CVE-2019-19645 (C, published 2019-12-09T16:15Z)
Description: value: alter.c in SQLite through 3.30.1 allows attackers to trigger infinite recursion via certain types of self-referential views in conjunction with ALTER TABLE statements.
Severity: LOW (CVSS v3 base score: 5.5)
Weakness: CWE-674 \u2014 Uncontrolled Recursion
The product does not properly control the amount of recursion that takes place,  consuming excessive resources, such as allocated memory or the program stack.
Repository: https://github.com/sqlite/sqlite
Files changed:
manifest
manifest.uuid
src/alter.c
src/build.c
src/sqliteInt.h
test/altertab3.test
Commit message: Avoid infinite recursion in the ALTER TABLE code when a view contains an unused CTE that references, directly or indirectly, the view itself.

FossilOrigin-Name: 1d2e53a39b87e364685e21de137655b6eee725e4c6d27fc90865072d7c5892b5

Vulnerable code:
C Fix\spossible\snull\spointer\sdereferences\sin\sthe\sfts5_expr()\sscalar\sfunction.
D 2019-12-09T02:20:37.957
F src/alter.c c49548d04914d370864c88ed4b5e3e3b112779ba70562ebd3f191b39be151536
F src/build.c ed6cc3e7e209d92b0ed2fa780c95b1a3aa7ecdd46a97671cfcca95079789bcc9
F src/sqliteInt.h daef6c0ec05fdb3dd8ed1b2da6fa2fdce98917dc463a6a65b001f3be5e24ce4c
F test/altertab3.test 18111c210a4992abe90247e4a83c6f6e901537288c42879d12680088612d0fa2
P 9d75e1ccc72e9f536f45df3b24e9ecd25076cc1f7cf16b806b19e0e1b68e8326
R 0a0e9aa93d1e91dec7ab207a55b0f9a7
Z 52b4f37e443381d36a712c3afffc572f
c5d44143599f3fe98492b2b900fa3d77925c7be545096251055ceeab899a41f1
      sqlite3SelectPrep(&sParse, sParse.pNewTable->pSelect, 0);

Fixed code:
C Avoid\sinfinite\srecursion\sin\sthe\sALTER\sTABLE\scode\swhen\sa\sview\scontains\san\sunused\sCTE\sthat\sreferences,\sdirectly\sor\sindirectly,\sthe\sview\sitself.
D 2019-12-09T08:13:43.318
F src/alter.c ef3519bcc3da6e1d8c0bda63233fb315c99f08e8cd74fe3afb9eeaa2b424bfd4
F src/build.c 7c277ccc24c249b84f29ba829b0ed377e78487c93d17d999798641be0c20fad5
F src/sqliteInt.h 1ac4dfde728b9d5812d1223d668d5e1f43c6fe4f469d6a7a482f298a10a03210
F test/altertab3.test 3faf56b3f5af0dd2c12d954db4746521fc96543222da5b6e2633ed417640ce83
P c5d44143599f3fe98492b2b900fa3d77925c7be545096251055ceeab899a41f1
R 22fd1a654a96a45bd7c185276aceb3b2
Z 7090efa7effe7e9fcfeaeecdf4e29b8c
1d2e53a39b87e364685e21de137655b6eee725e4c6d27fc90865072d7c5892b5
  if( p->selFlags & SF_View ) return WRC_Prune;
  if( p->selFlags & SF_View ) return WRC_Prune;
      pSelect->selFlags &= ~SF_View;
      sqlite3SelectPrep(&sParse, pSelect, 0);
  if( pSelect->selFlags & SF_View ) return WRC_Prune;
            Select *pSelect = pTab->pSelect;
            assert( pSelect->selFlags & SF_View );
            pSelect->selFlags &= ~SF_View;
  pSelect->selFlags |= SF_View;
#define SF_View          0x0200000 /* SELECT statement is a view */
#------------------------------------------------------------------------
#
reset_db
do_execsql_test 22.1 {
  CREATE TABLE t1(a);
  CREATE VIEW v2(b) AS SELECT * FROM v2;
}

do_catchsql_test 22.2 {
  ALTER TABLE t1 RENAME TO t4;
} {1 {error in view v2: view v2 is circularly defined}}

do_execsql_test 22.3 {
  DROP VIEW v2;
  CREATE VIEW v2(b) AS WITH t3 AS (SELECT b FROM v2) SELECT * FROM t3;
}

breakpoint
do_catchsql_test 22.4 {
  ALTER TABLE t1 RENAME TO t4;
} {1 {error in view v2: view v2 is circularly defined}}

do_execsql_test 22.5 {
  DROP VIEW v2;
  CREATE VIEW v2(b) AS WITH t3 AS (SELECT b FROM v2) VALUES(1);
}

do_catchsql_test 22.6 {
  ALTER TABLE t1 RENAME TO t4;
} {0 {}}