Blame SOURCES/sqlite-3.26.0-CVE-2020-13631.patch

7d97b9
Subject: [PATCH] Do not allow a virtual table to be renamed into the name of
7d97b9
 one of its shadows.
7d97b9
7d97b9
---
7d97b9
 src/alter.c     |  5 ++++-
3d6205
 src/build.c     | 29 +++++++++++++++++++++++------
7d97b9
 src/sqliteInt.h |  5 +++++
3d6205
 3 files changed, 32 insertions(+), 7 deletions(-)
7d97b9
7d97b9
diff --git a/src/alter.c b/src/alter.c
7d97b9
index 1280e90..0fa24c0 100644
7d97b9
--- a/src/alter.c
7d97b9
+++ b/src/alter.c
7d97b9
@@ -117,7 +117,10 @@ void sqlite3AlterRenameTable(
7d97b9
   /* Check that a table or index named 'zName' does not already exist
7d97b9
   ** in database iDb. If so, this is an error.
7d97b9
   */
7d97b9
-  if( sqlite3FindTable(db, zName, zDb) || sqlite3FindIndex(db, zName, zDb) ){
7d97b9
+  if( sqlite3FindTable(db, zName, zDb)
7d97b9
+   || sqlite3FindIndex(db, zName, zDb)
7d97b9
+   || sqlite3IsShadowTableOf(db, pTab, zName)
7d97b9
+  ){
7d97b9
     sqlite3ErrorMsg(pParse, 
7d97b9
         "there is already another table or index with this name: %s", zName);
7d97b9
     goto exit_rename_table;
7d97b9
diff --git a/src/build.c b/src/build.c
3d6205
index e0fed8a..afe4171 100644
7d97b9
--- a/src/build.c
7d97b9
+++ b/src/build.c
3d6205
@@ -1899,6 +1899,28 @@ static void convertToWithoutRowidTable(Parse *pParse, Table *pTab){
7d97b9
   recomputeColumnsNotIndexed(pPk);
7d97b9
 }
7d97b9
 
7d97b9
+
7d97b9
+#ifndef SQLITE_OMIT_VIRTUALTABLE
7d97b9
+/*
7d97b9
+** Return true if pTab is a virtual table and zName is a shadow table name
7d97b9
+** for that virtual table.
7d97b9
+*/
7d97b9
+int sqlite3IsShadowTableOf(sqlite3 *db, Table *pTab, const char *zName){
7d97b9
+  int nName;                    /* Length of zName */
3d6205
+  Module *pMod;                 /* Module for the virtual table */
7d97b9
+
7d97b9
+  if( !IsVirtual(pTab) ) return 0;
7d97b9
+  nName = sqlite3Strlen30(pTab->zName);
7d97b9
+  if( sqlite3_strnicmp(zName, pTab->zName, nName)!=0 ) return 0;
7d97b9
+  if( zName[nName]!='_' ) return 0;
3d6205
+  pMod = (Module*)sqlite3HashFind(&db->aModule, pTab->azModuleArg[0]);
7d97b9
+  if( pMod==0 ) return 0;
7d97b9
+  if( pMod->pModule->iVersion<3 ) return 0;
7d97b9
+  if( pMod->pModule->xShadowName==0 ) return 0;
7d97b9
+  return pMod->pModule->xShadowName(zName+nName+1);
7d97b9
+}
7d97b9
+#endif /* ifndef SQLITE_OMIT_VIRTUALTABLE */
7d97b9
+
7d97b9
 #ifndef SQLITE_OMIT_VIRTUALTABLE
7d97b9
 /*
7d97b9
 ** Return true if zName is a shadow table name in the current database
3d6205
@@ -1910,7 +1932,6 @@ static void convertToWithoutRowidTable(Parse *pParse, Table *pTab){
7d97b9
 static int isShadowTableName(sqlite3 *db, char *zName){
7d97b9
   char *zTail;                  /* Pointer to the last "_" in zName */
7d97b9
   Table *pTab;                  /* Table that zName is a shadow of */
7d97b9
-  Module *pMod;                 /* Module for the virtual table */
7d97b9
 
7d97b9
   zTail = strrchr(zName, '_');
7d97b9
   if( zTail==0 ) return 0;
3d6205
@@ -1919,11 +1940,7 @@ static int isShadowTableName(sqlite3 *db, char *zName){
7d97b9
   *zTail = '_';
7d97b9
   if( pTab==0 ) return 0;
7d97b9
   if( !IsVirtual(pTab) ) return 0;
7d97b9
-  pMod = (Module*)sqlite3HashFind(&db->aModule, pTab->azModuleArg[0]);
7d97b9
-  if( pMod==0 ) return 0;
7d97b9
-  if( pMod->pModule->iVersion<3 ) return 0;
7d97b9
-  if( pMod->pModule->xShadowName==0 ) return 0;
7d97b9
-  return pMod->pModule->xShadowName(zTail+1);
7d97b9
+  return sqlite3IsShadowTableOf(db, pTab, zName);
7d97b9
 }
7d97b9
 #else
7d97b9
 # define isShadowTableName(x,y) 0
7d97b9
diff --git a/src/sqliteInt.h b/src/sqliteInt.h
7d97b9
index b7d3571..76337f7 100644
7d97b9
--- a/src/sqliteInt.h
7d97b9
+++ b/src/sqliteInt.h
7d97b9
@@ -4407,6 +4407,11 @@ void sqlite3AutoLoadExtensions(sqlite3*);
7d97b9
    );
7d97b9
 #  define sqlite3VtabInSync(db) ((db)->nVTrans>0 && (db)->aVTrans==0)
7d97b9
 #endif
7d97b9
+#ifndef SQLITE_OMIT_VIRTUALTABLE
7d97b9
+  int sqlite3IsShadowTableOf(sqlite3*,Table*,const char*);
7d97b9
+#else
7d97b9
+# define sqlite3IsShadowTableOf(A,B,C) 0
7d97b9
+#endif
7d97b9
 int sqlite3VtabEponymousTableInit(Parse*,Module*);
7d97b9
 void sqlite3VtabEponymousTableClear(sqlite3*,Module*);
7d97b9
 void sqlite3VtabMakeWritable(Parse*,Table*);
7d97b9
-- 
7d97b9
2.24.1
7d97b9