CVE-2019-19244: Insufficient Information (NVD-CWE-noinfo)
value: sqlite3Select in select.c in SQLite 3.30.1 allows a crash if a sub-select uses both DISTINCT and window functions, and also has certain ORDER BY usage.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 7.5
Published: 2019-11-25T20:15Z
Repository: https://github.com/sqlite/sqlite
Language: Other
Files changed: manifest, manifest.uuid, src/select.c, test/window1.test
Commit date: 2019-11-22 10:14:01 +0000
Commit message: Fix a crash that could occur if a sub-select that uses both DISTINCT and window functions also used an ORDER BY that is the same as its select list.

FossilOrigin-Name: bcdd66c1691955c697f3d756c2b035acfe98f6aad72e90b0021bab6e9023b3ba
Diff: diff --git a/manifest b/manifest
index f1676b3eda..f6b23cfa86 100644
--- a/manifest
+++ b/manifest
@@ -1,7 +1,7 @@
-C Revise\sthe\sSQLITE_OPEN_NOFOLLOW\sso\sthat\sit\sactually\suses\sO_NOFOLLOW\sin\sthe\nopen()\ssystem\scall.\s\sThis\sbacks\sout\sthe\sSQLITE_ACCESS_SYMLINK\svalue\sbut\sadds\nthe\snew\sSQLITE_OK_SYMLINK\sreturn\scode\sfrom\sthe\sxFullPathname\smethod\sof\s\nsqlite3_vfs\swhen\sthat\sroutine\sresolves\ssymbolic\slinks.\sO_NOFOLLOW\sis\salways\nincluded\sin\sopen()\ssystem\scalls\sfor\sjournal\sfiles.
-D 2019-11-22T00:42:01.486
+C Fix\sa\scrash\sthat\scould\soccur\sif\sa\ssub-select\sthat\suses\sboth\sDISTINCT\sand\swindow\sfunctions\salso\sused\san\sORDER\sBY\sthat\sis\sthe\ssame\sas\sits\sselect\slist.
+D 2019-11-22T10:14:01.691
 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
 F LICENSE.md df5091916dbb40e6e9686186587125e1b2ff51f022cc334e886c19a0e9982724
 F Makefile.in bf24a9abbb277afa2fbe6bac80a181f22be6c48de771cd260c9851ecf6165dc1
 F Makefile.linux-gcc f609543700659711fbd230eced1f01353117621dccae7b9fb70daa64236c5241
@@ -524,11 +524,11 @@ F src/pragma.h ec3b31eac9b1df040f1cc8cb3d89bc06605c3b4cb3d76f833de8d6d6c3f77f04
 F src/prepare.c 6049beb71385f017af6fc320d2c75a4e50b75e280c54232442b785fbb83df057
 F src/printf.c 9be6945837c839ba57837b4bc3af349eba630920fa5532aa518816defe42a7d4
 F src/random.c 80f5d666f23feb3e6665a6ce04c7197212a88384
 F src/resolve.c 023397b50d09a3587a15169b713342e2d595ab29e14e54fd8f4a86b76c461d21
 F src/rowset.c d977b011993aaea002cab3e0bb2ce50cf346000dff94e944d547b989f4b1fe93
-F src/select.c 50ccaf5fc3566b897fd3090b63bd60605f2f3f38ac5709fda6c482510d71aa6c
+F src/select.c f403b7bd2304d4dfd5ad2614cc0ad3386a97af707922882bdabba4c14ce12975
