CVE-2019-19317: Incorrect Conversion between Numeric Types (CWE-681)
value: lookupName in resolve.c in SQLite 3.30.1 omits bits from the colUsed bitmask in the case of a generated column, which allows attackers to cause a denial of service or possibly have unspecified other impact.
CWE description: When converting from one data type to another, such as long to integer, data can be omitted or translated in a way that produces unexpected values. If the resulting values are used in a sensitive context, then dangerous behaviors may occur.
CVSS v3 base score: 9.8
Published: 2019-12-05T14:15Z
Repository: https://github.com/sqlite/sqlite
Language: Other
Files changed: manifest, manifest.uuid, src/resolve.c, test/gencol1.test
Commit date: 2019-11-21 19:37:00 +0000
Commit message: Whenever a generated column is used, assume that all columns are used.

FossilOrigin-Name: 6601da58032d18ae00b466c0f2077fb2b1ecd84225b56e1787724bea478eedc9
Diff: diff --git a/manifest b/manifest
index 40924ae60b..e2de30a079 100644
--- a/manifest
+++ b/manifest
@@ -1,7 +1,7 @@
-C Fix\sa\sproblem\sthat\scomes\sup\swhen\susing\sgenerated\scolumns\sthat\sevaluate\sto\sa\nconstant\sin\san\sindex\sand\sthen\smaking\suse\sof\sthat\sindex\sin\sa\sjoin.
-D 2019-11-21T18:28:44.463
+C Whenever\sa\sgenerated\scolumn\sis\sused,\sassume\sthat\sall\scolumns\sare\sused.
+D 2019-11-21T19:37:00.986
 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
 F LICENSE.md df5091916dbb40e6e9686186587125e1b2ff51f022cc334e886c19a0e9982724
 F Makefile.in bf24a9abbb277afa2fbe6bac80a181f22be6c48de771cd260c9851ecf6165dc1
 F Makefile.linux-gcc f609543700659711fbd230eced1f01353117621dccae7b9fb70daa64236c5241
@@ -522,11 +522,11 @@ F src/pcache1.c 62714cbd1b7299a6e6a27a587b66b4fd3a836a84e1181e7f96f5c34a50917848
 F src/pragma.c 36c367a62a9d3415fd3d15523e794cccc2cb74e6d806662b0185b8c686f06acb
 F src/pragma.h ec3b31eac9b1df040f1cc8cb3d89bc06605c3b4cb3d76f833de8d6d6c3f77f04
 F src/prepare.c 6049beb71385f017af6fc320d2c75a4e50b75e280c54232442b785fbb83df057
 F src/printf.c 9be6945837c839ba57837b4bc3af349eba630920fa5532aa518816defe42a7d4
 F src/random.c 80f5d666f23feb3e6665a6ce04c7197212a88384
-F src/resolve.c cf2391c93d425455388389e7a47674b9da107d2ed69ebf49979044d70dbeb045
+F src/resolve.c 023397b50d09a3587a15169b713342e2d595ab29e14e54fd8f4a86b76c461d21
 F src/rowset.c d977b011993aaea002cab3e0bb2ce50cf346000dff94e944d547b989f4b1fe93
 F src/select.c 50ccaf5fc3566b897fd3090b63bd60605f2f3f38ac5709fda6c482510d71aa6c
 F src/shell.c.in 4a3a9e1c11847b1904f2b01d087af1c052f660902755abab457cab1756817ded
 F src/sqlite.h.in 556c9ea9b168a65db70f9b32ce6f530442f717e8033cf56f4699961de9165ed3
 F src/sqlite3.rc 5121c9e10c3964d5755191c80dd1180c122fc3a8
@@ -1019,11 +1019,11 @@ F test/fuzzdata7.db e7a86fd83dda151d160445d542e32e5c6019c541b3a74c2a525b6ac64063
 F test/fuzzdata8.db b45368bbe9f86d40d30603e8f780ac29807cbcc951a18d7a7fd9d0c0e904706e
 F test/fuzzer1.test 3d4c4b7e547aba5e5511a2991e3e3d07166cfbb8
 F test/fuzzer2.test a85ef814ce071293bce1ad8dffa217cbbaad4c14
 F test/fuzzerfault.test 8792cd77fd5bce765b05d0c8e01b9edcf8af8536
 F test/gcfault.test dd28c228a38976d6336a3fc42d7e5f1ad060cb8c
-F test/gencol1.test cb18ae911ed157058ea030988463bd1ec3315ba889b4aff4b8711551c393afae
+F test/gencol1.test 6bdf7fbaa001321d01f35f7c33ccb847cf937b760877b9a32723e009983c13f7
 F test/genesis.tcl 1e2e2e8e5cc4058549a154ff1892fe5c9de19f98
 F test/having.test e4098a4b8962f9596035c3b87a8928a10648acc509f1bb8d6f96413bbf79a1b3
 F test/hexlit.test 4a6a5f46e3c65c4bf1fa06f5dd5a9507a5627751
 F test/hidden.test 23c1393a79e846d68fd902d72c85d5e5dcf98711
 F test/hook.test 1604b3b2f5931430087540404555c1b6be3618600b81558657c66b533ed70b13
@@ -1848,9 +1848,9 @@ F vsixtest/pch.h 9cab7980f2ac4baa40807d8b5e52af32a21cf78c
 F vsixtest/vsixtest.sln 77cadbe4e96c1fe1bf51cd77de9e9b0a12ada547
 F vsixtest/vsixtest.tcl 6a9a6ab600c25a91a7acc6293828957a386a8a93
 F vsixtest/vsixtest.vcxproj.data 2ed517e100c66dc455b492e1a33350c1b20fbcdc
 F vsixtest/vsixtest.vcxproj.filters 37e51ffedcdb064aad6ff33b6148725226cd608e
 F vsixtest/vsixtest_TemporaryKey.pfx e5b1b036facdb453873e7084e1cae9102ccc67a0
-P 2d53a30cc23e53033af8e8666457654db5dcc453ed6cd176ce1d0bff4f528159
-R 916b27815e9b3d41c41616a867889cc0
+P 8b12e95fec7ce6e0de82a04ca3dfcf1a8e62e233b7382aa28a8a9be6e862b1af
+R e99d34ba61fb6b297b18cc8c33e9b417
 U drh
-Z 2f4253a7507c4c18153791477951e376
+Z 29f405b4db68236e1fc771220e887d13
diff --git a/manifest.uuid b/manifest.uuid
index 44815f28dd..330cf7c4ae 100644
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-8b12e95fec7ce6e0de82a04ca3dfcf1a8e62e233b7382aa28a8a9be6e862b1af
\ No newline at end of file
+6601da58032d18ae00b466c0f2077fb2b1ecd84225b56e1787724bea478eedc9
\ No newline at end of file
diff --git a/src/resolve.c b/src/resolve.c
index 9be62c0902..fbfdf118e2 100644
--- a/src/resolve.c
+++ b/src/resolve.c
@@ -549,21 +549,35 @@ static int lookupName(
     pTopNC->nErr++;
   }
 
