CVE-2019-19959: Other (NVD-CWE-Other)
value: ext/misc/zipfile.c in SQLite 3.30.1 mishandles certain uses of INSERT INTO in situations involving embedded '\0' characters in filenames, leading to a memory-management error that can be detected by (for example) valgrind.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
CVSS v3 base score: 7.5
Published: 2020-01-03T22:15Z
Repository: https://github.com/sqlite/sqlite
Language: Other
Files changed: ext/misc/zipfile.c, manifest, manifest.uuid
Commit date: 2019-12-23 21:04:33 +0000
Commit message: Fix the zipfile() function in the zipfile extension so that it is able to
deal with goofy filenames that contain embedded zeros.

FossilOrigin-Name: cc0fb00a128fd0773db5ff7891f7aa577a3671d570166d2cbb30df922344adcf
Diff: diff --git a/ext/misc/zipfile.c b/ext/misc/zipfile.c
index 28017fd6d83..ec820038e24 100644
--- a/ext/misc/zipfile.c
+++ b/ext/misc/zipfile.c
@@ -1630,11 +1630,11 @@ static int zipfileUpdate(
       ** otherwise.  */
       if( zPath[nPath-1]!='/' ){
         zFree = sqlite3_mprintf("%s/", zPath);
         if( zFree==0 ){ rc = SQLITE_NOMEM; }
         zPath = (const char*)zFree;
-        nPath++;
+        nPath = (int)strlen(zPath);
       }
     }
 
     /* Check that we're not inserting a duplicate entry -OR- updating an
     ** entry with a path, thereby making it into a duplicate. */
@@ -2031,15 +2031,15 @@ void zipfileStep(sqlite3_context *pCtx, int nVal, sqlite3_value **apVal){
       goto zipfile_step_out;
     }
   }else{
     if( zName[nName-1]!='/' ){
       zName = zFree = sqlite3_mprintf("%s/", zName);
-      nName++;
       if( zName==0 ){
         rc = SQLITE_NOMEM;
         goto zipfile_step_out;
       }
+      nName = (int)strlen(zName);
     }else{
       while( nName>1 && zName[nName-2]=='/' ) nName--;
     }
   }
 
