CVE-2019-19959 (published 2020-01-03T22:15Z)

ext/misc/zipfile.c in SQLite 3.30.1 mishandles certain uses of INSERT INTO in situations involving embedded '\\0' characters in filenames, leading to a memory-management error that can be detected by (for example) valgrind.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:P/A:N)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)

Weakness information:
cwe_id: NVD-CWE-Other
cwe_name: Other
description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/sqlite/sqlite
commit_details: repo_url: https://github.com/sqlite/sqlite
author: drh
author_date: 2019-12-23 21:11:15+00:00
msg: Test case for the zipfile-extension bug fix of the previous check-in.

FossilOrigin-Name: bc8bfc7fcdf33f6855584e10e9260073430517ff3268cf0c7988dcc4cd785391
repository: repo_url: https://github.com/sqlite/sqlite
repo_name: sqlite/sqlite
description: Official Git mirror of the SQLite source tree
repo_language: C
owner: sqlite
file_changes: filename: manifest
change_type: ModificationType.MODIFY
diff: @@ -1,5 +1,5 @@
-C Fix\sthe\szipfile()\sfunction\sin\sthe\szipfile\sextension\sso\sthat\sit\sis\sable\sto\ndeal\swith\sgoofy\sfilenames\sthat\scontain\sembedded\szeros.
-D 2019-12-23T21:04:33.977
+C Test\scase\sfor\sthe\szipfile-extension\sbug\sfix\sof\sthe\sprevious\scheck-in.
+D 2019-12-23T21:11:15.463
 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
 F LICENSE.md df5091916dbb40e6e9686186587125e1b2ff51f022cc334e886c19a0e9982724
@@ -1748,7 +1748,7 @@ F test/wordcount.c d721a4b6fae93e6e33449700bce1686bc23257c27425bc3ef1599dc912ade
 F test/writecrash.test f1da7f7adfe8d7f09ea79b42e5ca6dcc41102f27f8e334ad71539501ddd910cc
 F test/zeroblob.test 07a5b11ab591d1f26c626945fb7f228f68b993533b2ada77273edf6ee29db174
 F test/zerodamage.test 9c41628db7e8d9e8a0181e59ea5f189df311a9f6ce99cc376dc461f66db6f8dc
-F test/zipfile.test daab4c9be151934fd6bbc71a0d2520351efc61719eabbf545920f953883d172a
+F test/zipfile.test 330bec11cee9da4da1a48e648b6d445b9334044089da62e9521803566a36dde2
 F test/zipfile2.test 9903388a602a3834189857a985106ff95c3bba6a3969e0134127df991889db5d
 F test/zipfilefault.test 44d4d7a7f7cca7521d569d7f71026b241d65a6b1757aa409c1a168827edbbc2c
 F tool/GetFile.cs 47852aa0d806fe47ed1ac5138bdce7f000fe87aaa7f28107d0cb1e26682aeb44
@@ -1852,7 +1852,7 @@ F vsixtest/vsixtest.tcl 6a9a6ab600c25a91a7acc6293828957a386a8a93
 F vsixtest/vsixtest.vcxproj.data 2ed517e100c66dc455b492e1a33350c1b20fbcdc
 F vsixtest/vsixtest.vcxproj.filters 37e51ffedcdb064aad6ff33b6148725226cd608e
 F vsixtest/vsixtest_TemporaryKey.pfx e5b1b036facdb453873e7084e1cae9102ccc67a0
-P 4c50afafce8416369f89477ba7fe7d9b047399a5ee5754c73d0e67bbea8d877c
-R 29d7c3cbcd5652a73d3305fec9c54b58
+P cc0fb00a128fd0773db5ff7891f7aa577a3671d570166d2cbb30df922344adcf
+R 01755885676b946174adbb226548e4c0
 U drh
-Z b32fa973d6865a272376759a8cfda3e5
+Z 9cbb5c3517ed7c9d1c8f71b1fd10d978

programming_language: Jupyter Notebook
filename: manifest.uuid
change_type: ModificationType.MODIFY
diff: @@ -1 +1 @@
-cc0fb00a128fd0773db5ff7891f7aa577a3671d570166d2cbb30df922344adcf
\ No newline at end of file
+bc8bfc7fcdf33f6855584e10e9260073430517ff3268cf0c7988dcc4cd785391
\ No newline at end of file

programming_language: SQL
filename: zipfile.test
change_type: ModificationType.MODIFY
diff: @@ -808,5 +808,17 @@ do_execsql_test 13.10 {
          quote(data),quote(method) FROM t1;
 } {'' 10 10 2 X'3130' X'3130' 0}
 
+# 2019-12-23 Yongheng and Rui fuzzer
+# Run using valgrind to see the problem.
+#
+do_execsql_test 14.10 {
+  DROP TABLE t1;
+  CREATE TABLE t1(x char);
+  INSERT INTO t1(x) VALUES('1');
+  INSERT INTO t1(x) SELECT zipfile(x, 'xyz') FROM t1;
+  INSERT INTO t1(x) SELECT zipfile(x, 'uvw') FROM t1;
+  SELECT count(*) FROM t1;
+  PRAGMA integrity_check;
+} {3 ok}
 
 finish_test

programming_language: Perl
repo_url: https://github.com/sqlite/sqlite
commit_details: repo_url: https://github.com/sqlite/sqlite
author: drh
author_date: 2019-12-23 21:04:33+00:00
msg: Fix the zipfile() function in the zipfile extension so that it is able to
deal with goofy filenames that contain embedded zeros.

