Blame SOURCES/sqlite-3.26.0-CVE-2020-15358.patch

3d6205
Subject: [PATCH] Fix a defect in the query-flattener optimization
3d6205
3d6205
---
3d6205
 src/select.c      |  8 ++++----
3d6205
 src/sqliteInt.h   |  1 +
3d6205
 test/selectA.test | 22 ++++++++++++++++++++++
3d6205
 3 files changed, 27 insertions(+), 4 deletions(-)
3d6205
3d6205
diff --git a/src/select.c b/src/select.c
3d6205
index 88a43df..a513d36 100644
3d6205
--- a/src/select.c
3d6205
+++ b/src/select.c
3d6205
@@ -2686,9 +2686,7 @@ static int multiSelect(
3d6205
                           selectOpName(p->op)));
3d6205
         rc = sqlite3Select(pParse, p, &uniondest);
3d6205
         testcase( rc!=SQLITE_OK );
3d6205
-        /* Query flattening in sqlite3Select() might refill p->pOrderBy.
3d6205
-        ** Be sure to delete p->pOrderBy, therefore, to avoid a memory leak. */
3d6205
-        sqlite3ExprListDelete(db, p->pOrderBy);
3d6205
+        assert( p->pOrderBy==0 );
3d6205
         pDelete = p->pPrior;
3d6205
         p->pPrior = pPrior;
3d6205
         p->pOrderBy = 0;
3d6205
@@ -4010,7 +4008,7 @@ static int flattenSubquery(
3d6205
     ** We look at every expression in the outer query and every place we see
3d6205
     ** "a" we substitute "x*3" and every place we see "b" we substitute "y+10".
3d6205
     */
3d6205
-    if( pSub->pOrderBy ){
3d6205
+    if( pSub->pOrderBy && (pParent->selFlags & SF_NoopOrderBy)==0 ){
3d6205
       /* At this point, any non-zero iOrderByCol values indicate that the
3d6205
       ** ORDER BY column expression is identical to the iOrderByCol'th
3d6205
       ** expression returned by SELECT statement pSub. Since these values
3d6205
@@ -5633,6 +5631,8 @@ int sqlite3Select(
3d6205
     sqlite3ExprListDelete(db, p->pOrderBy);
3d6205
     p->pOrderBy = 0;
3d6205
     p->selFlags &= ~SF_Distinct;
3d6205
+    p->selFlags |= SF_NoopOrderBy;
3d6205
+
3d6205
   }
3d6205
   sqlite3SelectPrep(pParse, p, 0);
3d6205
   if( pParse->nErr || db->mallocFailed ){
3d6205
diff --git a/src/sqliteInt.h b/src/sqliteInt.h
3d6205
index 76337f7..60b2ebd 100644
3d6205
--- a/src/sqliteInt.h
3d6205
+++ b/src/sqliteInt.h
3d6205
@@ -2874,6 +2874,7 @@ struct Select {
3d6205
 #define SF_Converted      0x10000  /* By convertCompoundSelectToSubquery() */
3d6205
 #define SF_IncludeHidden  0x20000  /* Include hidden columns in output */
3d6205
 #define SF_ComplexResult  0x40000  /* Result contains subquery or function */
3d6205
+#define SF_NoopOrderBy   0x0400000 /* ORDER BY is ignored for this query */
3d6205
 
3d6205
 /*
3d6205
 ** The results of a SELECT can be distributed in several ways, as defined
3d6205
diff --git a/test/selectA.test b/test/selectA.test
3d6205
index 838e5f4..2626008 100644
3d6205
--- a/test/selectA.test
3d6205
+++ b/test/selectA.test
3d6205
@@ -1446,5 +1446,27 @@ do_execsql_test 6.1 {
3d6205
   SELECT * FROM (SELECT a FROM t1 UNION SELECT b FROM t2) WHERE a=a;
3d6205
 } {12345}
3d6205
 
3d6205
+# 2020-06-15 ticket 8f157e8010b22af0
3d6205
+#
3d6205
+reset_db
3d6205
+do_execsql_test 7.1 {
3d6205
+  CREATE TABLE t1(c1);     INSERT INTO t1 VALUES(12),(123),(1234),(NULL),('abc');
3d6205
+  CREATE TABLE t2(c2);     INSERT INTO t2 VALUES(44),(55),(123);
3d6205
+  CREATE TABLE t3(c3,c4);  INSERT INTO t3 VALUES(66,1),(123,2),(77,3);
3d6205
+  CREATE VIEW t4 AS SELECT c3 FROM t3;
3d6205
+  CREATE VIEW t5 AS SELECT c3 FROM t3 ORDER BY c4;
3d6205
+}
3d6205
+do_execsql_test 7.2 {
3d6205
+  SELECT * FROM t1, t2 WHERE c1=(SELECT 123 INTERSECT SELECT c2 FROM t4) AND c1=123;
3d6205
+} {123 123}
3d6205
+do_execsql_test 7.3 {
3d6205
+  SELECT * FROM t1, t2 WHERE c1=(SELECT 123 INTERSECT SELECT c2 FROM t5) AND c1=123;
3d6205
+} {123 123}
3d6205
+do_execsql_test 7.4 {
3d6205
+  CREATE TABLE a(b);
3d6205
+  CREATE VIEW c(d) AS SELECT b FROM a ORDER BY b;
3d6205
+  SELECT sum(d) OVER( PARTITION BY(SELECT 0 FROM c JOIN a WHERE b =(SELECT b INTERSECT SELECT d FROM c) AND b = 123)) FROM c;
3d6205
+} {}
3d6205
+
3d6205
 
3d6205
 finish_test
3d6205
-- 
3d6205
2.24.1
3d6205