diff --git a/manifest b/manifest
index c90dd789d38..65200c2912f 100644
--- a/manifest
+++ b/manifest
@@ -1,7 +1,7 @@
-C Thoroughly\sreset\sthe\srtree\scursor\sat\sthe\sstart\sof\seach\sVFilter\soperation,\nincluding\sclearing\sits\scache.\s\sThis\sprevents\sleft\sover\spages\sin\sthe\scache\nwhich\scan\scause\sproblems\son\sshutdown\safter\sa\sLEFT\sJOIN.\nTicket\s[5eadca17c4dde90c]
-D 2019-12-23T20:41:39.904
+C Fix\sthe\szipfile()\sfunction\sin\sthe\szipfile\sextension\sso\sthat\sit\sis\sable\sto\ndeal\swith\sgoofy\sfilenames\sthat\scontain\sembedded\szeros.
+D 2019-12-23T21:04:33.977
 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
 F LICENSE.md df5091916dbb40e6e9686186587125e1b2ff51f022cc334e886c19a0e9982724
 F Makefile.in d3a862c9742f5a08230a3b295c0a47fd3067f19356dc39935280135f90474b04
 F Makefile.linux-gcc f609543700659711fbd230eced1f01353117621dccae7b9fb70daa64236c5241
@@ -322,11 +322,11 @@ F ext/misc/uuid.c db4db81e8c6a92ad6176ebd9f81dcb6870e331e1a286d0452f4319e3ba3df8
 F ext/misc/vfslog.c 3b25c2f56ba60788db247287be6ab024b53c4afffd412b4876db563389be0d35
 F ext/misc/vfsstat.c 77b5b4235c9f7f11eddf82487c0a422944ac2f132dafd5af3be7a68a057b1cdb
 F ext/misc/vtablog.c 5538acd0c8ddaae372331bee11608d76973436b77d6a91e8635cfc9432fba5ae
 F ext/misc/vtshim.c 1976e6dd68dd0d64508c91a6dfab8e75f8aaf6cd
 F ext/misc/wholenumber.c 784b12543d60702ebdd47da936e278aa03076212
-F ext/misc/zipfile.c dfec5589395fc2272a646fc309935ecb5164934a95757762afa120b72d1d0ba4
+F ext/misc/zipfile.c 46b8022d5c4f118995c3e7228542215204dacc9c1c4e9872710900ec276d6db3
 F ext/misc/zorder.c b0ff58fa643afa1d846786d51ea8d5c4b6b35aa0254ab5a82617db92f3adda64
 F ext/rbu/rbu.c 8681f6157db6adc82c34af24b14ea8a3be0146ad2a3b6c1d5da6cb8a5796c8ce
 F ext/rbu/rbu1.test 221d9c18a5e600ac9ac6b1810d99d9f99163a7909ba61597876ab6e4d4beb3d6
 F ext/rbu/rbu10.test 0a201c32202143f23c81c0144503da339786fc20acb7a2fda11601b65659f314
 F ext/rbu/rbu11.test 5c834cf491086b45e071eabf71f708febc143e86a384a92de69e0b1a4cace144
@@ -1850,9 +1850,9 @@ F vsixtest/pch.h 9cab7980f2ac4baa40807d8b5e52af32a21cf78c
 F vsixtest/vsixtest.sln 77cadbe4e96c1fe1bf51cd77de9e9b0a12ada547
 F vsixtest/vsixtest.tcl 6a9a6ab600c25a91a7acc6293828957a386a8a93
 F vsixtest/vsixtest.vcxproj.data 2ed517e100c66dc455b492e1a33350c1b20fbcdc
 F vsixtest/vsixtest.vcxproj.filters 37e51ffedcdb064aad6ff33b6148725226cd608e
 F vsixtest/vsixtest_TemporaryKey.pfx e5b1b036facdb453873e7084e1cae9102ccc67a0
-P 953e6aa6d9ca09e549c88bc728c322fabdcef581f3b4a7763d95488dddbbd6a5
-R ca340be656fb975dcd1521355f675df7
+P 4c50afafce8416369f89477ba7fe7d9b047399a5ee5754c73d0e67bbea8d877c
+R 29d7c3cbcd5652a73d3305fec9c54b58
 U drh
-Z 22698fecf79ba95f8e537178f371e71c
+Z b32fa973d6865a272376759a8cfda3e5
diff --git a/manifest.uuid b/manifest.uuid
index 227d56ff790..c0b77ea9f05 100644
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-4c50afafce8416369f89477ba7fe7d9b047399a5ee5754c73d0e67bbea8d877c
\ No newline at end of file
+cc0fb00a128fd0773db5ff7891f7aa577a3671d570166d2cbb30df922344adcf
\ No newline at end of file

Vulnerable code:         nPath++;
      nName++;
C Thoroughly\sreset\sthe\srtree\scursor\sat\sthe\sstart\sof\seach\sVFilter\soperation,\nincluding\sclearing\sits\scache.\s\sThis\sprevents\sleft\sover\spages\sin\sthe\scache\nwhich\scan\scause\sproblems\son\sshutdown\safter\sa\sLEFT\sJOIN.\nTicket\s[5eadca17c4dde90c]
D 2019-12-23T20:41:39.904
F ext/misc/zipfile.c dfec5589395fc2272a646fc309935ecb5164934a95757762afa120b72d1d0ba4
P 953e6aa6d9ca09e549c88bc728c322fabdcef581f3b4a7763d95488dddbbd6a5
R ca340be656fb975dcd1521355f675df7
Z 22698fecf79ba95f8e537178f371e71c
4c50afafce8416369f89477ba7fe7d9b047399a5ee5754c73d0e67bbea8d877c
Fixed code:         nPath = (int)strlen(zPath);
      nName = (int)strlen(zName);
C Fix\sthe\szipfile()\sfunction\sin\sthe\szipfile\sextension\sso\sthat\sit\sis\sable\sto\ndeal\swith\sgoofy\sfilenames\sthat\scontain\sembedded\szeros.
D 2019-12-23T21:04:33.977
F ext/misc/zipfile.c 46b8022d5c4f118995c3e7228542215204dacc9c1c4e9872710900ec276d6db3
P 4c50afafce8416369f89477ba7fe7d9b047399a5ee5754c73d0e67bbea8d877c
R 29d7c3cbcd5652a73d3305fec9c54b58
Z b32fa973d6865a272376759a8cfda3e5
cc0fb00a128fd0773db5ff7891f7aa577a3671d570166d2cbb30df922344adcf