hitoshura25/cvefixes huggingface dataset:
CVE-2018-25050 (Unknown, published 2022-12-28T10:15Z)
Description: value: A vulnerability, which was classified as problematic, has been found in Harvest Chosen up to 1.8.6. Affected by this issue is the function AbstractChosen of the file coffee/lib/abstract-chosen.coffee. The manipulation of the argument group_label leads to cross site scripting. The attack may be launched remotely. Upgrading to version 1.8.7 is able to address this issue. The name of the patch is 77fd031d541e77510268d1041ed37798fdd1017e. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216956.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/harvesthq/chosen
Files changed:
Commit message: Merge pull request #2997 from harvesthq/fix-group-label-xss-vulnerability

Escape the `group_label` when rendering it 

Vulnerable code:

Fixed code:
CVE-2017-15213 (Other, published 2017-10-11T01:32Z)
Description: value: Stored XSS vulnerability in Flyspray before 1.0-rc6 allows an authenticated user to inject JavaScript to gain administrator privileges, via the real_name or email_address field to themes/CleanFS/templates/common.editallusers.tpl.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/Flyspray/flyspray
Files changed:
themes/CleanFS/templates/common.editallusers.tpl
Commit message: Update common.editallusers.tpl

Vulnerable code:
		<td><a href="<?php echo CreateURL('edituser', $usr['user_id'] ); ?>"><?php echo $usr['real_name']; ?></a></td>
		<td<?= ($usr['notify_type']==0 || $usr['notify_type']==2) ? ' class="inactive"':''; ?>><?php echo $usr['email_address']; ?></td>

Fixed code:
		<td><a href="<?php echo CreateURL('edituser', $usr['user_id'] ); ?>"><?php echo Filters::noXSS($usr['real_name']); ?></a></td>
		<td<?= ($usr['notify_type']==0 || $usr['notify_type']==2) ? ' class="inactive"':''; ?>><?php echo Filters::noXSS($usr['email_address']); ?></td>
CVE-2017-15214 (PHP, published 2017-10-11T01:32Z)
Description: value: Stored XSS vulnerability in Flyspray 1.0-rc4 before 1.0-rc6 allows an authenticated user to inject JavaScript to gain administrator privileges and also to execute JavaScript against other users (including unauthenticated users), via the name, title, or id parameter to plugins/dokuwiki/lib/plugins/changelinks/syntax.php.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/Flyspray/flyspray
Files changed:
plugins/dokuwiki/lib/plugins/changelinks/syntax.php
Commit message: quickfix for dokuwiki links

Vulnerable code:
            $link['name']   = ($name) ? $name : $id;
            $link['title']  = ($name) ? $name : $id;
?>

Fixed code:
         
            if(is_array($name)){
               $link['name']   = (isset($name['title'])) ? hsc($name['title']) : hsc($id);
               $link['title'] = $id;
            } else{
               $link['name']   = ($name) ? hsc($name) : hsc($id);
               $link['title'] = ($name) ? $name : $id;
            }

?>
CVE-2017-6418 (C, published 2017-08-07T03:29Z)
Description: value: libclamav/message.c in ClamAV 0.99.2 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted e-mail message.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/vrtadmin/clamav-devel
Files changed:
libclamav/message.c
Commit message: bb11797 - fix invalid read in fuzzed mail file.


Vulnerable code:
			cli_dbgmsg("Possible data corruption fixed\n");
			p[8] = '=';
			if((*++ptr == '"') && (strchr(&ptr[1], '"') != NULL)) {

Fixed code:
                        if (strlen(p) > 8) {
                            cli_dbgmsg("Possible data corruption fixed\n");
                            p[8] = '=';
                        } else {
                            cli_dbgmsg("Possible data corruption not fixed\n");
                        }
			if((strlen(ptr) > 2) && (*++ptr == '"') && (strchr(&ptr[1], '"') != NULL)) {
CVE-2017-6419 (C, published 2017-08-07T03:29Z)
Description: value: mspack/lzxd.c in libmspack 0.5alpha, as used in ClamAV 0.99.2, allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted CHM file.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/vrtadmin/clamav-devel
Files changed:
libclamav/libmspack-0.5alpha/mspack/lzxd.c
libclamav/libmspack.c
Commit message: fixing potential OOB window write when unpacking chm files


