CVE-2019-19317 (published 2019-12-05T14:15Z)

lookupName in resolve.c in SQLite 3.30.1 omits bits from the colUsed bitmask in the case of a generated column, which allows attackers to cause a denial of service or possibly have unspecified other impact.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-681
cwe_name: Incorrect Conversion between Numeric Types
description: When converting from one data type to another, such as long to integer, data can be omitted or translated in a way that produces unexpected values. If the resulting values are used in a sensitive context, then dangerous behaviors may occur.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/sqlite/sqlite
commit_details: repo_url: https://github.com/sqlite/sqlite
author: drh
author_date: 2019-11-21 19:37:00+00:00
msg: Whenever a generated column is used, assume that all columns are used.

FossilOrigin-Name: 6601da58032d18ae00b466c0f2077fb2b1ecd84225b56e1787724bea478eedc9
repository: repo_url: https://github.com/sqlite/sqlite
repo_name: sqlite/sqlite
description: Official Git mirror of the SQLite source tree
repo_language: C
owner: sqlite
file_changes: filename: manifest
change_type: ModificationType.MODIFY
diff: @@ -1,5 +1,5 @@
-C Fix\sa\sproblem\sthat\scomes\sup\swhen\susing\sgenerated\scolumns\sthat\sevaluate\sto\sa\nconstant\sin\san\sindex\sand\sthen\smaking\suse\sof\sthat\sindex\sin\sa\sjoin.
-D 2019-11-21T18:28:44.463
+C Whenever\sa\sgenerated\scolumn\sis\sused,\sassume\sthat\sall\scolumns\sare\sused.
+D 2019-11-21T19:37:00.986
 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
 F LICENSE.md df5091916dbb40e6e9686186587125e1b2ff51f022cc334e886c19a0e9982724
@@ -524,7 +524,7 @@ F src/pragma.h ec3b31eac9b1df040f1cc8cb3d89bc06605c3b4cb3d76f833de8d6d6c3f77f04
 F src/prepare.c 6049beb71385f017af6fc320d2c75a4e50b75e280c54232442b785fbb83df057
 F src/printf.c 9be6945837c839ba57837b4bc3af349eba630920fa5532aa518816defe42a7d4
 F src/random.c 80f5d666f23feb3e6665a6ce04c7197212a88384
-F src/resolve.c cf2391c93d425455388389e7a47674b9da107d2ed69ebf49979044d70dbeb045
+F src/resolve.c 023397b50d09a3587a15169b713342e2d595ab29e14e54fd8f4a86b76c461d21
 F src/rowset.c d977b011993aaea002cab3e0bb2ce50cf346000dff94e944d547b989f4b1fe93
 F src/select.c 50ccaf5fc3566b897fd3090b63bd60605f2f3f38ac5709fda6c482510d71aa6c
 F src/shell.c.in 4a3a9e1c11847b1904f2b01d087af1c052f660902755abab457cab1756817ded
@@ -1021,7 +1021,7 @@ F test/fuzzer1.test 3d4c4b7e547aba5e5511a2991e3e3d07166cfbb8
 F test/fuzzer2.test a85ef814ce071293bce1ad8dffa217cbbaad4c14
 F test/fuzzerfault.test 8792cd77fd5bce765b05d0c8e01b9edcf8af8536
 F test/gcfault.test dd28c228a38976d6336a3fc42d7e5f1ad060cb8c
-F test/gencol1.test cb18ae911ed157058ea030988463bd1ec3315ba889b4aff4b8711551c393afae
+F test/gencol1.test 6bdf7fbaa001321d01f35f7c33ccb847cf937b760877b9a32723e009983c13f7
 F test/genesis.tcl 1e2e2e8e5cc4058549a154ff1892fe5c9de19f98
 F test/having.test e4098a4b8962f9596035c3b87a8928a10648acc509f1bb8d6f96413bbf79a1b3
 F test/hexlit.test 4a6a5f46e3c65c4bf1fa06f5dd5a9507a5627751
@@ -1850,7 +1850,7 @@ F vsixtest/vsixtest.tcl 6a9a6ab600c25a91a7acc6293828957a386a8a93
 F vsixtest/vsixtest.vcxproj.data 2ed517e100c66dc455b492e1a33350c1b20fbcdc
 F vsixtest/vsixtest.vcxproj.filters 37e51ffedcdb064aad6ff33b6148725226cd608e
 F vsixtest/vsixtest_TemporaryKey.pfx e5b1b036facdb453873e7084e1cae9102ccc67a0
-P 2d53a30cc23e53033af8e8666457654db5dcc453ed6cd176ce1d0bff4f528159
-R 916b27815e9b3d41c41616a867889cc0
+P 8b12e95fec7ce6e0de82a04ca3dfcf1a8e62e233b7382aa28a8a9be6e862b1af
+R e99d34ba61fb6b297b18cc8c33e9b417
 U drh
-Z 2f4253a7507c4c18153791477951e376
+Z 29f405b4db68236e1fc771220e887d13

