CVE-2019-19925: Unrestricted Upload of File with Dangerous Type (CWE-434)
value: zipfileUpdate in ext/misc/zipfile.c in SQLite 3.30.1 mishandles a NULL pathname during an update of a ZIP archive.
CWE description: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
CVSS v3 base score: 7.5
Published: 2019-12-24T17:15Z
Repository: https://github.com/sqlite/sqlite
Language: Other
Files changed: ext/misc/zipfile.c, manifest, manifest.uuid, test/zipfile.test
Commit date: 2019-12-19 15:15:40 +0000
Commit message: Fix the zipfile extension so that INSERT works even if the pathname of
the file being inserted is a NULL.  Bug discovered by the
Yongheng and Rui fuzzer.

FossilOrigin-Name: a80f84b511231204658304226de3e075a55afc2e3f39ac063716f7a57f585c06
Diff: diff --git a/ext/misc/zipfile.c b/ext/misc/zipfile.c
index 0d66f6a6f55..9a0345d9fdc 100644
--- a/ext/misc/zipfile.c
+++ b/ext/misc/zipfile.c
@@ -1617,10 +1617,11 @@ static int zipfileUpdate(
       rc = zipfileGetMode(apVal[3], bIsDir, &mode, &pTab->base.zErrMsg);
     }
 
     if( rc==SQLITE_OK ){
       zPath = (const char*)sqlite3_value_text(apVal[2]);
+      if( zPath==0 ) zPath = "";
       nPath = (int)strlen(zPath);
       mTime = zipfileGetTime(apVal[4]);
     }
 