Vulnerable code:
    sys->free(lzx->inbuf);
    sys->free(lzx->window);
	free(mem);

Fixed code:
        if (window_posn + this_run > lzx->window_size) {
                D(("match ran over window boundary"))
                return lzx->error = MSPACK_ERR_DECRUNCH;
        }

    if(lzx->inbuf)
        sys->free(lzx->inbuf);
    if(lzx->window)
        sys->free(lzx->window);
    if(mem) {
        free(mem);
        mem = NULL;
    }
    return;
CVE-2017-6420 (C, published 2017-08-07T03:29Z)
Description: value: The wwunpack function in libclamav/wwunpack.c in ClamAV 0.99.2 allows remote attackers to cause a denial of service (use-after-free) via a crafted PE file with WWPack compression.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/vrtadmin/clamav-devel
Files changed:
libclamav/wwunpack.c
Commit message: bb19798 - fix out of bound memory access for crafted wwunpack file.


Vulnerable code:

Fixed code:
    if (!CLI_ISCONTAINED(wwsect, sects[scount].rsz, wwsect+0x295, 4) ||
        !CLI_ISCONTAINED(wwsect, sects[scount].rsz, wwsect+0x295+sects[scount].rva, 4) ||
        !CLI_ISCONTAINED(wwsect, sects[scount].rsz, wwsect+0x295+sects[scount].rva+0x299, 4)) {
        cli_dbgmsg("WWPack: unpack memory address out of bounds.\n");
        return CL_EFORMAT;
    }
CVE-2013-10024 (PHP, published 2023-04-08T17:15Z)
Description: value: A vulnerability has been found in Exit Strategy Plugin 1.55 on WordPress and classified as problematic. Affected by this vulnerability is an unknown functionality of the file exitpage.php. The manipulation leads to information disclosure. The attack can be launched remotely. Upgrading to version 1.59 is able to address this issue. The identifier of the patch is d964b8e961b2634158719f3328f16eda16ce93ac. It is recommended to upgrade the affected component. The identifier VDB-225265 was assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/wp-plugins/exit-strategy
Files changed:
exitpage.php
Commit message: Security improvements, preventing XSS, full path disclosure, and unprivileged manipulation.

git-svn-id: https://plugins.svn.wordpress.org/exit-strategy/trunk@719477 b8457f37-d9ea-0310-8a92-e5e31aec5664


Vulnerable code:
 * @version 1.55
Version: 1.55

    if ($_POST['xx'])


Fixed code:
 * @version 1.59
Version: 1.59
if(!function_exists('add_action')){
    echo ""; // someone is trying to run the plugin directly, added to avoid full path disclosure.
    die;
}
    if (($_POST["xx"])&& (is_admin())&& check_admin_referer( 'exit_strategy_save', 'exit_strategy_nonce' ))
     wp_nonce_field( 'exit_strategy_save','exit_strategy_nonce' );
CVE-2013-10025 (PHP, published 2023-04-08T17:15Z)
Description: value: A vulnerability was found in Exit Strategy Plugin 1.55 on WordPress and classified as problematic. Affected by this issue is the function exitpageadmin of the file exitpage.php. The manipulation leads to cross-site request forgery. The attack may be launched remotely. Upgrading to version 1.59 is able to address this issue. The patch is identified as d964b8e961b2634158719f3328f16eda16ce93ac. It is recommended to upgrade the affected component. VDB-225266 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/wp-plugins/exit-strategy
Files changed:
exitpage.php
Commit message: Security improvements, preventing XSS, full path disclosure, and unprivileged manipulation.

git-svn-id: https://plugins.svn.wordpress.org/exit-strategy/trunk@719477 b8457f37-d9ea-0310-8a92-e5e31aec5664


Vulnerable code:
 * @version 1.55
Version: 1.55

    if ($_POST['xx'])


