CVE-2019-19242: NULL Pointer Dereference (CWE-476)
value: SQLite 3.30.1 mishandles pExpr->y.pTab, as demonstrated by the TK_COLUMN case in sqlite3ExprCodeTarget in expr.c.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 5.9
Published: 2019-11-27T17:15Z
Repository: https://github.com/sqlite/sqlite
Language: C
Files changed: manifest, manifest.uuid, src/expr.c, src/wherecode.c, test/gencol1.test
Commit date: 2019-11-21 18:28:44 +0000
Commit message: Fix a problem that comes up when using generated columns that evaluate to a
constant in an index and then making use of that index in a join.

FossilOrigin-Name: 8b12e95fec7ce6e0de82a04ca3dfcf1a8e62e233b7382aa28a8a9be6e862b1af
Diff: diff --git a/manifest b/manifest
index 7b921546d..40924ae60 100644
--- a/manifest
+++ b/manifest
@@ -1,7 +1,7 @@
-C Fix\sa\srecently\sintroduced\smemory\sleak\sin\sthe\stest\scode\sin\stest_vfs.c.
-D 2019-11-21T17:14:55.938
+C Fix\sa\sproblem\sthat\scomes\sup\swhen\susing\sgenerated\scolumns\sthat\sevaluate\sto\sa\nconstant\sin\san\sindex\sand\sthen\smaking\suse\sof\sthat\sindex\sin\sa\sjoin.
+D 2019-11-21T18:28:44.463
 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
 F LICENSE.md df5091916dbb40e6e9686186587125e1b2ff51f022cc334e886c19a0e9982724
 F Makefile.in bf24a9abbb277afa2fbe6bac80a181f22be6c48de771cd260c9851ecf6165dc1
 F Makefile.linux-gcc f609543700659711fbd230eced1f01353117621dccae7b9fb70daa64236c5241
@@ -476,11 +476,11 @@ F src/complete.c a3634ab1e687055cd002e11b8f43eb75c17da23e
 F src/ctime.c 1b0724e66f95f33b160b1af85caaf9cceb325d22abf39bd24df4f54a73982251
 F src/date.c e1d8ac7102f3f283e63e13867acb0efa33861cf34f0faf4cdbaf9fa7a1eb7041
 F src/dbpage.c 135eb3b5e74f9ef74bde5cec2571192c90c86984fa534c88bf4a055076fa19b7
 F src/dbstat.c 6c407e549406c10fde9ac3987f6d734459205239ad370369bc5fcd683084a4fa
 F src/delete.c a5c59b9c0251cf7682bc52af0d64f09b1aefc6781a63592c8f1136f7b73c66e4
-F src/expr.c a138de8ae79628a73da2597617dbeafb0f083172be81d93ffa1cafa45161ee8c
+F src/expr.c be8060167e2fcf9861b102602ca40386bf98446ef55e33e0bdee23ff88f16791
 F src/fault.c 460f3e55994363812d9d60844b2a6de88826e007
 F src/fkey.c 92a248ec0fa4ed8ab60c98d9b188ce173aaf218f32e7737ba77deb2a684f9847
 F src/func.c ed33e38cd642058182a31a3f518f2e34f4bbe53aa483335705c153c4d3e50b12
 F src/global.c a1a8d698762ddd9a1543aac26c1e0029b20fcc3fcb56bfa41ec8cea2368f2798
 F src/hash.c 8d7dda241d0ebdafb6ffdeda3149a412d7df75102cecfc1021c98d6219823b19
@@ -612,11 +612,11 @@ F src/vxworks.h d2988f4e5a61a4dfe82c6524dd3d6e4f2ce3cdb9
 F src/wal.c bbd6838bd79c0a32144d482fb0b6a9d2d1a252fb3b16d5005ec30f2f80413b0d
 F src/wal.h 606292549f5a7be50b6227bd685fa76e3a4affad71bb8ac5ce4cb5c79f6a176a
 F src/walker.c d5a94907dcac990e31976be9dc769d17f6a806782593d6aec9d760ee01ec22cd
 F src/where.c 874845fb5d93b3bc07123df8fee805e9650bd091e3ed62988273c7e2141ab8bd
