10,11),(10,12);
032533
+  SELECT DISTINCT c FROM t0 LEFT JOIN (SELECT a+1 AS c FROM t0) ORDER BY c ;
032533
+} {11}
032533
+
032533
 finish_test
032533
-- 
032533
2.19.1
032533