Blame SOURCES/sqlite-3.26.0-CVE-2019-20218.patch

7d97b9
From ff5f246e41239cc4dd33ffa73883fa07f78674e1 Mon Sep 17 00:00:00 2001
7d97b9
From: Ondrej Dubaj <odubaj@redhat.com>
7d97b9
Date: Fri, 7 Aug 2020 07:00:29 +0200
7d97b9
Subject: [PATCH] Do not attempt to unwind the WITH stack in the Parse object
7d97b9
 following an error.
7d97b9
7d97b9
---
7d97b9
 src/select.c        |  5 ++++-
7d97b9
 src/util.c          |  1 +
7d97b9
 test/altertab2.test | 20 ++++++++++++++++++++
7d97b9
 test/with3.test     | 10 +++++++++-
7d97b9
 4 files changed, 34 insertions(+), 2 deletions(-)
7d97b9
7d97b9
diff --git a/src/select.c b/src/select.c
7d97b9
index c46f177..a6d1757 100644
7d97b9
--- a/src/select.c
7d97b9
+++ b/src/select.c
7d97b9
@@ -4639,6 +4639,9 @@ static int withExpand(
7d97b9
   With *pWith;                    /* WITH clause that pCte belongs to */
7d97b9
 
7d97b9
   assert( pFrom->pTab==0 );
7d97b9
+  if( pParse->nErr ){
7d97b9
+    return SQLITE_ERROR;
7d97b9
+  }
7d97b9
 
7d97b9
   pCte = searchWith(pParse->pWith, pFrom, &pWith);
7d97b9
   if( pCte ){
7d97b9
@@ -4908,7 +4911,7 @@ static int selectExpander(Walker *pWalker, Select *p){
7d97b9
 
7d97b9
   /* Process NATURAL keywords, and ON and USING clauses of joins.
7d97b9
   */
7d97b9
-  if( db->mallocFailed || sqliteProcessJoin(pParse, p) ){
7d97b9
+  if( pParse->nErr || db->mallocFailed || sqliteProcessJoin(pParse, p) ){
7d97b9
     return WRC_Abort;
7d97b9
   }
7d97b9
 
7d97b9
diff --git a/src/util.c b/src/util.c
7d97b9
index 54f9b93..96b0b14 100644
7d97b9
--- a/src/util.c
7d97b9
+++ b/src/util.c
7d97b9
@@ -222,6 +222,7 @@ void sqlite3ErrorMsg(Parse *pParse, const char *zFormat, ...){
7d97b9
     sqlite3DbFree(db, pParse->zErrMsg);
7d97b9
     pParse->zErrMsg = zMsg;
7d97b9
     pParse->rc = SQLITE_ERROR;
7d97b9
+    pParse->pWith = 0;
7d97b9
   }
7d97b9
 }
7d97b9
 
7d97b9
diff --git a/test/altertab2.test b/test/altertab2.test
7d97b9
index 2e4212c..2102e02 100644
7d97b9
--- a/test/altertab2.test
7d97b9
+++ b/test/altertab2.test
7d97b9
@@ -85,5 +85,25 @@ do_execsql_test 2.3 {
7d97b9
   {CREATE TABLE c3(x, FOREIGN KEY (x) REFERENCES "p3"(a))}
7d97b9
 }
7d97b9
 
7d97b9
+#------------------------------------------------------------------------
7d97b9
+#
7d97b9
+reset_db
7d97b9
+do_execsql_test 3.0 {
7d97b9
+  CREATE TABLE v0 (a);
7d97b9
+  CREATE VIEW v2 (v3) AS 
7d97b9
+    WITH x1 AS (SELECT * FROM v2) 
7d97b9
+    SELECT v3 AS x, v3 AS y FROM v2; 
7d97b9
+}
7d97b9
+
7d97b9
+do_catchsql_test 3.1 {
7d97b9
+  SELECT * FROM v2
7d97b9
+} {1 {view v2 is circularly defined}}
7d97b9
+
7d97b9
+db close
7d97b9
+sqlite3 db test.db
7d97b9
+
7d97b9
+do_catchsql_test 3.2 {
7d97b9
+  ALTER TABLE v0 RENAME TO t3 ;
7d97b9
+} {1 {error in view v2: view v2 is circularly defined}}
7d97b9
 
7d97b9
 finish_test
7d97b9
diff --git a/test/with3.test b/test/with3.test
7d97b9
index de150b1..4a3a5a7 100644
7d97b9
--- a/test/with3.test
7d97b9
+++ b/test/with3.test
7d97b9
@@ -30,7 +30,15 @@ do_catchsql_test 1.0 {
7d97b9
     SELECT 5 FROM t0 UNION SELECT 8 FROM m
7d97b9
   )
7d97b9
   SELECT * FROM i;
7d97b9
-} {1 {no such table: m}}
7d97b9
+} {1 {no such table: t0}}
7d97b9
+
7d97b9
+# 2019-11-09 dbfuzzcheck find
7d97b9
+do_catchsql_test 1.1 {
7d97b9
+  CREATE VIEW v1(x,y) AS
7d97b9
+    WITH t1(a,b) AS (VALUES(1,2))
7d97b9
+    SELECT * FROM nosuchtable JOIN t1;
7d97b9
+  SELECT * FROM v1;
7d97b9
+} {1 {no such table: main.nosuchtable}}
7d97b9
 
7d97b9
 # Additional test cases that came out of the work to
7d97b9
 # fix for Kostya's problem.
7d97b9
-- 
7d97b9
2.26.0
7d97b9