CVE-2019-20218: Improper Handling of Exceptional Conditions (CWE-755)
value: selectExpander in select.c in SQLite 3.30.1 proceeds with WITH stack unwinding even after a parsing error.
CWE description: The product does not handle or incorrectly handles an exceptional condition.
CVSS v3 base score: 7.5
Published: 2020-01-02T14:16Z
Repository: https://github.com/sqlite/sqlite
Language: Other
Files changed: manifest, manifest.uuid, src/select.c, test/altertab3.test
Commit date: 2019-12-27 20:54:42 +0000
Commit message: Do not attempt to unwind the WITH stack in the Parse object following an error. This fixes a separate case to [de6e6d68].

FossilOrigin-Name: d29edef93451cc67a5d69c1cce1b1832d9ca8fff1f600afdd51338b74d077b92
Diff: diff --git a/manifest b/manifest
index 3dc5335b673..c699cc6ae03 100644
--- a/manifest
+++ b/manifest
@@ -1,7 +1,7 @@
-C Remove\sa\sNEVER()\sthat\sis\sno\slonger\strue.\sFix\sfor\s[36ffedcb9].
-D 2019-12-27T20:06:32.777
+C Do\snot\sattempt\sto\sunwind\sthe\sWITH\sstack\sin\sthe\sParse\sobject\sfollowing\san\serror.\sThis\sfixes\sa\sseparate\scase\sto\s[de6e6d68].
+D 2019-12-27T20:54:42.382
 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
 F LICENSE.md df5091916dbb40e6e9686186587125e1b2ff51f022cc334e886c19a0e9982724
 F Makefile.in 9dfc7936f675785309b74d09202bb656732325e65df889e5aaa18cc8932e5b0c
 F Makefile.linux-gcc f609543700659711fbd230eced1f01353117621dccae7b9fb70daa64236c5241
@@ -526,11 +526,11 @@ F src/pragma.h ec3b31eac9b1df040f1cc8cb3d89bc06605c3b4cb3d76f833de8d6d6c3f77f04
 F src/prepare.c 6049beb71385f017af6fc320d2c75a4e50b75e280c54232442b785fbb83df057
 F src/printf.c 9be6945837c839ba57837b4bc3af349eba630920fa5532aa518816defe42a7d4
 F src/random.c 80f5d666f23feb3e6665a6ce04c7197212a88384
 F src/resolve.c e231da7dd307f99772c40e76096abaf05c6fedcb4f1f045de23a61c194df6da6
 F src/rowset.c d977b011993aaea002cab3e0bb2ce50cf346000dff94e944d547b989f4b1fe93
-F src/select.c 83e3aba723cd50134b8af4b18433f46123c31889a39c8b4ac28cccedbdf070e8
+F src/select.c e18a64e8d9f468ce9c183ab27ad79658b2aad8128e0dcfcd0c5dfe0132fc1074
 F src/shell.c.in 4a3a9e1c11847b1904f2b01d087af1c052f660902755abab457cab1756817ded
 F src/sqlite.h.in 2a23e8161775253d9cf383c2c6aa559005dc787d350dcb0be67a6c4cc3bd1d19
 F src/sqlite3.rc 5121c9e10c3964d5755191c80dd1180c122fc3a8
 F src/sqlite3ext.h 72af51aa4e912e14cd495fb6e7fac65f0940db80ed950d90911aff292cc47ce2
 F src/sqliteInt.h 3e235c7a406630bff9fe7183d9af5d4ce21a9b7acb77bf1b82a0caa130a5f687
@@ -636,11 +636,11 @@ F test/altercol.test 54374d2ba18af25bb24e23acf18a60270d4ec120b7ec0558078b59d5aa1
 F test/alterlegacy.test 82022721ce0de29cedc9a7af63bc9fcc078b0ee000f8283b4b6ea9c3eab2f44b
 F test/altermalloc.test 167a47de41b5c638f5f5c6efb59784002b196fff70f98d9b4ed3cd74a3fb80c9
 F test/altermalloc2.test fa7b1c1139ea39b8dec407cf1feb032ca8e0076bd429574969b619175ad0174b
 F test/altertab.test 4d8b79b0b88b62b90b710390df14fe99e0a3578345526886eaa550e28e3065dc
 F test/altertab2.test 8883693952f6d7fb5f754dbf1d694ed780aa883027bef04cb1fb99a3b88c9272
-F test/altertab3.test 10c32d6251344bdc114d2df27e62cb72b5afc676f20709224d362d0cff0aa3e3
+F test/altertab3.test d58d41201afd64c6176dcc4e71110c600c03841dad1efcc354de2248f6126e70
 F test/amatch1.test b5ae7065f042b7f4c1c922933f4700add50cdb9f
 F test/analyze.test 547bb700f903107b38611b014ca645d6b5bb819f5210d7bf39c40802aafeb7d7
 F test/analyze3.test 01f0b122e3e54ad2544f14f7cc7dcb4c2cb8753cad5e88c6b8d49615b3fd6a2b
 F test/analyze4.test cdf88f3f72b0f0643a1ff6c730fc5af1e42464d47478d9fbac84c333f72c014e
 F test/analyze5.test fa5131952303ac4146aba101b116b9c8cb89e2637531c334a6df7f7d19dddc0d
@@ -1851,9 +1851,9 @@ F vsixtest/pch.h 9cab7980f2ac4baa40807d8b5e52af32a21cf78c
 F vsixtest/vsixtest.sln 77cadbe4e96c1fe1bf51cd77de9e9b0a12ada547
 F vsixtest/vsixtest.tcl 6a9a6ab600c25a91a7acc6293828957a386a8a93
 F vsixtest/vsixtest.vcxproj.data 2ed517e100c66dc455b492e1a33350c1b20fbcdc
 F vsixtest/vsixtest.vcxproj.filters 37e51ffedcdb064aad6ff33b6148725226cd608e
 F vsixtest/vsixtest_TemporaryKey.pfx e5b1b036facdb453873e7084e1cae9102ccc67a0
-P e3b5fc05c00fc58be7a7c94ce1d97a5b05113f39aba03df64aab08364f85616b
-R a966e346a033c0ab1a88c0d109a734aa
+P 597896ed0ae9e2960a8f39576bd7f77a11dccc1da84b6a44ebb5c38d90ebc330
+R e2fa6fb2e144752a1d4a9d45874c1bd9
 U dan
-Z ba0d31a3cdb9b737f0aa85ce7fe964a5
+Z e36f281614de7335dc6fbd6aa6abfc9f
diff --git a/manifest.uuid b/manifest.uuid
index 55ef3d6a917..dd056531ff9 100644
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-597896ed0ae9e2960a8f39576bd7f77a11dccc1da84b6a44ebb5c38d90ebc330
\ No newline at end of file
+d29edef93451cc67a5d69c1cce1b1832d9ca8fff1f600afdd51338b74d077b92
\ No newline at end of file
diff --git a/src/select.c b/src/select.c
index 5afd6b76ce4..6298e331f8d 100644
--- a/src/select.c
+++ b/src/select.c
@@ -4976,11 +4976,11 @@ static int selectExpander(Walker *pWalker, Select *p){
     }
   }
 