 F src/whereInt.h 4a296fd4fa79fdcbc2b5e8c1b898901617655811223e1082b899c23ecb092217
-F src/wherecode.c 9b84737fd68134249a439813d27b1c61de17a01e121eb98949548d1e7f8e400a
+F src/wherecode.c 909325b98d5cb313f24e5c8cb304a3e3c73ca6631cdb19cfa1f580dde182fedb
 F src/whereexpr.c 39b6a538804c6e1248c22b33e09d00f89ae6a099c849c4d841ce3995562287b4
 F src/window.c b5bed964a04c23fa335d6b1d2d8011ed518b36b692c1a999ae1777a023a45e1d
 F test/8_3_names.test ebbb5cd36741350040fd28b432ceadf495be25b2
 F test/affinity2.test ce1aafc86e110685b324e9a763eab4f2a73f737842ec3b687bd965867de90627
 F test/affinity3.test 6a101af2fc945ce2912f6fe54dd646018551710d
@@ -1019,11 +1019,11 @@ F test/fuzzdata7.db e7a86fd83dda151d160445d542e32e5c6019c541b3a74c2a525b6ac64063
 F test/fuzzdata8.db b45368bbe9f86d40d30603e8f780ac29807cbcc951a18d7a7fd9d0c0e904706e
 F test/fuzzer1.test 3d4c4b7e547aba5e5511a2991e3e3d07166cfbb8
 F test/fuzzer2.test a85ef814ce071293bce1ad8dffa217cbbaad4c14
 F test/fuzzerfault.test 8792cd77fd5bce765b05d0c8e01b9edcf8af8536
 F test/gcfault.test dd28c228a38976d6336a3fc42d7e5f1ad060cb8c
-F test/gencol1.test 82b8fc6953a6ff8560249c01f448a5fa8e8b633ec4dbdb3fc4f6632dc9ad9ea8
+F test/gencol1.test cb18ae911ed157058ea030988463bd1ec3315ba889b4aff4b8711551c393afae
 F test/genesis.tcl 1e2e2e8e5cc4058549a154ff1892fe5c9de19f98
 F test/having.test e4098a4b8962f9596035c3b87a8928a10648acc509f1bb8d6f96413bbf79a1b3
 F test/hexlit.test 4a6a5f46e3c65c4bf1fa06f5dd5a9507a5627751
 F test/hidden.test 23c1393a79e846d68fd902d72c85d5e5dcf98711
 F test/hook.test 1604b3b2f5931430087540404555c1b6be3618600b81558657c66b533ed70b13
@@ -1848,9 +1848,9 @@ F vsixtest/pch.h 9cab7980f2ac4baa40807d8b5e52af32a21cf78c
 F vsixtest/vsixtest.sln 77cadbe4e96c1fe1bf51cd77de9e9b0a12ada547
 F vsixtest/vsixtest.tcl 6a9a6ab600c25a91a7acc6293828957a386a8a93
 F vsixtest/vsixtest.vcxproj.data 2ed517e100c66dc455b492e1a33350c1b20fbcdc
 F vsixtest/vsixtest.vcxproj.filters 37e51ffedcdb064aad6ff33b6148725226cd608e
 F vsixtest/vsixtest_TemporaryKey.pfx e5b1b036facdb453873e7084e1cae9102ccc67a0
-P 2eb997327c2c369c10b7835be80112d77cb2a7cfa9fe4d564042984c21d94698
-R aec5831ff7a5bde3ac00189bc22970c2
-U dan
-Z 1f033777cb6b83f60ef12910c2c3cbe7
+P 2d53a30cc23e53033af8e8666457654db5dcc453ed6cd176ce1d0bff4f528159
+R 916b27815e9b3d41c41616a867889cc0
+U drh
+Z 2f4253a7507c4c18153791477951e376
diff --git a/manifest.uuid b/manifest.uuid
index 1e276b124..44815f28d 100644
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-2d53a30cc23e53033af8e8666457654db5dcc453ed6cd176ce1d0bff4f528159
\ No newline at end of file
+8b12e95fec7ce6e0de82a04ca3dfcf1a8e62e233b7382aa28a8a9be6e862b1af
\ No newline at end of file
diff --git a/src/expr.c b/src/expr.c
index 45c053a8c..a3ed249ee 100644
--- a/src/expr.c
+++ b/src/expr.c
@@ -3603,11 +3603,16 @@ expr_code_doover:
