diff options
Diffstat (limited to 'meta/recipes-support/sqlite/files/CVE-2020-13435.patch')
-rw-r--r-- | meta/recipes-support/sqlite/files/CVE-2020-13435.patch | 219 |
1 files changed, 219 insertions, 0 deletions
diff --git a/meta/recipes-support/sqlite/files/CVE-2020-13435.patch b/meta/recipes-support/sqlite/files/CVE-2020-13435.patch new file mode 100644 index 0000000000..d726e50a27 --- /dev/null +++ b/meta/recipes-support/sqlite/files/CVE-2020-13435.patch | |||
@@ -0,0 +1,219 @@ | |||
1 | From e40cc16b472071f553700c7208394e6cf73d5688 Mon Sep 17 00:00:00 2001 | ||
2 | From: drh <drh@noemail.net> | ||
3 | Date: Sun, 24 May 2020 03:01:36 +0000 | ||
4 | Subject: [PATCH] Combination of patches to fix CVE2020-13435 | ||
5 | |||
6 | Combines: | ||
7 | |||
8 | Move some utility Walker callbacks into the walker.c source file, as they seem to belong there better. | ||
9 | When rewriting a query for window functions, if the rewrite changes the depth of TK_AGG_FUNCTION nodes, be sure to adjust the Expr.op2 field appropriately. Fix for ticket [7a5279a25c57adf1] | ||
10 | Defensive code that tries to prevent a recurrence of problems like the one described in ticket [7a5279a25c57adf1] | ||
11 | |||
12 | FossilOrigin-Name: dac438236f7c5419d4e7e094e8b3f19f83cd3b1a18bc8acb14aee90d4514fa3c | ||
13 | FossilOrigin-Name: ad7bb70af9bb68d192137188bb2528f1e9e43ad164c925174ca1dafc9e1f5339 | ||
14 | FossilOrigin-Name: 572105de1d44bca4f18c99d373458889163611384eebbc9659474874ee1701f4 | ||
15 | |||
16 | Upstream-Status: Backport | ||
17 | CVE: CVE-2020-13435 | ||
18 | |||
19 | Reference to upstream patches: | ||
20 | https://github.com/sqlite/sqlite/commit/e40cc16b472071f553700c7208394e6cf73d5688 | ||
21 | https://github.com/sqlite/sqlite/commit/c37577bb2dfb602a5cdbba8322a01b548c34c185 | ||
22 | https://github.com/sqlite/sqlite/commit/0934d640456bb168a8888ae388643c5160afe501 | ||
23 | |||
24 | Patches combined and converted to amalgamation format | ||
25 | |||
26 | Signed-off-by: Steve Sakoman <steve@sakoman.com> | ||
27 | --- | ||
28 | diff --git a/sqlite3.c b/sqlite3.c | ||
29 | index 5ff2c14..02892f8 100644 | ||
30 | --- a/sqlite3.c | ||
31 | +++ b/sqlite3.c | ||
32 | @@ -18965,6 +18965,9 @@ SQLITE_PRIVATE int sqlite3WalkSelectFrom(Walker*, Select*); | ||
33 | SQLITE_PRIVATE int sqlite3ExprWalkNoop(Walker*, Expr*); | ||
34 | SQLITE_PRIVATE int sqlite3SelectWalkNoop(Walker*, Select*); | ||
35 | SQLITE_PRIVATE int sqlite3SelectWalkFail(Walker*, Select*); | ||
36 | +SQLITE_PRIVATE int sqlite3WalkerDepthIncrease(Walker*,Select*); | ||
37 | +SQLITE_PRIVATE void sqlite3WalkerDepthDecrease(Walker*,Select*); | ||
38 | + | ||
39 | #ifdef SQLITE_DEBUG | ||
40 | SQLITE_PRIVATE void sqlite3SelectWalkAssert2(Walker*, Select*); | ||
41 | #endif | ||
42 | @@ -96773,6 +96776,43 @@ SQLITE_PRIVATE int sqlite3WalkSelect(Walker *pWalker, Select *p){ | ||
43 | return WRC_Continue; | ||
44 | } | ||
45 | |||
46 | +/* Increase the walkerDepth when entering a subquery, and | ||
47 | +** descrease when leaving the subquery. | ||
48 | +*/ | ||
49 | +SQLITE_PRIVATE int sqlite3WalkerDepthIncrease(Walker *pWalker, Select *pSelect){ | ||
50 | + UNUSED_PARAMETER(pSelect); | ||
51 | + pWalker->walkerDepth++; | ||
52 | + return WRC_Continue; | ||
53 | +} | ||
54 | +SQLITE_PRIVATE void sqlite3WalkerDepthDecrease(Walker *pWalker, Select *pSelect){ | ||
55 | + UNUSED_PARAMETER(pSelect); | ||
56 | + pWalker->walkerDepth--; | ||
57 | +} | ||
58 | + | ||
59 | + | ||
60 | +/* | ||
61 | +** No-op routine for the parse-tree walker. | ||