Fixed code:
 * @version 1.59
Version: 1.59
if(!function_exists('add_action')){
    echo ""; // someone is trying to run the plugin directly, added to avoid full path disclosure.
    die;
}
    if (($_POST["xx"])&& (is_admin())&& check_admin_referer( 'exit_strategy_save', 'exit_strategy_nonce' ))
     wp_nonce_field( 'exit_strategy_save','exit_strategy_nonce' );
CVE-2019-19242 (C, published 2019-11-27T17:15Z)
Description: value: SQLite 3.30.1 mishandles pExpr->y.pTab, as demonstrated by the TK_COLUMN case in sqlite3ExprCodeTarget in expr.c.
Severity: MEDIUM (CVSS v3 base score: 5.9)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/sqlite/sqlite
Files changed:
manifest
manifest.uuid
src/expr.c
src/wherecode.c
test/gencol1.test
Commit message: Fix a problem that comes up when using generated columns that evaluate to a
constant in an index and then making use of that index in a join.

FossilOrigin-Name: 8b12e95fec7ce6e0de82a04ca3dfcf1a8e62e233b7382aa28a8a9be6e862b1af

Vulnerable code:
C Fix\sa\srecently\sintroduced\smemory\sleak\sin\sthe\stest\scode\sin\stest_vfs.c.
D 2019-11-21T17:14:55.938
F src/expr.c a138de8ae79628a73da2597617dbeafb0f083172be81d93ffa1cafa45161ee8c
F src/wherecode.c 9b84737fd68134249a439813d27b1c61de17a01e121eb98949548d1e7f8e400a
F test/gencol1.test 82b8fc6953a6ff8560249c01f448a5fa8e8b633ec4dbdb3fc4f6632dc9ad9ea8
P 2eb997327c2c369c10b7835be80112d77cb2a7cfa9fe4d564042984c21d94698
R aec5831ff7a5bde3ac00189bc22970c2
U dan
Z 1f033777cb6b83f60ef12910c2c3cbe7
2d53a30cc23e53033af8e8666457654db5dcc453ed6cd176ce1d0bff4f528159
        int aff = sqlite3TableColumnAffinity(pExpr->y.pTab, pExpr->iColumn);

Fixed code:
C Fix\sa\sproblem\sthat\scomes\sup\swhen\susing\sgenerated\scolumns\sthat\sevaluate\sto\sa\nconstant\sin\san\sindex\sand\sthen\smaking\suse\sof\sthat\sindex\sin\sa\sjoin.
D 2019-11-21T18:28:44.463
F src/expr.c be8060167e2fcf9861b102602ca40386bf98446ef55e33e0bdee23ff88f16791
F src/wherecode.c 909325b98d5cb313f24e5c8cb304a3e3c73ca6631cdb19cfa1f580dde182fedb
F test/gencol1.test cb18ae911ed157058ea030988463bd1ec3315ba889b4aff4b8711551c393afae
P 2d53a30cc23e53033af8e8666457654db5dcc453ed6cd176ce1d0bff4f528159
R 916b27815e9b3d41c41616a867889cc0
U drh
Z 2f4253a7507c4c18153791477951e376
8b12e95fec7ce6e0de82a04ca3dfcf1a8e62e233b7382aa28a8a9be6e862b1af
        int aff;
        if( pExpr->y.pTab ){
          aff = sqlite3TableColumnAffinity(pExpr->y.pTab, pExpr->iColumn);
        }else{
          aff = pExpr->affExpr;
        }
      assert( pExpr->y.pTab!=0 );
      pExpr->affExpr = sqlite3TableColumnAffinity(pExpr->y.pTab,pExpr->iColumn);
# 2019-11-21 Problems in the new generated column logic
# reported by Yongheng Chen and Rui Zhong
do_execsql_test gencol1-9.10 {
  DROP TABLE IF EXISTS t1;
  DROP TABLE IF EXISTS t2;
  CREATE TABLE t1(aa , bb AS (17) UNIQUE);
  INSERT INTO t1 VALUES(17);
  CREATE TABLE t2(cc);
  INSERT INTO t2 VALUES(41);
  SELECT * FROM t2 JOIN t1 WHERE t1.bb=t1.aa AND t1.bb=17;
} {41 17 17}
CVE-2019-19244 (Other, published 2019-11-25T20:15Z)
Description: value: sqlite3Select in select.c in SQLite 3.30.1 allows a crash if a sub-select uses both DISTINCT and window functions, and also has certain ORDER BY usage.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/sqlite/sqlite
Files changed:
manifest
manifest.uuid
src/select.c
test/window1.test
Commit message: Fix a crash that could occur if a sub-select that uses both DISTINCT and window functions also used an ORDER BY that is the same as its select list.