   /* If a column from a table in pSrcList is referenced, then record
   ** this fact in the pSrcList.a[].colUsed bitmask.  Column 0 causes
-  ** bit 0 to be set.  Column 1 sets bit 1.  And so forth.  If the
-  ** column number is greater than the number of bits in the bitmask
-  ** then set the high-order bit of the bitmask.
+  ** bit 0 to be set.  Column 1 sets bit 1.  And so forth.
+  **
+  ** The colUsed mask is an optimization used to help determine if an
+  ** index is a covering index.  The correct answer is still obtained
+  ** if the mask contains extra bits.  But omitting bits from the mask
+  ** might result in an incorrect answer.
+  **
+  ** The high-order bit of the mask is a "we-use-them-all" bit.
+  ** If the column number is greater than the number of bits in the bitmask
+  ** then set the high-order bit of the bitmask.  Also set the high-order
+  ** bit if the column is a generated column, as that adds dependencies
+  ** that are difficult to track, so we assume that all columns are used.
   */
   if( pExpr->iColumn>=0 && pMatch!=0 ){
     int n = pExpr->iColumn;
     testcase( n==BMS-1 );
     if( n>=BMS ){
       n = BMS-1;
     }
+    assert( pExpr->y.pTab!=0 );
     assert( pMatch->iCursor==pExpr->iTable );
+    if( pExpr->y.pTab->tabFlags & TF_HasGenerated ){
+      Column *pCol = pExpr->y.pTab->aCol + pExpr->iColumn;
+      if( pCol->colFlags & COLFLAG_GENERATED ) n = BMS-1;
+    }
     pMatch->colUsed |= ((Bitmask)1)<<n;
   }
 
   /* Clean up and return
   */
diff --git a/test/gencol1.test b/test/gencol1.test
index 9e2ca21e87..15b93c72a2 100644
--- a/test/gencol1.test
+++ b/test/gencol1.test
@@ -244,16 +244,21 @@ do_catchsql_test gencol1-8.20 {
 } {1 {generated column loop on "c2"}}
 