programming_language: Jupyter Notebook
filename: manifest.uuid
change_type: ModificationType.MODIFY
diff: @@ -1 +1 @@
-8b12e95fec7ce6e0de82a04ca3dfcf1a8e62e233b7382aa28a8a9be6e862b1af
\ No newline at end of file
+6601da58032d18ae00b466c0f2077fb2b1ecd84225b56e1787724bea478eedc9
\ No newline at end of file

programming_language: SQL
filename: resolve.c
change_type: ModificationType.MODIFY
diff: @@ -551,9 +551,18 @@ static int lookupName(
 
   /* If a column from a table in pSrcList is referenced, then record
   ** this fact in the pSrcList.a[].colUsed bitmask.  Column 0 causes
-  ** bit 0 to be set.  Column 1 sets bit 1.  And so forth.  If the
-  ** column number is greater than the number of bits in the bitmask
-  ** then set the high-order bit of the bitmask.
+  ** bit 0 to be set.  Column 1 sets bit 1.  And so forth.
+  **
+  ** The colUsed mask is an optimization used to help determine if an
+  ** index is a covering index.  The correct answer is still obtained
+  ** if the mask contains extra bits.  But omitting bits from the mask
+  ** might result in an incorrect answer.
+  **
+  ** The high-order bit of the mask is a "we-use-them-all" bit.
+  ** If the column number is greater than the number of bits in the bitmask
+  ** then set the high-order bit of the bitmask.  Also set the high-order
+  ** bit if the column is a generated column, as that adds dependencies
+  ** that are difficult to track, so we assume that all columns are used.
   */
   if( pExpr->iColumn>=0 && pMatch!=0 ){
     int n = pExpr->iColumn;
@@ -561,7 +570,12 @@ static int lookupName(
     if( n>=BMS ){
       n = BMS-1;
     }
+    assert( pExpr->y.pTab!=0 );
     assert( pMatch->iCursor==pExpr->iTable );
+    if( pExpr->y.pTab->tabFlags & TF_HasGenerated ){
+      Column *pCol = pExpr->y.pTab->aCol + pExpr->iColumn;
+      if( pCol->colFlags & COLFLAG_GENERATED ) n = BMS-1;
+    }
     pMatch->colUsed |= ((Bitmask)1)<<n;
   }
 

programming_language: C
filename: gencol1.test
change_type: ModificationType.MODIFY
diff: @@ -246,14 +246,19 @@ do_catchsql_test gencol1-8.20 {
 # 2019-11-21 Problems in the new generated column logic
 # reported by Yongheng Chen and Rui Zhong
 do_execsql_test gencol1-9.10 {
-  DROP TABLE IF EXISTS t1;
-  DROP TABLE IF EXISTS t2;
+  DROP TABLE t1;
   CREATE TABLE t1(aa , bb AS (17) UNIQUE);
   INSERT INTO t1 VALUES(17);
   CREATE TABLE t2(cc);
   INSERT INTO t2 VALUES(41);
   SELECT * FROM t2 JOIN t1 WHERE t1.bb=t1.aa AND t1.bb=17;
 } {41 17 17}
-
+do_execsql_test gencol1-9.20 {
+  CREATE TABLE t3(aa INT PRIMARY KEY, bb UNIQUE AS(aa));
+  INSERT INTO t3 VALUES(1);
+  SELECT 100, * FROM t3;
+  DELETE FROM t3 WHERE (SELECT bb FROM t3);
+  SELECT 200, * FROM t3;
+} {100 1 1}
 
 finish_test

programming_language: SQL
repo_url: https://github.com/sqlite/sqlite
commit_details: repo_url: https://github.com/sqlite/sqlite
author: drh
author_date: 2019-11-22 11:38:40+00:00
msg: Add more test cases from Yongheng Chen and Rui Zhong.