     if( rc==SQLITE_OK && bIsDir ){
diff --git a/manifest b/manifest
index 91c07f8a4cb..8c11ba89634 100644
--- a/manifest
+++ b/manifest
@@ -1,7 +1,7 @@
-C Fix\sincorrect\sSQL\sgenerated\sby\sthe\sLemon\schange\sof\sthe\sprevious\scheck-in.
-D 2019-12-19T13:17:07.364
+C Fix\sthe\szipfile\sextension\sso\sthat\sINSERT\sworks\seven\sif\sthe\spathname\sof\nthe\sfile\sbeing\sinserted\sis\sa\sNULL.\s\sBug\sdiscovered\sby\sthe\nYongheng\sand\sRui\sfuzzer.
+D 2019-12-19T15:15:40.450
 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
 F LICENSE.md df5091916dbb40e6e9686186587125e1b2ff51f022cc334e886c19a0e9982724
 F Makefile.in d3a862c9742f5a08230a3b295c0a47fd3067f19356dc39935280135f90474b04
 F Makefile.linux-gcc f609543700659711fbd230eced1f01353117621dccae7b9fb70daa64236c5241
@@ -322,11 +322,11 @@ F ext/misc/uuid.c db4db81e8c6a92ad6176ebd9f81dcb6870e331e1a286d0452f4319e3ba3df8
 F ext/misc/vfslog.c 3b25c2f56ba60788db247287be6ab024b53c4afffd412b4876db563389be0d35
 F ext/misc/vfsstat.c 77b5b4235c9f7f11eddf82487c0a422944ac2f132dafd5af3be7a68a057b1cdb
 F ext/misc/vtablog.c 5538acd0c8ddaae372331bee11608d76973436b77d6a91e8635cfc9432fba5ae
 F ext/misc/vtshim.c 1976e6dd68dd0d64508c91a6dfab8e75f8aaf6cd
 F ext/misc/wholenumber.c 784b12543d60702ebdd47da936e278aa03076212
-F ext/misc/zipfile.c 7ad29133e304e40c8fe239bea10e101580ed56bc68c16d992af514cce19572d0
+F ext/misc/zipfile.c 8f965eb309da3ae8c30088f6c3ebdddcdbdf9e0ef24f3bc7ae0756deb93da503
 F ext/misc/zorder.c b0ff58fa643afa1d846786d51ea8d5c4b6b35aa0254ab5a82617db92f3adda64
 F ext/rbu/rbu.c 8681f6157db6adc82c34af24b14ea8a3be0146ad2a3b6c1d5da6cb8a5796c8ce
 F ext/rbu/rbu1.test 221d9c18a5e600ac9ac6b1810d99d9f99163a7909ba61597876ab6e4d4beb3d6
 F ext/rbu/rbu10.test 0a201c32202143f23c81c0144503da339786fc20acb7a2fda11601b65659f314
 F ext/rbu/rbu11.test 5c834cf491086b45e071eabf71f708febc143e86a384a92de69e0b1a4cace144
@@ -1746,11 +1746,11 @@ F test/without_rowid6.test 8463b20098e9f75a501a9f17dfb42fffc79068eac0b2775fe56ef
 F test/without_rowid7.test d7c59a93d726b55812d620f8f284e01904a5b85f9ee9eea8f2f68571a5e8c40e
 F test/wordcount.c d721a4b6fae93e6e33449700bce1686bc23257c27425bc3ef1599dc912adec66
 F test/writecrash.test f1da7f7adfe8d7f09ea79b42e5ca6dcc41102f27f8e334ad71539501ddd910cc
 F test/zeroblob.test 07a5b11ab591d1f26c626945fb7f228f68b993533b2ada77273edf6ee29db174
 F test/zerodamage.test 9c41628db7e8d9e8a0181e59ea5f189df311a9f6ce99cc376dc461f66db6f8dc
-F test/zipfile.test b3b558639f7a103e095713ad0f57fec1fce1b7d60c8054df5789b98f7547a395
+F test/zipfile.test daab4c9be151934fd6bbc71a0d2520351efc61719eabbf545920f953883d172a
 F test/zipfile2.test 9903388a602a3834189857a985106ff95c3bba6a3969e0134127df991889db5d
 F test/zipfilefault.test 44d4d7a7f7cca7521d569d7f71026b241d65a6b1757aa409c1a168827edbbc2c
 F tool/GetFile.cs 47852aa0d806fe47ed1ac5138bdce7f000fe87aaa7f28107d0cb1e26682aeb44
 F tool/GetTclKit.bat 8995df40c4209808b31f24de0b58f90930239a234f7591e3675d45bfbb990c5d
 F tool/Replace.cs 02c67258801c2fb5f63231e0ac0f220b4b36ba91
@@ -1850,9 +1850,9 @@ F vsixtest/pch.h 9cab7980f2ac4baa40807d8b5e52af32a21cf78c
 F vsixtest/vsixtest.sln 77cadbe4e96c1fe1bf51cd77de9e9b0a12ada547
 F vsixtest/vsixtest.tcl 6a9a6ab600c25a91a7acc6293828957a386a8a93
 F vsixtest/vsixtest.vcxproj.data 2ed517e100c66dc455b492e1a33350c1b20fbcdc
 F vsixtest/vsixtest.vcxproj.filters 37e51ffedcdb064aad6ff33b6148725226cd608e
 F vsixtest/vsixtest_TemporaryKey.pfx e5b1b036facdb453873e7084e1cae9102ccc67a0
-P 329cbb372d4d77f774f01a87d104c40ef42d713afbe76195b65f5ca205c5ea7b
-R d028a5f013795e21f082346da52e7329
+P fccfb8a9ed3c1df9f23762bb8df6fdf36a21118899e3fae41f451169a5f2c08e
+R 0fec610fab0a45c2e8f5600ef1cab28e
 U drh
-Z 50186217141264fb7bf8cc1df4e95908
+Z aed8df93d89c2e0fad2b3edf29a44f34
diff --git a/manifest.uuid b/manifest.uuid
index f064dd77ffa..cd30110c815 100644
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-fccfb8a9ed3c1df9f23762bb8df6fdf36a21118899e3fae41f451169a5f2c08e
\ No newline at end of file
+a80f84b511231204658304226de3e075a55afc2e3f39ac063716f7a57f585c06
\ No newline at end of file
diff --git a/test/zipfile.test b/test/zipfile.test
index 2bab066df0b..a37e8139be0 100644
--- a/test/zipfile.test
+++ b/test/zipfile.test
@@ -793,6 +793,20 @@ if {$tcl_platform(platform)!="windows"} {
   do_execsql_test 12.5 {
     SELECT name FROM d JOIN x JOIN fsdir('.', d) ORDER BY 1;
   } {. ./x1.txt ./x2.txt}
 }
 