FossilOrigin-Name: bcdd66c1691955c697f3d756c2b035acfe98f6aad72e90b0021bab6e9023b3ba

Vulnerable code:
C Revise\sthe\sSQLITE_OPEN_NOFOLLOW\sso\sthat\sit\sactually\suses\sO_NOFOLLOW\sin\sthe\nopen()\ssystem\scall.\s\sThis\sbacks\sout\sthe\sSQLITE_ACCESS_SYMLINK\svalue\sbut\sadds\nthe\snew\sSQLITE_OK_SYMLINK\sreturn\scode\sfrom\sthe\sxFullPathname\smethod\sof\s\nsqlite3_vfs\swhen\sthat\sroutine\sresolves\ssymbolic\slinks.\sO_NOFOLLOW\sis\salways\nincluded\sin\sopen()\ssystem\scalls\sfor\sjournal\sfiles.
D 2019-11-22T00:42:01.486
F src/select.c 50ccaf5fc3566b897fd3090b63bd60605f2f3f38ac5709fda6c482510d71aa6c
F test/window1.test e88f674b5de9d3bd2787bc1ff22e8c04c10c7e9773212f3c3c3396cb8dccb096
P ac080432b480062507452d3cdbe6c0f759e6f95b65d9862e0462017405ab2b8e
R b32992f83d3fe313532417046634561a
U drh
Z 3c868f0a98a5c208f527ca2b91cdb564
6a64fb6a2da6c98f1e87b55ad5689967e1db4eae2e08345471d95e28cd567e0f

Fixed code:
C Fix\sa\scrash\sthat\scould\soccur\sif\sa\ssub-select\sthat\suses\sboth\sDISTINCT\sand\swindow\sfunctions\salso\sused\san\sORDER\sBY\sthat\sis\sthe\ssame\sas\sits\sselect\slist.
D 2019-11-22T10:14:01.691
F src/select.c f403b7bd2304d4dfd5ad2614cc0ad3386a97af707922882bdabba4c14ce12975
F test/window1.test 60ba11fb64122c57dfd423a5f9483fb446cc27ed5cf5526152a0decdc9a761fa
P 6a64fb6a2da6c98f1e87b55ad5689967e1db4eae2e08345471d95e28cd567e0f
R 6a5d6072626d6501ea14c356f9dce16a
U dan
Z 0f63dd080b5a1fb6658b32eaaaf6aa19
bcdd66c1691955c697f3d756c2b035acfe98f6aad72e90b0021bab6e9023b3ba
   && p->pWin==0
reset_db
do_execsql_test 33.1 {
  CREATE TABLE t1(aa, bb);
  INSERT INTO t1 VALUES(1, 2);
  INSERT INTO t1 VALUES(5, 6);
  CREATE TABLE t2(x);
  INSERT INTO t2 VALUES(1);
}
do_execsql_test 33.2 {
  SELECT (SELECT DISTINCT sum(aa) OVER() FROM t1 ORDER BY 1), x FROM t2 
  ORDER BY 1;
} {6 1}
CVE-2019-19317 (Other, published 2019-12-05T14:15Z)
Description: value: lookupName in resolve.c in SQLite 3.30.1 omits bits from the colUsed bitmask in the case of a generated column, which allows attackers to cause a denial of service or possibly have unspecified other impact.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-681 \u2014 Incorrect Conversion between Numeric Types
When converting from one data type to another, such as long to integer, data can be omitted or translated in a way that produces unexpected values. If the resulting values are used in a sensitive context, then dangerous behaviors may occur.
Repository: https://github.com/sqlite/sqlite
Files changed:
manifest
manifest.uuid
Commit message: Add more test cases from Yongheng Chen and Rui Zhong.