 # 2019-11-21 Problems in the new generated column logic
 # reported by Yongheng Chen and Rui Zhong
 do_execsql_test gencol1-9.10 {
-  DROP TABLE IF EXISTS t1;
-  DROP TABLE IF EXISTS t2;
+  DROP TABLE t1;
   CREATE TABLE t1(aa , bb AS (17) UNIQUE);
   INSERT INTO t1 VALUES(17);
   CREATE TABLE t2(cc);
   INSERT INTO t2 VALUES(41);
   SELECT * FROM t2 JOIN t1 WHERE t1.bb=t1.aa AND t1.bb=17;
 } {41 17 17}
-
+do_execsql_test gencol1-9.20 {
+  CREATE TABLE t3(aa INT PRIMARY KEY, bb UNIQUE AS(aa));
+  INSERT INTO t3 VALUES(1);
+  SELECT 100, * FROM t3;
+  DELETE FROM t3 WHERE (SELECT bb FROM t3);
+  SELECT 200, * FROM t3;
+} {100 1 1}
 
 finish_test

Vulnerable code: C Fix\sa\sproblem\sthat\scomes\sup\swhen\susing\sgenerated\scolumns\sthat\sevaluate\sto\sa\nconstant\sin\san\sindex\sand\sthen\smaking\suse\sof\sthat\sindex\sin\sa\sjoin.
D 2019-11-21T18:28:44.463
F src/resolve.c cf2391c93d425455388389e7a47674b9da107d2ed69ebf49979044d70dbeb045
F test/gencol1.test cb18ae911ed157058ea030988463bd1ec3315ba889b4aff4b8711551c393afae
P 2d53a30cc23e53033af8e8666457654db5dcc453ed6cd176ce1d0bff4f528159
R 916b27815e9b3d41c41616a867889cc0
Z 2f4253a7507c4c18153791477951e376
8b12e95fec7ce6e0de82a04ca3dfcf1a8e62e233b7382aa28a8a9be6e862b1af
  ** bit 0 to be set.  Column 1 sets bit 1.  And so forth.  If the
  ** column number is greater than the number of bits in the bitmask
  ** then set the high-order bit of the bitmask.
  DROP TABLE IF EXISTS t1;
  DROP TABLE IF EXISTS t2;

Fixed code: C Whenever\sa\sgenerated\scolumn\sis\sused,\sassume\sthat\sall\scolumns\sare\sused.
D 2019-11-21T19:37:00.986
F src/resolve.c 023397b50d09a3587a15169b713342e2d595ab29e14e54fd8f4a86b76c461d21
F test/gencol1.test 6bdf7fbaa001321d01f35f7c33ccb847cf937b760877b9a32723e009983c13f7
P 8b12e95fec7ce6e0de82a04ca3dfcf1a8e62e233b7382aa28a8a9be6e862b1af
R e99d34ba61fb6b297b18cc8c33e9b417
Z 29f405b4db68236e1fc771220e887d13
6601da58032d18ae00b466c0f2077fb2b1ecd84225b56e1787724bea478eedc9
  ** bit 0 to be set.  Column 1 sets bit 1.  And so forth.
  **
  ** The colUsed mask is an optimization used to help determine if an
  ** index is a covering index.  The correct answer is still obtained
  ** if the mask contains extra bits.  But omitting bits from the mask
  ** might result in an incorrect answer.
  **
  ** The high-order bit of the mask is a "we-use-them-all" bit.
  ** If the column number is greater than the number of bits in the bitmask
  ** then set the high-order bit of the bitmask.  Also set the high-order
  ** bit if the column is a generated column, as that adds dependencies
  ** that are difficult to track, so we assume that all columns are used.
    assert( pExpr->y.pTab!=0 );
    if( pExpr->y.pTab->tabFlags & TF_HasGenerated ){
      Column *pCol = pExpr->y.pTab->aCol + pExpr->iColumn;
      if( pCol->colFlags & COLFLAG_GENERATED ) n = BMS-1;
    }
  DROP TABLE t1;
do_execsql_test gencol1-9.20 {
  CREATE TABLE t3(aa INT PRIMARY KEY, bb UNIQUE AS(aa));
  INSERT INTO t3 VALUES(1);
  SELECT 100, * FROM t3;
  DELETE FROM t3 WHERE (SELECT bb FROM t3);
  SELECT 200, * FROM t3;
} {100 1 1}