62 | +** | ||
63 | +** When this routine is the Walker.xExprCallback then expression trees | ||
64 | +** are walked without any actions being taken at each node. Presumably, | ||
65 | +** when this routine is used for Walker.xExprCallback then | ||
66 | +** Walker.xSelectCallback is set to do something useful for every | ||
67 | +** subquery in the parser tree. | ||
68 | +*/ | ||
69 | +SQLITE_PRIVATE int sqlite3ExprWalkNoop(Walker *NotUsed, Expr *NotUsed2){ | ||
70 | + UNUSED_PARAMETER2(NotUsed, NotUsed2); | ||
71 | + return WRC_Continue; | ||
72 | +} | ||
73 | + | ||
74 | +/* | ||
75 | +** No-op routine for the parse-tree walker for SELECT statements. | ||
76 | +** subquery in the parser tree. | ||
77 | +*/ | ||
78 | +SQLITE_PRIVATE int sqlite3SelectWalkNoop(Walker *NotUsed, Select *NotUsed2){ | ||
79 | + UNUSED_PARAMETER2(NotUsed, NotUsed2); | ||
80 | + return WRC_Continue; | ||
81 | +} | ||
82 | + | ||
83 | /************** End of walker.c **********************************************/ | ||
84 | /************** Begin file resolve.c *****************************************/ | ||
85 | /* | ||
86 | @@ -96801,6 +96841,8 @@ SQLITE_PRIVATE int sqlite3WalkSelect(Walker *pWalker, Select *p){ | ||
87 | ** | ||
88 | ** incrAggFunctionDepth(pExpr,n) is the main routine. incrAggDepth(..) | ||
89 | ** is a helper function - a callback for the tree walker. | ||
90 | +** | ||
91 | +** See also the sqlite3WindowExtraAggFuncDepth() routine in window.c | ||
92 | */ | ||
93 | static int incrAggDepth(Walker *pWalker, Expr *pExpr){ | ||
94 | if( pExpr->op==TK_AGG_FUNCTION ) pExpr->op2 += pWalker->u.n; | ||
95 | @@ -102459,7 +102501,10 @@ expr_code_doover: | ||
96 | switch( op ){ | ||
97 | case TK_AGG_COLUMN: { | ||
98 | AggInfo *pAggInfo = pExpr->pAggInfo; | ||
99 | - struct AggInfo_col *pCol = &pAggInfo->aCol[pExpr->iAgg]; | ||
100 | + struct AggInfo_col *pCol; | ||
101 | + assert( pAggInfo!=0 ); | ||
102 | + assert( pExpr->iAgg>=0 && pExpr->iAgg<pAggInfo->nColumn ); | ||
103 | + pCol = &pAggInfo->aCol[pExpr->iAgg]; | ||
104 | if( !pAggInfo->directMode ){ | ||
105 | assert( pCol->iMem>0 ); | ||
106 | return pCol->iMem; | ||
107 | @@ -102753,7 +102798,10 @@ expr_code_doover: | ||
108 | } | ||
109 | case TK_AGG_FUNCTION: { | ||
110 | AggInfo *pInfo = pExpr->pAggInfo; | ||
111 | - if( pInfo==0 ){ | ||
112 | + if( pInfo==0 | ||
113 | + || NEVER(pExpr->iAgg<0) | ||
114 | + || NEVER(pExpr->iAgg>=pInfo->nFunc) | ||
115 | + ){ | ||
116 | assert( !ExprHasProperty(pExpr, EP_IntValue) ); | ||
117 | sqlite3ErrorMsg(pParse, "misuse of aggregate: %s()", pExpr->u.zToken); | ||
118 | }else{ | ||
119 | @@ -104492,15 +104540,6 @@ static int analyzeAggregate(Walker *pWalker, Expr *pExpr){ | ||
120 | } | ||
121 | return WRC_Continue; | ||
122 | } | ||
123 | -static int analyzeAggregatesInSelect(Walker *pWalker, Select *pSelect){ | ||
124 | - UNUSED_PARAMETER(pSelect); | ||
125 | - pWalker->walkerDepth++; | ||
126 | - return WRC_Continue; | ||
127 | -} | ||
128 | -static void analyzeAggregatesInSelectEnd(Walker *pWalker, Select *pSelect){ | ||
129 | - UNUSED_PARAMETER(pSelect); | ||
130 | - pWalker->walkerDepth--; | ||
131 | -} | ||
132 | |||
133 | /* | ||
134 | ** Analyze the pExpr expression looking for aggregate functions and | ||
135 | @@ -104514,8 +104553,8 @@ static void analyzeAggregatesInSelectEnd(Walker *pWalker, Select *pSelect){ | ||
136 | SQLITE_PRIVATE void sqlite3ExprAnalyzeAggregates(NameContext *pNC, Expr *pExpr){ | ||
137 | Walker w; | ||
138 | w.xExprCallback = analyzeAggregate; | ||