 F src/shell.c.in 4a3a9e1c11847b1904f2b01d087af1c052f660902755abab457cab1756817ded
 F src/sqlite.h.in 4fe42f27a7be44586bbd94f49f2b097ef8a1053c747d82f135456c7f5381c85a
 F src/sqlite3.rc 5121c9e10c3964d5755191c80dd1180c122fc3a8
 F src/sqlite3ext.h 72af51aa4e912e14cd495fb6e7fac65f0940db80ed950d90911aff292cc47ce2
 F src/sqliteInt.h 98bc9562acfc361e34182aa25b00e2c73095732ddd3ba4158f984b94f5601f96
@@ -1709,11 +1709,11 @@ F test/wherelimit.test 592081800806d297dd7449b1030c863d2883d6d42901837ccd2e5a9bd
 F test/wherelimit2.test 9bf0aa56cca40ea0e4c5e2915341355a2bbc0859ec4ce1589197fe2a9d94635f
 F test/win32heap.test 10fd891266bd00af68671e702317726375e5407561d859be1aa04696f2aeee74
 F test/win32lock.test fbf107c91d8f5512be5a5b87c4c42ab9fdd54972
 F test/win32longpath.test 169c75a3b2e43481f4a62122510210c67b08f26d
 F test/win32nolock.test ac4f08811a562e45a5755e661f45ca85892bdbbc
-F test/window1.test e88f674b5de9d3bd2787bc1ff22e8c04c10c7e9773212f3c3c3396cb8dccb096
+F test/window1.test 60ba11fb64122c57dfd423a5f9483fb446cc27ed5cf5526152a0decdc9a761fa
 F test/window2.tcl 66db96fd9fd202bc31ee7f8ce7904cb469564864cff3f74e009bfef8102333f4
 F test/window2.test af2a001ded703bb8f2474fb0edfef170d5aba00f5c1f2aa9f65935b5da13df90
 F test/window3.tcl acea6e86a4324a210fd608d06741010ca83ded9fde438341cb978c49928faf03
 F test/window3.test e9959a993c8a71e96433be8daaa1827d78b8921e4f12debd7bdbeb3c856ef3cb
 F test/window4.tcl d732df0e81beedc0ba8a563ade68611d322d27303ad0c0c8e4444107c39e84ec
@@ -1848,9 +1848,9 @@ F vsixtest/pch.h 9cab7980f2ac4baa40807d8b5e52af32a21cf78c
 F vsixtest/vsixtest.sln 77cadbe4e96c1fe1bf51cd77de9e9b0a12ada547
 F vsixtest/vsixtest.tcl 6a9a6ab600c25a91a7acc6293828957a386a8a93
 F vsixtest/vsixtest.vcxproj.data 2ed517e100c66dc455b492e1a33350c1b20fbcdc
 F vsixtest/vsixtest.vcxproj.filters 37e51ffedcdb064aad6ff33b6148725226cd608e
 F vsixtest/vsixtest_TemporaryKey.pfx e5b1b036facdb453873e7084e1cae9102ccc67a0
-P ac080432b480062507452d3cdbe6c0f759e6f95b65d9862e0462017405ab2b8e
-R b32992f83d3fe313532417046634561a
-U drh
-Z 3c868f0a98a5c208f527ca2b91cdb564
+P 6a64fb6a2da6c98f1e87b55ad5689967e1db4eae2e08345471d95e28cd567e0f
+R 6a5d6072626d6501ea14c356f9dce16a
+U dan
+Z 0f63dd080b5a1fb6658b32eaaaf6aa19
diff --git a/manifest.uuid b/manifest.uuid
index 85931cbb52..18bd00e701 100644
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-6a64fb6a2da6c98f1e87b55ad5689967e1db4eae2e08345471d95e28cd567e0f
