CVE-2019-19317: Incorrect Conversion between Numeric Types (CWE-681)
value: lookupName in resolve.c in SQLite 3.30.1 omits bits from the colUsed bitmask in the case of a generated column, which allows attackers to cause a denial of service or possibly have unspecified other impact.
CWE description: When converting from one data type to another, such as long to integer, data can be omitted or translated in a way that produces unexpected values. If the resulting values are used in a sensitive context, then dangerous behaviors may occur.
CVSS v3 base score: 9.8
Published: 2019-12-05T14:15Z
Repository: https://github.com/sqlite/sqlite
Language: Other
Files changed: manifest, manifest.uuid
Commit date: 2019-11-22 11:38:40 +0000
Commit message: Add more test cases from Yongheng Chen and Rui Zhong.

FossilOrigin-Name: f24e6ca4f23008212ec05cace9202dbeb37ee34530ead91fac2f5e3eac7f6347
Diff: diff --git a/manifest b/manifest
index f6b23cfa86..35b200a4b5 100644
--- a/manifest
+++ b/manifest
@@ -1,7 +1,7 @@
-C Fix\sa\scrash\sthat\scould\soccur\sif\sa\ssub-select\sthat\suses\sboth\sDISTINCT\sand\swindow\sfunctions\salso\sused\san\sORDER\sBY\sthat\sis\sthe\ssame\sas\sits\sselect\slist.
-D 2019-11-22T10:14:01.691
+C Add\smore\stest\scases\sfrom\sYongheng\sChen\sand\sRui\sZhong.
+D 2019-11-22T11:38:40.010
 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
 F LICENSE.md df5091916dbb40e6e9686186587125e1b2ff51f022cc334e886c19a0e9982724
 F Makefile.in bf24a9abbb277afa2fbe6bac80a181f22be6c48de771cd260c9851ecf6165dc1
 F Makefile.linux-gcc f609543700659711fbd230eced1f01353117621dccae7b9fb70daa64236c5241
@@ -1007,11 +1007,11 @@ F test/fuzz2.test 76dc35b32b6d6f965259508508abce75a6c4d7e1
 F test/fuzz3.test 9c813e6613b837cb7a277b0383cd66bfa07042b4cf0317157c35852f30043c31
 F test/fuzz4.test c229bcdb45518a89e1d208a21343e061503460ac69fae1539320a89f572eb634
 F test/fuzz_common.tcl a87dfbb88c2a6b08a38e9a070dabd129e617b45b
 F test/fuzz_malloc.test f348276e732e814802e39f042b1f6da6362a610af73a528d8f76898fde6b22f2
 F test/fuzzcheck.c e8cf694f71a1ee39a59f7c2a38c0f8660db0656ce47c8a334b6e9a11f1e66c6d
-F test/fuzzdata1.db 36e67e14aeb12ef15bf9bc7215694573244355be70a855b1a3d0e1009645a462
+F test/fuzzdata1.db d36e88741b4f23bcbaaf55b006290669d03c6c891cf13c7b3a53bc1b097b693f
 F test/fuzzdata2.db 128b3feeb78918d075c9b14b48610145a0dd4c8d6f1ca7c2870c7e425f5bf31f
 F test/fuzzdata3.db c6586d3e3cef0fbc18108f9bb649aa77bfc38aba
 F test/fuzzdata4.db b502c7d5498261715812dd8b3c2005bad08b3a26e6489414bd13926cd3e42ed2
 F test/fuzzdata5.db e35f64af17ec48926481cfaf3b3855e436bd40d1cfe2d59a9474cb4b748a52a5
 F test/fuzzdata6.db 92a80e4afc172c24f662a10a612d188fb272de4a9bd19e017927c95f737de6d7
@@ -1848,9 +1848,9 @@ F vsixtest/pch.h 9cab7980f2ac4baa40807d8b5e52af32a21cf78c
 F vsixtest/vsixtest.sln 77cadbe4e96c1fe1bf51cd77de9e9b0a12ada547
 F vsixtest/vsixtest.tcl 6a9a6ab600c25a91a7acc6293828957a386a8a93
 F vsixtest/vsixtest.vcxproj.data 2ed517e100c66dc455b492e1a33350c1b20fbcdc
 F vsixtest/vsixtest.vcxproj.filters 37e51ffedcdb064aad6ff33b6148725226cd608e
 F vsixtest/vsixtest_TemporaryKey.pfx e5b1b036facdb453873e7084e1cae9102ccc67a0
-P 6a64fb6a2da6c98f1e87b55ad5689967e1db4eae2e08345471d95e28cd567e0f
-R 6a5d6072626d6501ea14c356f9dce16a
-U dan
-Z 0f63dd080b5a1fb6658b32eaaaf6aa19
+P bcdd66c1691955c697f3d756c2b035acfe98f6aad72e90b0021bab6e9023b3ba
+R f1da4824caf80eae8ce8f07b9958fc70
+U drh
+Z 8c3d65cb0a9bf9ef3eea1a3d78549ecc
diff --git a/manifest.uuid b/manifest.uuid
index 18bd00e701..c23402a402 100644
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-bcdd66c1691955c697f3d756c2b035acfe98f6aad72e90b0021bab6e9023b3ba
\ No newline at end of file
+f24e6ca4f23008212ec05cace9202dbeb37ee34530ead91fac2f5e3eac7f6347
\ No newline at end of file
diff --git a/test/fuzzdata1.db b/test/fuzzdata1.db
index 62185d7222..091a645298 100644
Binary files a/test/fuzzdata1.db and b/test/fuzzdata1.db differ

Vulnerable code: C Fix\sa\scrash\sthat\scould\soccur\sif\sa\ssub-select\sthat\suses\sboth\sDISTINCT\sand\swindow\sfunctions\salso\sused\san\sORDER\sBY\sthat\sis\sthe\ssame\sas\sits\sselect\slist.
D 2019-11-22T10:14:01.691
F test/fuzzdata1.db 36e67e14aeb12ef15bf9bc7215694573244355be70a855b1a3d0e1009645a462
P 6a64fb6a2da6c98f1e87b55ad5689967e1db4eae2e08345471d95e28cd567e0f
R 6a5d6072626d6501ea14c356f9dce16a
U dan
Z 0f63dd080b5a1fb6658b32eaaaf6aa19
bcdd66c1691955c697f3d756c2b035acfe98f6aad72e90b0021bab6e9023b3ba
Fixed code: C Add\smore\stest\scases\sfrom\sYongheng\sChen\sand\sRui\sZhong.
D 2019-11-22T11:38:40.010
F test/fuzzdata1.db d36e88741b4f23bcbaaf55b006290669d03c6c891cf13c7b3a53bc1b097b693f
P bcdd66c1691955c697f3d756c2b035acfe98f6aad72e90b0021bab6e9023b3ba
R f1da4824caf80eae8ce8f07b9958fc70
U drh
Z 8c3d65cb0a9bf9ef3eea1a3d78549ecc
f24e6ca4f23008212ec05cace9202dbeb37ee34530ead91fac2f5e3eac7f6347