CVE-2019-19926: NULL Pointer Dereference (CWE-476)
value: multiSelect in select.c in SQLite 3.30.1 mishandles certain errors during parsing, as demonstrated by errors from sqlite3WindowRewrite() calls. NOTE: this vulnerability exists because of an incomplete fix for CVE-2019-19880.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 7.5
Published: 2019-12-23T01:15Z
Repository: https://github.com/sqlite/sqlite
Language: Other
Files changed: manifest, manifest.uuid, src/select.c
Commit date: 2019-12-19 22:08:19 +0000
Commit message: Continuation of [e2bddcd4c55ba3cb]: Add another spot where it is necessary
to abort early due to prior errors in sqlite3WindowRewrite().

FossilOrigin-Name: cba2a2a44cdf138a629109bb0ad088ed4ef67fc66bed3e0373554681a39615d2
Diff: diff --git a/manifest b/manifest
index 10ad86cc98b..1b00d4ecdb5 100644
--- a/manifest
+++ b/manifest
@@ -1,7 +1,7 @@
-C Fix\sthe\sregexp\sextension\sso\sthat\sit\scorrectly\stranslates\sall\sover-length\n3-byte\sUTF8\ssequences\sinto\s0xfffd.
-D 2019-12-19T21:11:48.622
+C Continuation\sof\s[e2bddcd4c55ba3cb]:\sAdd\sanother\sspot\swhere\sit\sis\snecessary\nto\sabort\searly\sdue\sto\sprior\serrors\sin\ssqlite3WindowRewrite().
+D 2019-12-19T22:08:19.301
 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
 F LICENSE.md df5091916dbb40e6e9686186587125e1b2ff51f022cc334e886c19a0e9982724
 F Makefile.in d3a862c9742f5a08230a3b295c0a47fd3067f19356dc39935280135f90474b04
 F Makefile.linux-gcc f609543700659711fbd230eced1f01353117621dccae7b9fb70daa64236c5241
@@ -525,11 +525,11 @@ F src/pragma.h ec3b31eac9b1df040f1cc8cb3d89bc06605c3b4cb3d76f833de8d6d6c3f77f04
 F src/prepare.c 6049beb71385f017af6fc320d2c75a4e50b75e280c54232442b785fbb83df057
 F src/printf.c 9be6945837c839ba57837b4bc3af349eba630920fa5532aa518816defe42a7d4
 F src/random.c 80f5d666f23feb3e6665a6ce04c7197212a88384
 F src/resolve.c 86a7773d2892227ba9ad1721c41bb03c501830f1bf6de5f78dd0062b82e10c9d
 F src/rowset.c d977b011993aaea002cab3e0bb2ce50cf346000dff94e944d547b989f4b1fe93
-F src/select.c dd7e40967760b28efe274ade35043d5bf5d72774208bb75d2cb4dd59cbd59ad1
+F src/select.c b895d809b93596c828c4cd79f4da96d48bf1969414877bb4313770000ea736cc
 F src/shell.c.in 4a3a9e1c11847b1904f2b01d087af1c052f660902755abab457cab1756817ded
 F src/sqlite.h.in 2a23e8161775253d9cf383c2c6aa559005dc787d350dcb0be67a6c4cc3bd1d19
 F src/sqlite3.rc 5121c9e10c3964d5755191c80dd1180c122fc3a8
 F src/sqlite3ext.h 72af51aa4e912e14cd495fb6e7fac65f0940db80ed950d90911aff292cc47ce2
 F src/sqliteInt.h 60d92fad64da7c3e77bbc35ee306340814cdaa5df32892b0ec58d306d99b5733
@@ -1850,9 +1850,9 @@ F vsixtest/pch.h 9cab7980f2ac4baa40807d8b5e52af32a21cf78c
 F vsixtest/vsixtest.sln 77cadbe4e96c1fe1bf51cd77de9e9b0a12ada547
 F vsixtest/vsixtest.tcl 6a9a6ab600c25a91a7acc6293828957a386a8a93
 F vsixtest/vsixtest.vcxproj.data 2ed517e100c66dc455b492e1a33350c1b20fbcdc
 F vsixtest/vsixtest.vcxproj.filters 37e51ffedcdb064aad6ff33b6148725226cd608e
 F vsixtest/vsixtest_TemporaryKey.pfx e5b1b036facdb453873e7084e1cae9102ccc67a0
-P e2bddcd4c55ba3cbe0130332679ff4b048630d0ced9a8899982edb5a3569ba7f
-R af9053af10312d4307bee0a49d732fcd
+P 3d4c0bf8904135fa68c75801bfa738715cacc3b19dc8ad6ef550b11798d4b121
+R 5ae11b0f596e58f50666a1f36d76218a
 U drh
-Z 117f0e64b781f6b402ee8f8a6b6c39a1
+Z a0201de5777363689738ee935bfc3b28
diff --git a/manifest.uuid b/manifest.uuid
index 46d447263b2..3d142a4feff 100644
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-3d4c0bf8904135fa68c75801bfa738715cacc3b19dc8ad6ef550b11798d4b121
\ No newline at end of file
+cba2a2a44cdf138a629109bb0ad088ed4ef67fc66bed3e0373554681a39615d2
\ No newline at end of file
diff --git a/src/select.c b/src/select.c
index a94c4236e8a..6fff2883ec0 100644
--- a/src/select.c
+++ b/src/select.c
@@ -2807,10 +2807,11 @@ static int multiSelect(
     if( p->pNext==0 ){
       ExplainQueryPlanPop(pParse);
     }
   #endif
   }
+  if( pParse->nErr ) goto multi_select_end;
   
   /* Compute collating sequences used by 
   ** temporary tables needed to implement the compound select.
   ** Attach the KeyInfo structure to all temporary tables.
   **

Vulnerable code: C Fix\sthe\sregexp\sextension\sso\sthat\sit\scorrectly\stranslates\sall\sover-length\n3-byte\sUTF8\ssequences\sinto\s0xfffd.
D 2019-12-19T21:11:48.622
F src/select.c dd7e40967760b28efe274ade35043d5bf5d72774208bb75d2cb4dd59cbd59ad1
P e2bddcd4c55ba3cbe0130332679ff4b048630d0ced9a8899982edb5a3569ba7f
R af9053af10312d4307bee0a49d732fcd
Z 117f0e64b781f6b402ee8f8a6b6c39a1
3d4c0bf8904135fa68c75801bfa738715cacc3b19dc8ad6ef550b11798d4b121
Fixed code: C Continuation\sof\s[e2bddcd4c55ba3cb]:\sAdd\sanother\sspot\swhere\sit\sis\snecessary\nto\sabort\searly\sdue\sto\sprior\serrors\sin\ssqlite3WindowRewrite().
D 2019-12-19T22:08:19.301
F src/select.c b895d809b93596c828c4cd79f4da96d48bf1969414877bb4313770000ea736cc
P 3d4c0bf8904135fa68c75801bfa738715cacc3b19dc8ad6ef550b11798d4b121
R 5ae11b0f596e58f50666a1f36d76218a
Z a0201de5777363689738ee935bfc3b28
cba2a2a44cdf138a629109bb0ad088ed4ef67fc66bed3e0373554681a39615d2
  if( pParse->nErr ) goto multi_select_end;