CVE-2019-19603 (Other, published 2019-12-09T19:15Z)
Description: value: SQLite 3.30.1 mishandles certain SELECT statements with a nonexistent VIEW, leading to an application crash.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/sqlite/sqlite
Files changed:
manifest
manifest.uuid
src/build.c
src/sqliteInt.h
test/altertab.test
Commit message: Do not allow CREATE TABLE or CREATE VIEW of an object with a name that looks
like a shadow table name.

FossilOrigin-Name: 6aef58b629d89955f85f65191ba2be67b2adfac4f0327fe9a7141cb2705dbc00

Vulnerable code:
C Break\sout\sthe\stest\sfor\swritable\sshadow\stables\sinto\sa\sseparate\ssubroutine.
D 2019-11-16T13:51:31.727
F src/build.c 0001fed71cad92f94b3ed3ca38007de9cf61e1d48b209ba22feaeb606bbe6de1
F src/sqliteInt.h 7bce951adf6bc8015accda3c204bc8da8127f7c8fa9e8684a9fcbf25e941206d
F test/altertab.test 8069e5a8cbd3cb35732d3ec680dcc5273c2587ebd8e6a5d51084fa8059e468e5
P 70390bbca49e706649ca5b7c031f0baf416fc38798c17e5f3b73746b3e66e3b5
R eb1e2d60d183f45db7dd5d6f1b4dd659
T *branch * defensive-improvements
T *sym-defensive-improvements *
T -sym-trunk *
Z 25e7114e721d6c257eca936cdc80fddc
8ad34d36a141fa8f5d9bd784dfeb892c983897a6dc6b867607cc668508acf944
    if( pParse->nested==0 
     && 0==sqlite3StrNICmp(zName, "sqlite_", 7)
static int isShadowTableName(sqlite3 *db, char *zName){
#else
# define isShadowTableName(x,y) 0
  if( pSelect==0 && isShadowTableName(db, p->zName) ){
    ALTER TABLE y1_segments RENAME TO abc;
  } {1 {table y1_segments may not be altered}}

  do_catchsql_test 16.21 {

Fixed code:
C Do\snot\sallow\sCREATE\sTABLE\sor\sCREATE\sVIEW\sof\san\sobject\swith\sa\sname\sthat\slooks\nlike\sa\sshadow\stable\sname.
D 2019-11-16T14:15:19.202
F src/build.c fe0b0b6dfab27a6f5778bd3dba8db879fda114c1d524a9597e5195ac55c8d01b
F src/sqliteInt.h 98bc9562acfc361e34182aa25b00e2c73095732ddd3ba4158f984b94f5601f96
F test/altertab.test 4d8b79b0b88b62b90b710390df14fe99e0a3578345526886eaa550e28e3065dc
P 8ad34d36a141fa8f5d9bd784dfeb892c983897a6dc6b867607cc668508acf944
R eb081275a7e8dd518362d4efeb289e7e
Z 5fd6ba2bd9359116ce6160036d7c9b86
6aef58b629d89955f85f65191ba2be67b2adfac4f0327fe9a7141cb2705dbc00
    if( (pParse->nested==0 && 0==sqlite3StrNICmp(zName, "sqlite_", 7))
     || (sqlite3ReadOnlyShadowTables(db) && sqlite3ShadowTableName(db, zName))

int sqlite3ShadowTableName(sqlite3 *db, const char *zName){
  if( pSelect==0 && sqlite3ShadowTableName(db, p->zName) ){
#ifndef SQLITE_OMIT_VIRTUALTABLE
  int sqlite3ShadowTableName(sqlite3 *db, const char *zName);
#else
# define sqlite3ShadowTableName(A,B) 0
#endif
  do_catchsql_test 16.20 {
    ALTER TABLE y1_segments RENAME TO abc;
  } {1 {table y1_segments may not be altered}}
  sqlite3_db_config db DEFENSIVE 0
  do_catchsql_test 16.22 {
    ALTER TABLE y1_segments RENAME TO abc;
  } {0 {}}
  sqlite3_db_config db DEFENSIVE 1
  do_catchsql_test 16.23 {
    CREATE TABLE y1_segments AS SELECT * FROM abc;
  } {1 {object name reserved for internal use: y1_segments}}
  do_catchsql_test 16.24 {
    CREATE VIEW y1_segments AS SELECT * FROM abc;
  } {1 {object name reserved for internal use: y1_segments}}
  sqlite3_db_config db DEFENSIVE 0
  do_catchsql_test 16.25 {
    ALTER TABLE abc RENAME TO y1_segments;
  } {0 {}}
  sqlite3_db_config db DEFENSIVE 1