         ** expresssion.  However, make sure the constant has the correct
         ** datatype by applying the Affinity of the table column to the
         ** constant.
         */
         int iReg = sqlite3ExprCodeTarget(pParse, pExpr->pLeft,target);
-        int aff = sqlite3TableColumnAffinity(pExpr->y.pTab, pExpr->iColumn);
+        int aff;
+        if( pExpr->y.pTab ){
+          aff = sqlite3TableColumnAffinity(pExpr->y.pTab, pExpr->iColumn);
+        }else{
+          aff = pExpr->affExpr;
+        }
         if( aff>SQLITE_AFF_BLOB ){
           static const char zAff[] = "B\000C\000D\000E";
           assert( SQLITE_AFF_BLOB=='A' );
           assert( SQLITE_AFF_TEXT=='B' );
           if( iReg!=target ){
diff --git a/src/wherecode.c b/src/wherecode.c
index d34912eb7..893ba7b8e 100644
--- a/src/wherecode.c
+++ b/src/wherecode.c
@@ -1139,10 +1139,12 @@ static int whereIndexExprTransNode(Walker *p, Expr *pExpr){
 */
 static int whereIndexExprTransColumn(Walker *p, Expr *pExpr){
   if( pExpr->op==TK_COLUMN ){
     IdxExprTrans *pX = p->u.pIdxTrans;
     if( pExpr->iTable==pX->iTabCur && pExpr->iColumn==pX->iTabCol ){
+      assert( pExpr->y.pTab!=0 );
+      pExpr->affExpr = sqlite3TableColumnAffinity(pExpr->y.pTab,pExpr->iColumn);
       pExpr->iTable = pX->iIdxCur;
       pExpr->iColumn = pX->iIdxCol;
       pExpr->y.pTab = 0;
     }
   }
diff --git a/test/gencol1.test b/test/gencol1.test
index 98906efdf..9e2ca21e8 100644
--- a/test/gencol1.test
+++ b/test/gencol1.test
@@ -241,7 +241,19 @@ do_catchsql_test gencol1-8.20 {
     c2 AS(c1) CHECK(c2)
   );
   UPDATE t0 SET c0 = NULL;
 } {1 {generated column loop on "c2"}}
 
+# 2019-11-21 Problems in the new generated column logic
+# reported by Yongheng Chen and Rui Zhong
+do_execsql_test gencol1-9.10 {
+  DROP TABLE IF EXISTS t1;
+  DROP TABLE IF EXISTS t2;
+  CREATE TABLE t1(aa , bb AS (17) UNIQUE);
+  INSERT INTO t1 VALUES(17);
+  CREATE TABLE t2(cc);
+  INSERT INTO t2 VALUES(41);
+  SELECT * FROM t2 JOIN t1 WHERE t1.bb=t1.aa AND t1.bb=17;
+} {41 17 17}
+
 
 finish_test

Vulnerable code: C Fix\sa\srecently\sintroduced\smemory\sleak\sin\sthe\stest\scode\sin\stest_vfs.c.
D 2019-11-21T17:14:55.938
F src/expr.c a138de8ae79628a73da2597617dbeafb0f083172be81d93ffa1cafa45161ee8c
F src/wherecode.c 9b84737fd68134249a439813d27b1c61de17a01e121eb98949548d1e7f8e400a
F test/gencol1.test 82b8fc6953a6ff8560249c01f448a5fa8e8b633ec4dbdb3fc4f6632dc9ad9ea8
P 2eb997327c2c369c10b7835be80112d77cb2a7cfa9fe4d564042984c21d94698
R aec5831ff7a5bde3ac00189bc22970c2
U dan
Z 1f033777cb6b83f60ef12910c2c3cbe7
2d53a30cc23e53033af8e8666457654db5dcc453ed6cd176ce1d0bff4f528159
        int aff = sqlite3TableColumnAffinity(pExpr->y.pTab, pExpr->iColumn);
Fixed code: C Fix\sa\sproblem\sthat\scomes\sup\swhen\susing\sgenerated\scolumns\sthat\sevaluate\sto\sa\nconstant\sin\san\sindex\sand\sthen\smaking\suse\sof\sthat\sindex\sin\sa\sjoin.
D 2019-11-21T18:28:44.463
F src/expr.c be8060167e2fcf9861b102602ca40386bf98446ef55e33e0bdee23ff88f16791
F src/wherecode.c 909325b98d5cb313f24e5c8cb304a3e3c73ca6631cdb19cfa1f580dde182fedb
F test/gencol1.test cb18ae911ed157058ea030988463bd1ec3315ba889b4aff4b8711551c393afae
P 2d53a30cc23e53033af8e8666457654db5dcc453ed6cd176ce1d0bff4f528159
R 916b27815e9b3d41c41616a867889cc0
U drh
Z 2f4253a7507c4c18153791477951e376
8b12e95fec7ce6e0de82a04ca3dfcf1a8e62e233b7382aa28a8a9be6e862b1af
        int aff;
        if( pExpr->y.pTab ){
          aff = sqlite3TableColumnAffinity(pExpr->y.pTab, pExpr->iColumn);
        }else{
          aff = pExpr->affExpr;
        }
      assert( pExpr->y.pTab!=0 );
      pExpr->affExpr = sqlite3TableColumnAffinity(pExpr->y.pTab,pExpr->iColumn);
# 2019-11-21 Problems in the new generated column logic
# reported by Yongheng Chen and Rui Zhong
do_execsql_test gencol1-9.10 {
  DROP TABLE IF EXISTS t1;
  DROP TABLE IF EXISTS t2;
  CREATE TABLE t1(aa , bb AS (17) UNIQUE);
  INSERT INTO t1 VALUES(17);
  CREATE TABLE t2(cc);
  INSERT INTO t2 VALUES(41);
  SELECT * FROM t2 JOIN t1 WHERE t1.bb=t1.aa AND t1.bb=17;
} {41 17 17}