CVE-2019-19646 (Other, published 2019-12-09T19:15Z)
Description: value: pragma.c in SQLite through 3.30.1 mishandles NOT NULL in an integrity_check PRAGMA command in certain cases of generated columns.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-754 \u2014 Improper Check for Unusual or Exceptional Conditions
The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.
Repository: https://github.com/sqlite/sqlite
Files changed:
manifest
manifest.uuid
src/resolve.c
test/gencol1.test
Commit message: Ensure that the SrcList_item.colUsed field is set correctly (set to have a
1 for all columns of the table) when a generated column appears in the USING
clause of a join.

FossilOrigin-Name: 1923efb283e8840fa7436eb20b9d2174ef7cace1690d3b97b572a0db2048b8e3

Vulnerable code:
C Fix\sthe\sNOT\sNULL\sverification\slogic\sin\sPRAGMA\sintegrity_check\sso\sthat\sit\nworks\sfor\sgenerated\scolumns\swhose\svalue\sis\sthe\sresult\sof\sa\scomparison\soperator.\nTicket\s[bd8c280671ba44a7]
D 2019-12-09T15:52:07.194
F src/resolve.c 618bf4f57fa0617cd5295117fea5f25955b76d278303405a8551c4204593011e
F test/gencol1.test 96d669ccb82d4140df6b38bfc110b98f94ac4cf8d32af42bae6349941b3eb92c
P e3398c5ffb060b2b26334b8598e2c63953741e2d6f5124dbd6bdfc8e94742539
R 214fd6f511022e08e69f40b8ca4a69e8
Z 7b3cdd64628ae3e72f321ced6b81d514
f3b39c71b88cb6721f443de56cdce4c08252453a5e340b00a2bd88dc10c42400
    p->y.pTab = pItem->pTab;
      testcase( iCol==BMS );
      testcase( iCol==BMS-1 );
      pItem->colUsed |= ((Bitmask)1)<<(iCol>=BMS ? BMS-1 : iCol);

Fixed code:
C Ensure\sthat\sthe\sSrcList_item.colUsed\sfield\sis\sset\scorrectly\s(set\sto\shave\sa\n1\sfor\sall\scolumns\sof\sthe\stable)\swhen\sa\sgenerated\scolumn\sappears\sin\sthe\sUSING\nclause\sof\sa\sjoin.
D 2019-12-09T17:14:48.320
F src/resolve.c 32b5adb26c21be0dcf7d639053f10f1a34a0a4ae10f59dd9c5b71f8d1579e76b
F test/gencol1.test 891f9ac3a3acf27902767020b8667ba6168306f3f226e5c036c442caffd06dd7
P f3b39c71b88cb6721f443de56cdce4c08252453a5e340b00a2bd88dc10c42400
R 4c75b826224c9334b1247cab793c4dea
Z 46d53a02a606d9b97d8ca0a567728aa1
1923efb283e8840fa7436eb20b9d2174ef7cace1690d3b97b572a0db2048b8e3
    Table *pTab = p->y.pTab = pItem->pTab;
      if( pTab->tabFlags & TF_HasGenerated ){
        Column *pColumn = pTab->aCol + iCol;
        if( pColumn->colFlags & COLFLAG_GENERATED ){
          testcase( pTab->nCol==63 );
          testcase( pTab->nCol==64 );
          if( pTab->nCol>=64 ){
            pItem->colUsed = ALLBITS;
          }else{
            pItem->colUsed = MASKBIT(pTab->nCol)-1;
          }
        }
      }else{
        testcase( iCol==BMS );
        testcase( iCol==BMS-1 );
        pItem->colUsed |= ((Bitmask)1)<<(iCol>=BMS ? BMS-1 : iCol);
      }
# 2019-12-09 but report from Yongheng Chen
# Ensure that the SrcList_item.colUsed field is set correctly when a
# generated column appears in the USING clause of a join.
#
do_execsql_test gencol1-13.10 {
  CREATE TABLE t1(x, y AS(x+1));
  INSERT INTO t1 VALUES(10);
  SELECT y FROM t1 JOIN t1 USING (y,y);
} {11}
do_execsql_test gencol1-13.11 {
  CREATE INDEX t1y ON t1(y);
  SELECT y FROM t1 JOIN t1 USING (y,y);
} {11}