CVE-2019-19959: Other (NVD-CWE-Other)
value: ext/misc/zipfile.c in SQLite 3.30.1 mishandles certain uses of INSERT INTO in situations involving embedded '\0' characters in filenames, leading to a memory-management error that can be detected by (for example) valgrind.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
CVSS v3 base score: 7.5
Published: 2020-01-03T22:15Z
Repository: https://github.com/sqlite/sqlite
Language: Other
Files changed: manifest, manifest.uuid, test/zipfile.test
Commit date: 2019-12-23 21:11:15 +0000
Commit message: Test case for the zipfile-extension bug fix of the previous check-in.

FossilOrigin-Name: bc8bfc7fcdf33f6855584e10e9260073430517ff3268cf0c7988dcc4cd785391
Diff: diff --git a/manifest b/manifest
index 65200c2912f..a959069d126 100644
--- a/manifest
+++ b/manifest
@@ -1,7 +1,7 @@
-C Fix\sthe\szipfile()\sfunction\sin\sthe\szipfile\sextension\sso\sthat\sit\sis\sable\sto\ndeal\swith\sgoofy\sfilenames\sthat\scontain\sembedded\szeros.
-D 2019-12-23T21:04:33.977
+C Test\scase\sfor\sthe\szipfile-extension\sbug\sfix\sof\sthe\sprevious\scheck-in.
+D 2019-12-23T21:11:15.463
 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
 F LICENSE.md df5091916dbb40e6e9686186587125e1b2ff51f022cc334e886c19a0e9982724
 F Makefile.in d3a862c9742f5a08230a3b295c0a47fd3067f19356dc39935280135f90474b04
 F Makefile.linux-gcc f609543700659711fbd230eced1f01353117621dccae7b9fb70daa64236c5241
@@ -1746,11 +1746,11 @@ F test/without_rowid6.test 8463b20098e9f75a501a9f17dfb42fffc79068eac0b2775fe56ef
 F test/without_rowid7.test d7c59a93d726b55812d620f8f284e01904a5b85f9ee9eea8f2f68571a5e8c40e
 F test/wordcount.c d721a4b6fae93e6e33449700bce1686bc23257c27425bc3ef1599dc912adec66
 F test/writecrash.test f1da7f7adfe8d7f09ea79b42e5ca6dcc41102f27f8e334ad71539501ddd910cc
 F test/zeroblob.test 07a5b11ab591d1f26c626945fb7f228f68b993533b2ada77273edf6ee29db174
 F test/zerodamage.test 9c41628db7e8d9e8a0181e59ea5f189df311a9f6ce99cc376dc461f66db6f8dc
-F test/zipfile.test daab4c9be151934fd6bbc71a0d2520351efc61719eabbf545920f953883d172a
+F test/zipfile.test 330bec11cee9da4da1a48e648b6d445b9334044089da62e9521803566a36dde2
 F test/zipfile2.test 9903388a602a3834189857a985106ff95c3bba6a3969e0134127df991889db5d
 F test/zipfilefault.test 44d4d7a7f7cca7521d569d7f71026b241d65a6b1757aa409c1a168827edbbc2c
 F tool/GetFile.cs 47852aa0d806fe47ed1ac5138bdce7f000fe87aaa7f28107d0cb1e26682aeb44
 F tool/GetTclKit.bat 8995df40c4209808b31f24de0b58f90930239a234f7591e3675d45bfbb990c5d
 F tool/Replace.cs 02c67258801c2fb5f63231e0ac0f220b4b36ba91
@@ -1850,9 +1850,9 @@ F vsixtest/pch.h 9cab7980f2ac4baa40807d8b5e52af32a21cf78c
 F vsixtest/vsixtest.sln 77cadbe4e96c1fe1bf51cd77de9e9b0a12ada547
 F vsixtest/vsixtest.tcl 6a9a6ab600c25a91a7acc6293828957a386a8a93
 F vsixtest/vsixtest.vcxproj.data 2ed517e100c66dc455b492e1a33350c1b20fbcdc
 F vsixtest/vsixtest.vcxproj.filters 37e51ffedcdb064aad6ff33b6148725226cd608e
 F vsixtest/vsixtest_TemporaryKey.pfx e5b1b036facdb453873e7084e1cae9102ccc67a0
-P 4c50afafce8416369f89477ba7fe7d9b047399a5ee5754c73d0e67bbea8d877c
-R 29d7c3cbcd5652a73d3305fec9c54b58
+P cc0fb00a128fd0773db5ff7891f7aa577a3671d570166d2cbb30df922344adcf
+R 01755885676b946174adbb226548e4c0
 U drh
-Z b32fa973d6865a272376759a8cfda3e5
+Z 9cbb5c3517ed7c9d1c8f71b1fd10d978
diff --git a/manifest.uuid b/manifest.uuid
index c0b77ea9f05..565704d085b 100644
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-cc0fb00a128fd0773db5ff7891f7aa577a3671d570166d2cbb30df922344adcf
\ No newline at end of file
+bc8bfc7fcdf33f6855584e10e9260073430517ff3268cf0c7988dcc4cd785391
\ No newline at end of file
diff --git a/test/zipfile.test b/test/zipfile.test
index a37e8139be0..e4b80884e0f 100644
--- a/test/zipfile.test
+++ b/test/zipfile.test
@@ -806,7 +806,19 @@ do_execsql_test 13.10 {
   REPLACE INTO t1 SELECT * FROM t0;
   SELECT quote(name),quote(mode),quote(mtime),quote(sz),quote(rawdata),
          quote(data),quote(method) FROM t1;
 } {'' 10 10 2 X'3130' X'3130' 0}
 