FossilOrigin-Name: f24e6ca4f23008212ec05cace9202dbeb37ee34530ead91fac2f5e3eac7f6347

Vulnerable code:
C Fix\sa\scrash\sthat\scould\soccur\sif\sa\ssub-select\sthat\suses\sboth\sDISTINCT\sand\swindow\sfunctions\salso\sused\san\sORDER\sBY\sthat\sis\sthe\ssame\sas\sits\sselect\slist.
D 2019-11-22T10:14:01.691
F test/fuzzdata1.db 36e67e14aeb12ef15bf9bc7215694573244355be70a855b1a3d0e1009645a462
P 6a64fb6a2da6c98f1e87b55ad5689967e1db4eae2e08345471d95e28cd567e0f
R 6a5d6072626d6501ea14c356f9dce16a
U dan
Z 0f63dd080b5a1fb6658b32eaaaf6aa19
bcdd66c1691955c697f3d756c2b035acfe98f6aad72e90b0021bab6e9023b3ba

Fixed code:
C Add\smore\stest\scases\sfrom\sYongheng\sChen\sand\sRui\sZhong.
D 2019-11-22T11:38:40.010
F test/fuzzdata1.db d36e88741b4f23bcbaaf55b006290669d03c6c891cf13c7b3a53bc1b097b693f
P bcdd66c1691955c697f3d756c2b035acfe98f6aad72e90b0021bab6e9023b3ba
R f1da4824caf80eae8ce8f07b9958fc70
U drh
Z 8c3d65cb0a9bf9ef3eea1a3d78549ecc
f24e6ca4f23008212ec05cace9202dbeb37ee34530ead91fac2f5e3eac7f6347
CVE-2019-19646 (Other, published 2019-12-09T19:15Z)
Description: value: pragma.c in SQLite through 3.30.1 mishandles NOT NULL in an integrity_check PRAGMA command in certain cases of generated columns.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-754 \u2014 Improper Check for Unusual or Exceptional Conditions
The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.
Repository: https://github.com/sqlite/sqlite
Files changed:
manifest
manifest.uuid
src/pragma.c
test/gencol1.test
Commit message: Fix the NOT NULL verification logic in PRAGMA integrity_check so that it
works for generated columns whose value is the result of a comparison operator.
Ticket [bd8c280671ba44a7]

FossilOrigin-Name: f3b39c71b88cb6721f443de56cdce4c08252453a5e340b00a2bd88dc10c42400

Vulnerable code:
C Fix\sa\sgramfuzz\sfind.\s\sIf\sa\spartial\sindex\sthat\sdoes\snot\sreference\sany\scolumn\nof\sits\stable\sis\sused\sby\san\sUPDATE\sstatement\sin\sone-pass\smode,\sthen\savoid\sthe\nuse\sof\sOP_DeferredSeek\ssince\sthe\sseek\smight\snot\sbe\sresolved\sprior\sto\sthe\nOP_Delete\sand\sOP_Insert\sthat\simplement\sthe\sUPDATE.
D 2019-12-09T14:34:37.171
F src/pragma.c 36c367a62a9d3415fd3d15523e794cccc2cb74e6d806662b0185b8c686f06acb
F test/gencol1.test 037c5c26dddd984ba7ea11bd16996377f72523a4126804b1bbecafc833fccb47
P 1d2e53a39b87e364685e21de137655b6eee725e4c6d27fc90865072d7c5892b5
R 73f9d074ffb019cac59a96d55cf2c0bc
Z 9b8f81a17115c4850191512c3ac99432
e3398c5ffb060b2b26334b8598e2c63953741e2d6f5124dbd6bdfc8e94742539
          sqlite3VdbeChangeP5(v, OPFLAG_TYPEOFARG);