   /* Process NATURAL keywords, and ON and USING clauses of joins.
   */
-  if( db->mallocFailed || sqliteProcessJoin(pParse, p) ){
+  if( pParse->nErr || db->mallocFailed || sqliteProcessJoin(pParse, p) ){
     return WRC_Abort;
   }
 
   /* For every "*" that occurs in the column list, insert the names of
   ** all columns in all tables.  And for every TABLE.* insert the names
diff --git a/test/altertab3.test b/test/altertab3.test
index 27bca291fc2..74b9b1a0f00 100644
--- a/test/altertab3.test
+++ b/test/altertab3.test
@@ -529,6 +529,28 @@ do_execsql_test 23.1 {
 
 do_catchsql_test 23.2 {
   ALTER TABLE t1 RENAME TO t1x;
 } {1 {error in trigger r1: no such table: main.t2}}
 
+#------------------------------------------------------------------------
+#
+reset_db
+do_execsql_test 23.1 {
+  CREATE TABLE v0 (a);
+  CREATE VIEW v2 (v3) AS 
+    WITH x1 AS (SELECT * FROM v2) 
+    SELECT v3 AS x, v3 AS y FROM v2; 
+}
+
+do_catchsql_test 23.2 {
+  SELECT * FROM v2
+} {1 {view v2 is circularly defined}}
+
+db close
+sqlite3 db test.db
+
+do_catchsql_test 23.3 {
+  ALTER TABLE v0 RENAME TO t3 ;
+} {1 {error in view v2: view v2 is circularly defined}}
+
 finish_test
+

Vulnerable code: C Remove\sa\sNEVER()\sthat\sis\sno\slonger\strue.\sFix\sfor\s[36ffedcb9].
D 2019-12-27T20:06:32.777
F src/select.c 83e3aba723cd50134b8af4b18433f46123c31889a39c8b4ac28cccedbdf070e8
F test/altertab3.test 10c32d6251344bdc114d2df27e62cb72b5afc676f20709224d362d0cff0aa3e3
P e3b5fc05c00fc58be7a7c94ce1d97a5b05113f39aba03df64aab08364f85616b
R a966e346a033c0ab1a88c0d109a734aa
Z ba0d31a3cdb9b737f0aa85ce7fe964a5
597896ed0ae9e2960a8f39576bd7f77a11dccc1da84b6a44ebb5c38d90ebc330
  if( db->mallocFailed || sqliteProcessJoin(pParse, p) ){
Fixed code: C Do\snot\sattempt\sto\sunwind\sthe\sWITH\sstack\sin\sthe\sParse\sobject\sfollowing\san\serror.\sThis\sfixes\sa\sseparate\scase\sto\s[de6e6d68].
D 2019-12-27T20:54:42.382
F src/select.c e18a64e8d9f468ce9c183ab27ad79658b2aad8128e0dcfcd0c5dfe0132fc1074
F test/altertab3.test d58d41201afd64c6176dcc4e71110c600c03841dad1efcc354de2248f6126e70
P 597896ed0ae9e2960a8f39576bd7f77a11dccc1da84b6a44ebb5c38d90ebc330
R e2fa6fb2e144752a1d4a9d45874c1bd9
Z e36f281614de7335dc6fbd6aa6abfc9f
d29edef93451cc67a5d69c1cce1b1832d9ca8fff1f600afdd51338b74d077b92
  if( pParse->nErr || db->mallocFailed || sqliteProcessJoin(pParse, p) ){
#------------------------------------------------------------------------
#
reset_db
do_execsql_test 23.1 {
  CREATE TABLE v0 (a);
  CREATE VIEW v2 (v3) AS 
    WITH x1 AS (SELECT * FROM v2) 
    SELECT v3 AS x, v3 AS y FROM v2; 
}

do_catchsql_test 23.2 {
  SELECT * FROM v2
} {1 {view v2 is circularly defined}}

db close
sqlite3 db test.db

do_catchsql_test 23.3 {
  ALTER TABLE v0 RENAME TO t3 ;
} {1 {error in view v2: view v2 is circularly defined}}