+# 2019-12-18 Yongheng and Rui fuzzer
+#
+do_execsql_test 13.10 {
+  DROP TABLE IF EXISTS t0;
+  DROP TABLE IF EXISTS t1;
+  CREATE TABLE t0(a,b,c,d,e,f,g);
+  REPLACE INTO t0(c,b,f) VALUES(10,10,10);
+  CREATE VIRTUAL TABLE t1 USING zipfile('h.zip');
+  REPLACE INTO t1 SELECT * FROM t0;
+  SELECT quote(name),quote(mode),quote(mtime),quote(sz),quote(rawdata),
+         quote(data),quote(method) FROM t1;
+} {'' 10 10 2 X'3130' X'3130' 0}
+
+
 finish_test

Vulnerable code: C Fix\sincorrect\sSQL\sgenerated\sby\sthe\sLemon\schange\sof\sthe\sprevious\scheck-in.
D 2019-12-19T13:17:07.364
F ext/misc/zipfile.c 7ad29133e304e40c8fe239bea10e101580ed56bc68c16d992af514cce19572d0
F test/zipfile.test b3b558639f7a103e095713ad0f57fec1fce1b7d60c8054df5789b98f7547a395
P 329cbb372d4d77f774f01a87d104c40ef42d713afbe76195b65f5ca205c5ea7b
R d028a5f013795e21f082346da52e7329
Z 50186217141264fb7bf8cc1df4e95908
fccfb8a9ed3c1df9f23762bb8df6fdf36a21118899e3fae41f451169a5f2c08e
Fixed code:       if( zPath==0 ) zPath = "";
C Fix\sthe\szipfile\sextension\sso\sthat\sINSERT\sworks\seven\sif\sthe\spathname\sof\nthe\sfile\sbeing\sinserted\sis\sa\sNULL.\s\sBug\sdiscovered\sby\sthe\nYongheng\sand\sRui\sfuzzer.
D 2019-12-19T15:15:40.450
F ext/misc/zipfile.c 8f965eb309da3ae8c30088f6c3ebdddcdbdf9e0ef24f3bc7ae0756deb93da503
F test/zipfile.test daab4c9be151934fd6bbc71a0d2520351efc61719eabbf545920f953883d172a
P fccfb8a9ed3c1df9f23762bb8df6fdf36a21118899e3fae41f451169a5f2c08e
R 0fec610fab0a45c2e8f5600ef1cab28e
Z aed8df93d89c2e0fad2b3edf29a44f34
a80f84b511231204658304226de3e075a55afc2e3f39ac063716f7a57f585c06
# 2019-12-18 Yongheng and Rui fuzzer
#
do_execsql_test 13.10 {
  DROP TABLE IF EXISTS t0;
  DROP TABLE IF EXISTS t1;
  CREATE TABLE t0(a,b,c,d,e,f,g);
  REPLACE INTO t0(c,b,f) VALUES(10,10,10);
  CREATE VIRTUAL TABLE t1 USING zipfile('h.zip');
  REPLACE INTO t1 SELECT * FROM t0;
  SELECT quote(name),quote(mode),quote(mtime),quote(sz),quote(rawdata),
         quote(data),quote(method) FROM t1;
} {'' 10 10 2 X'3130' X'3130' 0}