FossilOrigin-Name: cc0fb00a128fd0773db5ff7891f7aa577a3671d570166d2cbb30df922344adcf
repository: repo_url: https://github.com/sqlite/sqlite
repo_name: sqlite/sqlite
description: Official Git mirror of the SQLite source tree
repo_language: C
owner: sqlite
file_changes: filename: zipfile.c
change_type: ModificationType.MODIFY
diff: @@ -1632,7 +1632,7 @@ static int zipfileUpdate(
         zFree = sqlite3_mprintf("%s/", zPath);
         if( zFree==0 ){ rc = SQLITE_NOMEM; }
         zPath = (const char*)zFree;
-        nPath++;
+        nPath = (int)strlen(zPath);
       }
     }
 
@@ -2033,11 +2033,11 @@ void zipfileStep(sqlite3_context *pCtx, int nVal, sqlite3_value **apVal){
   }else{
     if( zName[nName-1]!='/' ){
       zName = zFree = sqlite3_mprintf("%s/", zName);
-      nName++;
       if( zName==0 ){
         rc = SQLITE_NOMEM;
         goto zipfile_step_out;
       }
+      nName = (int)strlen(zName);
     }else{
       while( nName>1 && zName[nName-2]=='/' ) nName--;
     }

programming_language: C
filename: manifest
change_type: ModificationType.MODIFY
diff: @@ -1,5 +1,5 @@
-C Thoroughly\sreset\sthe\srtree\scursor\sat\sthe\sstart\sof\seach\sVFilter\soperation,\nincluding\sclearing\sits\scache.\s\sThis\sprevents\sleft\sover\spages\sin\sthe\scache\nwhich\scan\scause\sproblems\son\sshutdown\safter\sa\sLEFT\sJOIN.\nTicket\s[5eadca17c4dde90c]
-D 2019-12-23T20:41:39.904
+C Fix\sthe\szipfile()\sfunction\sin\sthe\szipfile\sextension\sso\sthat\sit\sis\sable\sto\ndeal\swith\sgoofy\sfilenames\sthat\scontain\sembedded\szeros.
+D 2019-12-23T21:04:33.977
 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
 F LICENSE.md df5091916dbb40e6e9686186587125e1b2ff51f022cc334e886c19a0e9982724
@@ -324,7 +324,7 @@ F ext/misc/vfsstat.c 77b5b4235c9f7f11eddf82487c0a422944ac2f132dafd5af3be7a68a057
 F ext/misc/vtablog.c 5538acd0c8ddaae372331bee11608d76973436b77d6a91e8635cfc9432fba5ae
 F ext/misc/vtshim.c 1976e6dd68dd0d64508c91a6dfab8e75f8aaf6cd
 F ext/misc/wholenumber.c 784b12543d60702ebdd47da936e278aa03076212
-F ext/misc/zipfile.c dfec5589395fc2272a646fc309935ecb5164934a95757762afa120b72d1d0ba4
+F ext/misc/zipfile.c 46b8022d5c4f118995c3e7228542215204dacc9c1c4e9872710900ec276d6db3
 F ext/misc/zorder.c b0ff58fa643afa1d846786d51ea8d5c4b6b35aa0254ab5a82617db92f3adda64
 F ext/rbu/rbu.c 8681f6157db6adc82c34af24b14ea8a3be0146ad2a3b6c1d5da6cb8a5796c8ce
 F ext/rbu/rbu1.test 221d9c18a5e600ac9ac6b1810d99d9f99163a7909ba61597876ab6e4d4beb3d6
@@ -1852,7 +1852,7 @@ F vsixtest/vsixtest.tcl 6a9a6ab600c25a91a7acc6293828957a386a8a93
 F vsixtest/vsixtest.vcxproj.data 2ed517e100c66dc455b492e1a33350c1b20fbcdc
 F vsixtest/vsixtest.vcxproj.filters 37e51ffedcdb064aad6ff33b6148725226cd608e
 F vsixtest/vsixtest_TemporaryKey.pfx e5b1b036facdb453873e7084e1cae9102ccc67a0
-P 953e6aa6d9ca09e549c88bc728c322fabdcef581f3b4a7763d95488dddbbd6a5
-R ca340be656fb975dcd1521355f675df7
+P 4c50afafce8416369f89477ba7fe7d9b047399a5ee5754c73d0e67bbea8d877c
+R 29d7c3cbcd5652a73d3305fec9c54b58
 U drh
-Z 22698fecf79ba95f8e537178f371e71c
+Z b32fa973d6865a272376759a8cfda3e5

programming_language: Jupyter Notebook
filename: manifest.uuid
change_type: ModificationType.MODIFY
diff: @@ -1 +1 @@
-4c50afafce8416369f89477ba7fe7d9b047399a5ee5754c73d0e67bbea8d877c
\ No newline at end of file
+cc0fb00a128fd0773db5ff7891f7aa577a3671d570166d2cbb30df922344adcf
\ No newline at end of file

programming_language: SQL