Fixed code:
C Fix\sthe\sNOT\sNULL\sverification\slogic\sin\sPRAGMA\sintegrity_check\sso\sthat\sit\nworks\sfor\sgenerated\scolumns\swhose\svalue\sis\sthe\sresult\sof\sa\scomparison\soperator.\nTicket\s[bd8c280671ba44a7]
D 2019-12-09T15:52:07.194
F src/pragma.c 26e9ee514138b9697d4be6d8f9ca84655053026390cf10de838862238aa4aba9
F test/gencol1.test 96d669ccb82d4140df6b38bfc110b98f94ac4cf8d32af42bae6349941b3eb92c
P e3398c5ffb060b2b26334b8598e2c63953741e2d6f5124dbd6bdfc8e94742539
R 214fd6f511022e08e69f40b8ca4a69e8
Z 7b3cdd64628ae3e72f321ced6b81d514
f3b39c71b88cb6721f443de56cdce4c08252453a5e340b00a2bd88dc10c42400
          if( sqlite3VdbeGetOp(v,-1)->opcode==OP_Column ){
            sqlite3VdbeChangeP5(v, OPFLAG_TYPEOFARG);
          }
# 2019-12-09 ticket bd8c280671ba44a7
# With generated columns, the sqlite3ExprGetColumnOfTable() routine might
# generate a code sequence that does not end with OP_Column.  So check to
# make sure that the last instruction generated is an OP_column prior to
# applying the OPFLAG_TYPEOFARG optimization to NOT NULL checks in the
# PRAGMA integrity_check code.
#
sqlite3 db :memory:
do_execsql_test gencol1-12.10 {
  CREATE TABLE t0 (c0, c1 NOT NULL AS (c0==0));
  INSERT INTO t0(c0) VALUES (0);
  PRAGMA integrity_check;
} {ok}
CVE-2019-19880 (Other, published 2019-12-18T06:15Z)
Description: value: exprListAppendList in window.c in SQLite 3.30.1 allows attackers to trigger an invalid pointer dereference because constant integer values in ORDER BY clauses of window definitions are mishandled.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/sqlite/sqlite
Files changed:
manifest
manifest.uuid
src/window.c
Commit message: When processing constant integer values in ORDER BY clauses of window
definitions (see check-in [7e4809eadfe99ebf]) be sure to fully disable
the constant value to avoid an invalid pointer dereference if the expression
is ever duplicated. This fixes a crash report from Yongheng and Rui.

FossilOrigin-Name: 1ca0bd982ab1183bbafce0d260e4dceda5eb766ed2e7793374a88d1ae0bdd2ca

Vulnerable code:
C Clean\sup\sthe\sExprList\sthat\sholds\sthe\snames\sof\scolumns\sin\sa\sCTE\sbefore\schecking\nfor\sunused\sreferences\sin\sthe\sALTER\sTABLE\simplementation.
D 2019-12-17T12:03:30.587
F src/window.c a77f12078dd4b10e655d4ba5a73ca32dbe00e0206018305185c7e86445d3f429
P 0271491438ad2a985aeff355173a8d0f1e5813954c82147bc68cb26cca5804c8
R c68dc3ba4d5d231b86e4d84e0586fee0
Z 71205fed544fdcd4f0e940dde5d4548f
8223e79f987feda5c8e51ec52cec6798cca16d070b10558939e2888ca1a25b8e

Fixed code:
C When\sprocessing\sconstant\sinteger\svalues\sin\sORDER\sBY\sclauses\sof\swindow\ndefinitions\s(see\scheck-in\s[7e4809eadfe99ebf])\sbe\ssure\sto\sfully\sdisable\nthe\sconstant\svalue\sto\savoid\san\sinvalid\spointer\sdereference\sif\sthe\sexpression\nis\sever\sduplicated.\sThis\sfixes\sa\scrash\sreport\sfrom\sYongheng\sand\sRui.
D 2019-12-18T00:05:50.510
F src/window.c 913a10696f5197adae32738a7c7cabc03e1f1553240d6c9ce868ee57f5cee88e
P 8223e79f987feda5c8e51ec52cec6798cca16d070b10558939e2888ca1a25b8e
R b2173cceb9c7cb44c37df84c9f42b08c
Z 156cc4a0e438e4b57215f0738876dab1
1ca0bd982ab1183bbafce0d260e4dceda5eb766ed2e7793374a88d1ae0bdd2ca
      assert( pDup==0 || !ExprHasProperty(pDup, EP_MemToken) );
        pDup->u.zToken = 0;