139 | - w.xSelectCallback = analyzeAggregatesInSelect; | ||
140 | - w.xSelectCallback2 = analyzeAggregatesInSelectEnd; | ||
141 | + w.xSelectCallback = sqlite3WalkerDepthIncrease; | ||
142 | + w.xSelectCallback2 = sqlite3WalkerDepthDecrease; | ||
143 | w.walkerDepth = 0; | ||
144 | w.u.pNC = pNC; | ||
145 | w.pParse = 0; | ||
146 | @@ -133065,29 +133104,6 @@ static int selectExpander(Walker *pWalker, Select *p){ | ||
147 | return WRC_Continue; | ||
148 | } | ||
149 | |||
150 | -/* | ||
151 | -** No-op routine for the parse-tree walker. | ||
152 | -** | ||
153 | -** When this routine is the Walker.xExprCallback then expression trees | ||
154 | -** are walked without any actions being taken at each node. Presumably, | ||
155 | -** when this routine is used for Walker.xExprCallback then | ||
156 | -** Walker.xSelectCallback is set to do something useful for every | ||
157 | -** subquery in the parser tree. | ||
158 | -*/ | ||
159 | -SQLITE_PRIVATE int sqlite3ExprWalkNoop(Walker *NotUsed, Expr *NotUsed2){ | ||
160 | - UNUSED_PARAMETER2(NotUsed, NotUsed2); | ||
161 | - return WRC_Continue; | ||
162 | -} | ||
163 | - | ||
164 | -/* | ||
165 | -** No-op routine for the parse-tree walker for SELECT statements. | ||
166 | -** subquery in the parser tree. | ||
167 | -*/ | ||
168 | -SQLITE_PRIVATE int sqlite3SelectWalkNoop(Walker *NotUsed, Select *NotUsed2){ | ||
169 | - UNUSED_PARAMETER2(NotUsed, NotUsed2); | ||
170 | - return WRC_Continue; | ||
171 | -} | ||
172 | - | ||
173 | #if SQLITE_DEBUG | ||
174 | /* | ||
175 | ** Always assert. This xSelectCallback2 implementation proves that the | ||
176 | @@ -150225,6 +150241,23 @@ static ExprList *exprListAppendList( | ||
177 | return pList; | ||
178 | } | ||
179 | |||
180 | +/* | ||
181 | +** When rewriting a query, if the new subquery in the FROM clause | ||
182 | +** contains TK_AGG_FUNCTION nodes that refer to an outer query, | ||
183 | +** then we have to increase the Expr->op2 values of those nodes | ||
184 | +** due to the extra subquery layer that was added. | ||
185 | +** | ||
186 | +** See also the incrAggDepth() routine in resolve.c | ||
187 | +*/ | ||
188 | +static int sqlite3WindowExtraAggFuncDepth(Walker *pWalker, Expr *pExpr){ | ||
189 | + if( pExpr->op==TK_AGG_FUNCTION | ||
190 | + && pExpr->op2>=pWalker->walkerDepth | ||
191 | + ){ | ||
192 | + pExpr->op2++; | ||
193 | + } | ||
194 | + return WRC_Continue; | ||
195 | +} | ||
196 | + | ||
197 | /* | ||
198 | ** If the SELECT statement passed as the second argument does not invoke | ||
199 | ** any SQL window functions, this function is a no-op. Otherwise, it | ||
200 | @@ -150333,6 +150366,7 @@ SQLITE_PRIVATE int sqlite3WindowRewrite(Parse *pParse, Select *p){ | ||
201 | p->pSrc = sqlite3SrcListAppend(pParse, 0, 0, 0); | ||
202 | if( p->pSrc ){ | ||
203 | Table *pTab2; | ||
204 | + Walker w; | ||
205 | p->pSrc->a[0].pSelect = pSub; | ||
206 | sqlite3SrcListAssignCursors(pParse, p->pSrc); | ||
207 | pSub->selFlags |= SF_Expanded; | ||
208 | @@ -150347,6 +150381,11 @@ SQLITE_PRIVATE int sqlite3WindowRewrite(Parse *pParse, Select *p){ | ||
209 | pTab->tabFlags |= TF_Ephemeral; | ||
210 | p->pSrc->a[0].pTab = pTab; | ||
211 | pTab = pTab2; | ||
212 | + memset(&w, 0, sizeof(w)); | ||
213 | + w.xExprCallback = sqlite3WindowExtraAggFuncDepth; | ||
214 | + w.xSelectCallback = sqlite3WalkerDepthIncrease; | ||
215 | + w.xSelectCallback2 = sqlite3WalkerDepthDecrease; | ||
216 | + sqlite3WalkSelect(&w, pSub); | ||
217 | } | ||
218 | }else{ | ||
219 | sqlite3SelectDelete(db, pSub); | ||