CVE-2019-19317 (Other, published 2019-12-05T14:15Z)
Description: value: lookupName in resolve.c in SQLite 3.30.1 omits bits from the colUsed bitmask in the case of a generated column, which allows attackers to cause a denial of service or possibly have unspecified other impact.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-681 \u2014 Incorrect Conversion between Numeric Types
When converting from one data type to another, such as long to integer, data can be omitted or translated in a way that produces unexpected values. If the resulting values are used in a sensitive context, then dangerous behaviors may occur.
Repository: https://github.com/sqlite/sqlite
Files changed:
manifest
manifest.uuid
src/resolve.c
test/gencol1.test
Commit message: Whenever a generated column is used, assume that all columns are used.

FossilOrigin-Name: 6601da58032d18ae00b466c0f2077fb2b1ecd84225b56e1787724bea478eedc9

Vulnerable code:
C Fix\sa\sproblem\sthat\scomes\sup\swhen\susing\sgenerated\scolumns\sthat\sevaluate\sto\sa\nconstant\sin\san\sindex\sand\sthen\smaking\suse\sof\sthat\sindex\sin\sa\sjoin.
D 2019-11-21T18:28:44.463
F src/resolve.c cf2391c93d425455388389e7a47674b9da107d2ed69ebf49979044d70dbeb045
F test/gencol1.test cb18ae911ed157058ea030988463bd1ec3315ba889b4aff4b8711551c393afae
P 2d53a30cc23e53033af8e8666457654db5dcc453ed6cd176ce1d0bff4f528159
R 916b27815e9b3d41c41616a867889cc0
Z 2f4253a7507c4c18153791477951e376
8b12e95fec7ce6e0de82a04ca3dfcf1a8e62e233b7382aa28a8a9be6e862b1af
  ** bit 0 to be set.  Column 1 sets bit 1.  And so forth.  If the
  ** column number is greater than the number of bits in the bitmask
  ** then set the high-order bit of the bitmask.
  DROP TABLE IF EXISTS t1;
  DROP TABLE IF EXISTS t2;


Fixed code:
C Whenever\sa\sgenerated\scolumn\sis\sused,\sassume\sthat\sall\scolumns\sare\sused.
D 2019-11-21T19:37:00.986
F src/resolve.c 023397b50d09a3587a15169b713342e2d595ab29e14e54fd8f4a86b76c461d21
F test/gencol1.test 6bdf7fbaa001321d01f35f7c33ccb847cf937b760877b9a32723e009983c13f7
P 8b12e95fec7ce6e0de82a04ca3dfcf1a8e62e233b7382aa28a8a9be6e862b1af
R e99d34ba61fb6b297b18cc8c33e9b417
Z 29f405b4db68236e1fc771220e887d13
6601da58032d18ae00b466c0f2077fb2b1ecd84225b56e1787724bea478eedc9
  ** bit 0 to be set.  Column 1 sets bit 1.  And so forth.
  **
  ** The colUsed mask is an optimization used to help determine if an
  ** index is a covering index.  The correct answer is still obtained
  ** if the mask contains extra bits.  But omitting bits from the mask
  ** might result in an incorrect answer.
  **
  ** The high-order bit of the mask is a "we-use-them-all" bit.
  ** If the column number is greater than the number of bits in the bitmask
  ** then set the high-order bit of the bitmask.  Also set the high-order
  ** bit if the column is a generated column, as that adds dependencies
  ** that are difficult to track, so we assume that all columns are used.
    assert( pExpr->y.pTab!=0 );
    if( pExpr->y.pTab->tabFlags & TF_HasGenerated ){
      Column *pCol = pExpr->y.pTab->aCol + pExpr->iColumn;
      if( pCol->colFlags & COLFLAG_GENERATED ) n = BMS-1;
    }
  DROP TABLE t1;
do_execsql_test gencol1-9.20 {
  CREATE TABLE t3(aa INT PRIMARY KEY, bb UNIQUE AS(aa));
  INSERT INTO t3 VALUES(1);
  SELECT 100, * FROM t3;
  DELETE FROM t3 WHERE (SELECT bb FROM t3);
  SELECT 200, * FROM t3;
} {100 1 1}