+# 2019-12-23 Yongheng and Rui fuzzer
+# Run using valgrind to see the problem.
+#
+do_execsql_test 14.10 {
+  DROP TABLE t1;
+  CREATE TABLE t1(x char);
+  INSERT INTO t1(x) VALUES('1');
+  INSERT INTO t1(x) SELECT zipfile(x, 'xyz') FROM t1;
+  INSERT INTO t1(x) SELECT zipfile(x, 'uvw') FROM t1;
+  SELECT count(*) FROM t1;
+  PRAGMA integrity_check;
+} {3 ok}
 
 finish_test

Vulnerable code: C Fix\sthe\szipfile()\sfunction\sin\sthe\szipfile\sextension\sso\sthat\sit\sis\sable\sto\ndeal\swith\sgoofy\sfilenames\sthat\scontain\sembedded\szeros.
D 2019-12-23T21:04:33.977
F test/zipfile.test daab4c9be151934fd6bbc71a0d2520351efc61719eabbf545920f953883d172a
P 4c50afafce8416369f89477ba7fe7d9b047399a5ee5754c73d0e67bbea8d877c
R 29d7c3cbcd5652a73d3305fec9c54b58
Z b32fa973d6865a272376759a8cfda3e5
cc0fb00a128fd0773db5ff7891f7aa577a3671d570166d2cbb30df922344adcf
Fixed code: C Test\scase\sfor\sthe\szipfile-extension\sbug\sfix\sof\sthe\sprevious\scheck-in.
D 2019-12-23T21:11:15.463
F test/zipfile.test 330bec11cee9da4da1a48e648b6d445b9334044089da62e9521803566a36dde2
P cc0fb00a128fd0773db5ff7891f7aa577a3671d570166d2cbb30df922344adcf
R 01755885676b946174adbb226548e4c0
Z 9cbb5c3517ed7c9d1c8f71b1fd10d978
bc8bfc7fcdf33f6855584e10e9260073430517ff3268cf0c7988dcc4cd785391
# 2019-12-23 Yongheng and Rui fuzzer
# Run using valgrind to see the problem.
#
do_execsql_test 14.10 {
  DROP TABLE t1;
  CREATE TABLE t1(x char);
  INSERT INTO t1(x) VALUES('1');
  INSERT INTO t1(x) SELECT zipfile(x, 'xyz') FROM t1;
  INSERT INTO t1(x) SELECT zipfile(x, 'uvw') FROM t1;
  SELECT count(*) FROM t1;
  PRAGMA integrity_check;
} {3 ok}