\ No newline at end of file
+bcdd66c1691955c697f3d756c2b035acfe98f6aad72e90b0021bab6e9023b3ba
\ No newline at end of file
diff --git a/src/select.c b/src/select.c
index 5f51074a04..44fb06f48d 100644
--- a/src/select.c
+++ b/src/select.c
@@ -6062,10 +6062,11 @@ int sqlite3Select(
   ** written the query must use a temp-table for at least one of the ORDER 
   ** BY and DISTINCT, and an index or separate temp-table for the other.
   */
   if( (p->selFlags & (SF_Distinct|SF_Aggregate))==SF_Distinct 
    && sqlite3ExprListCompare(sSort.pOrderBy, pEList, -1)==0
+   && p->pWin==0
   ){
     p->selFlags &= ~SF_Distinct;
     pGroupBy = p->pGroupBy = sqlite3ExprListDup(db, pEList, 0);
     /* Notice that even thought SF_Distinct has been cleared from p->selFlags,
     ** the sDistinct.isTnct is still set.  Hence, isTnct represents the
diff --git a/test/window1.test b/test/window1.test
index ff2f86516b..98a4ce4569 100644
--- a/test/window1.test
+++ b/test/window1.test
@@ -1241,6 +1241,19 @@ do_catchsql_test 32.10 {
   CREATE VIEW a AS SELECT NULL INTERSECT SELECT NULL ORDER BY s() OVER R;
   CREATE TABLE a0 AS SELECT 0;
   ALTER TABLE a0 RENAME TO S;
 } {1 {error in view a: 1st ORDER BY term does not match any column in the result set}}
 
+reset_db
+do_execsql_test 33.1 {
+  CREATE TABLE t1(aa, bb);
+  INSERT INTO t1 VALUES(1, 2);
+  INSERT INTO t1 VALUES(5, 6);
+  CREATE TABLE t2(x);
+  INSERT INTO t2 VALUES(1);
+}
+do_execsql_test 33.2 {
+  SELECT (SELECT DISTINCT sum(aa) OVER() FROM t1 ORDER BY 1), x FROM t2 
+  ORDER BY 1;
+} {6 1}
+
 finish_test

Vulnerable code: C Revise\sthe\sSQLITE_OPEN_NOFOLLOW\sso\sthat\sit\sactually\suses\sO_NOFOLLOW\sin\sthe\nopen()\ssystem\scall.\s\sThis\sbacks\sout\sthe\sSQLITE_ACCESS_SYMLINK\svalue\sbut\sadds\nthe\snew\sSQLITE_OK_SYMLINK\sreturn\scode\sfrom\sthe\sxFullPathname\smethod\sof\s\nsqlite3_vfs\swhen\sthat\sroutine\sresolves\ssymbolic\slinks.\sO_NOFOLLOW\sis\salways\nincluded\sin\sopen()\ssystem\scalls\sfor\sjournal\sfiles.
D 2019-11-22T00:42:01.486
F src/select.c 50ccaf5fc3566b897fd3090b63bd60605f2f3f38ac5709fda6c482510d71aa6c
F test/window1.test e88f674b5de9d3bd2787bc1ff22e8c04c10c7e9773212f3c3c3396cb8dccb096
P ac080432b480062507452d3cdbe6c0f759e6f95b65d9862e0462017405ab2b8e
R b32992f83d3fe313532417046634561a
U drh
Z 3c868f0a98a5c208f527ca2b91cdb564
6a64fb6a2da6c98f1e87b55ad5689967e1db4eae2e08345471d95e28cd567e0f
Fixed code: C Fix\sa\scrash\sthat\scould\soccur\sif\sa\ssub-select\sthat\suses\sboth\sDISTINCT\sand\swindow\sfunctions\salso\sused\san\sORDER\sBY\sthat\sis\sthe\ssame\sas\sits\sselect\slist.
D 2019-11-22T10:14:01.691
F src/select.c f403b7bd2304d4dfd5ad2614cc0ad3386a97af707922882bdabba4c14ce12975
F test/window1.test 60ba11fb64122c57dfd423a5f9483fb446cc27ed5cf5526152a0decdc9a761fa
P 6a64fb6a2da6c98f1e87b55ad5689967e1db4eae2e08345471d95e28cd567e0f
R 6a5d6072626d6501ea14c356f9dce16a
U dan
Z 0f63dd080b5a1fb6658b32eaaaf6aa19
bcdd66c1691955c697f3d756c2b035acfe98f6aad72e90b0021bab6e9023b3ba
   && p->pWin==0
reset_db
do_execsql_test 33.1 {
  CREATE TABLE t1(aa, bb);
  INSERT INTO t1 VALUES(1, 2);
  INSERT INTO t1 VALUES(5, 6);
  CREATE TABLE t2(x);
  INSERT INTO t2 VALUES(1);
}
do_execsql_test 33.2 {
  SELECT (SELECT DISTINCT sum(aa) OVER() FROM t1 ORDER BY 1), x FROM t2 
  ORDER BY 1;
} {6 1}