sqlite/0010-Fix_handling_of_window_functions.patch
Markeryang b5718f9b04 Fix CVE-2020-13871
Fix CVE-2020-13871
2020-08-04 15:03:24 +08:00

146 lines
4.1 KiB
Diff

From 553948e51433715f32d57e6977db6e0992b7f8cd Mon Sep 17 00:00:00 2001
From: dan <dan@noemail.net>
Date: Mon, 16 Mar 2020 18:52:53 +0000
Subject: [PATCH] Fix handling of window functions in aggregate queries that
have no GROUP BY clause. Also remove a faulty assert causing the error
reported in [618156e3].
patch reference:
https://www.sqlite.org/src/info/38e3dd389d142e52
---
src/select.c | 1 -
src/window.c | 2 ++
test/window4.tcl | 14 ++++++++++++++
test/window4.test | 14 ++++++++++++++
test/window9.test | 33 +++++++++++++++++++++++++++++++++
5 files changed, 63 insertions(+), 1 deletion(-)
diff --git a/src/select.c b/src/select.c
index 7f88e35..f61fbce 100644
--- a/src/select.c
+++ b/src/select.c
@@ -103,7 +103,6 @@ static void clearSelect(sqlite3 *db, Select *p, int bFree){
if( OK_IF_ALWAYS_TRUE(p->pWinDefn) ){
sqlite3WindowListDelete(db, p->pWinDefn);
}
- assert( p->pWin==0 );
#endif
if( OK_IF_ALWAYS_TRUE(p->pWith) ) sqlite3WithDelete(db, p->pWith);
if( bFree ) sqlite3DbFreeNN(db, p);
diff --git a/src/window.c b/src/window.c
index a72ec0d..9bb3217 100644
--- a/src/window.c
+++ b/src/window.c
@@ -933,6 +933,7 @@ int sqlite3WindowRewrite(Parse *pParse, Select *p){
Window *pMWin = p->pWin; /* Master window object */
Window *pWin; /* Window object iterator */
Table *pTab;
+ u32 selFlags = p->selFlags;
pTab = sqlite3DbMallocZero(db, sizeof(Table));
if( pTab==0 ){
@@ -1022,6 +1023,7 @@ int sqlite3WindowRewrite(Parse *pParse, Select *p){
sqlite3SrcListAssignCursors(pParse, p->pSrc);
pSub->selFlags |= SF_Expanded;
pTab2 = sqlite3ResultSetOfSelect(pParse, pSub, SQLITE_AFF_NONE);
+ pSub->selFlags |= (selFlags & SF_Aggregate);
if( pTab2==0 ){
/* Might actually be some other kind of error, but in that case
** pParse->nErr will be set, so if SQLITE_NOMEM is set, we will get
diff --git a/test/window4.tcl b/test/window4.tcl
index 1b2b2ef..0b91d76 100644
--- a/test/window4.tcl
+++ b/test/window4.tcl
@@ -385,6 +385,20 @@ execsql_test 11.4 {
) sub;
}
+execsql_test 11.5 {
+ SELECT sum( min(t) ) OVER () FROM t8 GROUP BY total;
+}
+execsql_test 11.5 {
+ SELECT sum( max(t) ) OVER () FROM t8 GROUP BY total;
+}
+
+execsql_test 11.7 {
+ SELECT sum( min(t) ) OVER () FROM t8;
+}
+execsql_test 11.8 {
+ SELECT sum( max(t) ) OVER () FROM t8;
+}
+
execsql_test 12.0 {
DROP TABLE IF EXISTS t2;
CREATE TABLE t2(a INTEGER);
diff --git a/test/window4.test b/test/window4.test
index 6951a23..a0344e0 100644
--- a/test/window4.test
+++ b/test/window4.test
@@ -1324,6 +1324,20 @@ do_execsql_test 11.4 {
) sub;
} {0 1 2}
+do_execsql_test 11.5 {
+ SELECT sum( min(t) ) OVER () FROM t8 GROUP BY total;
+} {5 5}
+
+do_execsql_test 11.5 {
+ SELECT sum( max(t) ) OVER () FROM t8 GROUP BY total;
+} {10 10}
+do_execsql_test 11.7 {
+ SELECT sum( min(t) ) OVER () FROM t8;
+} {0}
+do_execsql_test 11.8 {
+ SELECT sum( max(t) ) OVER () FROM t8;
+} {10}
+
do_execsql_test 12.0 {
DROP TABLE IF EXISTS t2;
CREATE TABLE t2(a INTEGER);
diff --git a/test/window9.test b/test/window9.test
index adfeaba..686afc9 100644
--- a/test/window9.test
+++ b/test/window9.test
@@ -232,4 +232,37 @@ do_execsql_test 7.4 {
7.2 8.75 10.0 11.0 15.0
}
+#-------------------------------------------------------------------------
+reset_db
+do_execsql_test 8.1.1 {
+ CREATE TABLE t1(a, b);
+ INSERT INTO t1 VALUES(1, 2), (3, 4);
+ SELECT min( sum(a) ) OVER () FROM t1;
+} {4}
+
+do_execsql_test 8.1.2 {
+ SELECT min( sum(a) ) OVER () FROM t1 GROUP BY a;
+} {1 1}
+
+do_execsql_test 8.2 {
+ CREATE VIEW v1 AS
+ SELECT 0 AS x
+ UNION
+ SELECT count() OVER() FROM (SELECT 0)
+ ORDER BY 1
+ ;
+}
+
+do_catchsql_test 8.3 {
+ SELECT min( max((SELECT x FROM v1)) ) OVER()
+} {1 {misuse of aggregate: max()}}
+
+do_execsql_test 8.4 {
+ SELECT(
+ SELECT x UNION
+ SELECT sum( avg((SELECT x FROM v1)) ) OVER()
+ )
+ FROM v1;
+} {0.0}
+
finish_test
--
2.23.0