FossilOrigin-Name: f24e6ca4f23008212ec05cace9202dbeb37ee34530ead91fac2f5e3eac7f6347
repository: repo_url: https://github.com/sqlite/sqlite
repo_name: sqlite/sqlite
description: Official Git mirror of the SQLite source tree
repo_language: C
owner: sqlite
file_changes: filename: manifest
change_type: ModificationType.MODIFY
diff: @@ -1,5 +1,5 @@
-C Fix\sa\scrash\sthat\scould\soccur\sif\sa\ssub-select\sthat\suses\sboth\sDISTINCT\sand\swindow\sfunctions\salso\sused\san\sORDER\sBY\sthat\sis\sthe\ssame\sas\sits\sselect\slist.
-D 2019-11-22T10:14:01.691
+C Add\smore\stest\scases\sfrom\sYongheng\sChen\sand\sRui\sZhong.
+D 2019-11-22T11:38:40.010
 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
 F LICENSE.md df5091916dbb40e6e9686186587125e1b2ff51f022cc334e886c19a0e9982724
@@ -1009,7 +1009,7 @@ F test/fuzz4.test c229bcdb45518a89e1d208a21343e061503460ac69fae1539320a89f572eb6
 F test/fuzz_common.tcl a87dfbb88c2a6b08a38e9a070dabd129e617b45b
 F test/fuzz_malloc.test f348276e732e814802e39f042b1f6da6362a610af73a528d8f76898fde6b22f2
 F test/fuzzcheck.c e8cf694f71a1ee39a59f7c2a38c0f8660db0656ce47c8a334b6e9a11f1e66c6d
-F test/fuzzdata1.db 36e67e14aeb12ef15bf9bc7215694573244355be70a855b1a3d0e1009645a462
+F test/fuzzdata1.db d36e88741b4f23bcbaaf55b006290669d03c6c891cf13c7b3a53bc1b097b693f
 F test/fuzzdata2.db 128b3feeb78918d075c9b14b48610145a0dd4c8d6f1ca7c2870c7e425f5bf31f
 F test/fuzzdata3.db c6586d3e3cef0fbc18108f9bb649aa77bfc38aba
 F test/fuzzdata4.db b502c7d5498261715812dd8b3c2005bad08b3a26e6489414bd13926cd3e42ed2
@@ -1850,7 +1850,7 @@ F vsixtest/vsixtest.tcl 6a9a6ab600c25a91a7acc6293828957a386a8a93
 F vsixtest/vsixtest.vcxproj.data 2ed517e100c66dc455b492e1a33350c1b20fbcdc
 F vsixtest/vsixtest.vcxproj.filters 37e51ffedcdb064aad6ff33b6148725226cd608e
 F vsixtest/vsixtest_TemporaryKey.pfx e5b1b036facdb453873e7084e1cae9102ccc67a0
-P 6a64fb6a2da6c98f1e87b55ad5689967e1db4eae2e08345471d95e28cd567e0f
-R 6a5d6072626d6501ea14c356f9dce16a
-U dan
-Z 0f63dd080b5a1fb6658b32eaaaf6aa19
+P bcdd66c1691955c697f3d756c2b035acfe98f6aad72e90b0021bab6e9023b3ba
+R f1da4824caf80eae8ce8f07b9958fc70
+U drh
+Z 8c3d65cb0a9bf9ef3eea1a3d78549ecc

programming_language: Jupyter Notebook
filename: manifest.uuid
change_type: ModificationType.MODIFY
diff: @@ -1 +1 @@
-bcdd66c1691955c697f3d756c2b035acfe98f6aad72e90b0021bab6e9023b3ba
\ No newline at end of file
+f24e6ca4f23008212ec05cace9202dbeb37ee34530ead91fac2f5e3eac7f6347
\ No newline at end of file

programming_language: SQL