CVE-2019-19926 (published 2019-12-23T01:15Z)

multiSelect in select.c in SQLite 3.30.1 mishandles certain errors during parsing, as demonstrated by errors from sqlite3WindowRewrite() calls. NOTE: this vulnerability exists because of an incomplete fix for CVE-2019-19880.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/sqlite/sqlite
commit_details: repo_url: https://github.com/sqlite/sqlite
author: drh
author_date: 2019-12-19 22:08:19+00:00
msg: Continuation of [e2bddcd4c55ba3cb]: Add another spot where it is necessary
to abort early due to prior errors in sqlite3WindowRewrite().

FossilOrigin-Name: cba2a2a44cdf138a629109bb0ad088ed4ef67fc66bed3e0373554681a39615d2
repository: repo_url: https://github.com/sqlite/sqlite
repo_name: sqlite/sqlite
description: Official Git mirror of the SQLite source tree
repo_language: C
owner: sqlite
file_changes: filename: manifest
change_type: ModificationType.MODIFY
diff: @@ -1,5 +1,5 @@
-C Fix\sthe\sregexp\sextension\sso\sthat\sit\scorrectly\stranslates\sall\sover-length\n3-byte\sUTF8\ssequences\sinto\s0xfffd.
-D 2019-12-19T21:11:48.622
+C Continuation\sof\s[e2bddcd4c55ba3cb]:\sAdd\sanother\sspot\swhere\sit\sis\snecessary\nto\sabort\searly\sdue\sto\sprior\serrors\sin\ssqlite3WindowRewrite().
+D 2019-12-19T22:08:19.301
 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
 F LICENSE.md df5091916dbb40e6e9686186587125e1b2ff51f022cc334e886c19a0e9982724
@@ -527,7 +527,7 @@ F src/printf.c 9be6945837c839ba57837b4bc3af349eba630920fa5532aa518816defe42a7d4
 F src/random.c 80f5d666f23feb3e6665a6ce04c7197212a88384
 F src/resolve.c 86a7773d2892227ba9ad1721c41bb03c501830f1bf6de5f78dd0062b82e10c9d
 F src/rowset.c d977b011993aaea002cab3e0bb2ce50cf346000dff94e944d547b989f4b1fe93
-F src/select.c dd7e40967760b28efe274ade35043d5bf5d72774208bb75d2cb4dd59cbd59ad1
+F src/select.c b895d809b93596c828c4cd79f4da96d48bf1969414877bb4313770000ea736cc
 F src/shell.c.in 4a3a9e1c11847b1904f2b01d087af1c052f660902755abab457cab1756817ded
 F src/sqlite.h.in 2a23e8161775253d9cf383c2c6aa559005dc787d350dcb0be67a6c4cc3bd1d19
 F src/sqlite3.rc 5121c9e10c3964d5755191c80dd1180c122fc3a8
@@ -1852,7 +1852,7 @@ F vsixtest/vsixtest.tcl 6a9a6ab600c25a91a7acc6293828957a386a8a93
 F vsixtest/vsixtest.vcxproj.data 2ed517e100c66dc455b492e1a33350c1b20fbcdc
 F vsixtest/vsixtest.vcxproj.filters 37e51ffedcdb064aad6ff33b6148725226cd608e
 F vsixtest/vsixtest_TemporaryKey.pfx e5b1b036facdb453873e7084e1cae9102ccc67a0
-P e2bddcd4c55ba3cbe0130332679ff4b048630d0ced9a8899982edb5a3569ba7f
-R af9053af10312d4307bee0a49d732fcd
+P 3d4c0bf8904135fa68c75801bfa738715cacc3b19dc8ad6ef550b11798d4b121
+R 5ae11b0f596e58f50666a1f36d76218a
 U drh
-Z 117f0e64b781f6b402ee8f8a6b6c39a1
+Z a0201de5777363689738ee935bfc3b28

programming_language: Jupyter Notebook
filename: manifest.uuid
change_type: ModificationType.MODIFY
diff: @@ -1 +1 @@
-3d4c0bf8904135fa68c75801bfa738715cacc3b19dc8ad6ef550b11798d4b121
\ No newline at end of file
+cba2a2a44cdf138a629109bb0ad088ed4ef67fc66bed3e0373554681a39615d2
\ No newline at end of file

programming_language: SQL
filename: select.c
change_type: ModificationType.MODIFY
diff: @@ -2809,6 +2809,7 @@ static int multiSelect(
     }
   #endif
   }
+  if( pParse->nErr ) goto multi_select_end;
   
   /* Compute collating sequences used by 
   ** temporary tables needed to implement the compound select.

programming_language: C