SQLite

Check-in [bb9bfc3a12]
Login

Many hyperlinks are disabled.
Use anonymous login to enable hyperlinks.

Overview
Comment:Fix a crash caused by a LIKE pattern that consists of a single escape character. Problem found by OSSFuzz.
Downloads: Tarball | ZIP archive
Timelines: family | ancestors | descendants | both | trunk
Files: files | file ages | folders
SHA3-256: bb9bfc3a12dfb89b1c58f5551cdc89ab7b0fbe03f285f2ed86611786ed02ffd9
User & Date: dan 2018-07-02 15:03:50.160
Original Comment: Fix a crash caused by a LIKE pattern that consists of a single escape character.
Context
2018-07-02
17:14
Fix a segfault caused by having identical window functions in the select-list and ORDER BY clause of a SELECT statement. (check-in: 693b4350d7 user: dan tags: trunk)
15:03
Fix a crash caused by a LIKE pattern that consists of a single escape character. Problem found by OSSFuzz. (check-in: bb9bfc3a12 user: dan tags: trunk)
12:07
Fix a segfault caused by invoking a regular aggregate as a window-function. And some problems with count(*) when used as a window-function. (check-in: 4f3c8a82fd user: dan tags: trunk)
Changes
Unified Diff Ignore Whitespace Patch
Changes to src/func.c.
︙︙
1608
1609
1610
1611
1612
1613
1614


1615
1616
1617
1618
1619
1620
1621
1622

  if( (argc==0 || SQLITE_NULL!=sqlite3_value_type(argv[0])) && p ){
    p->n--;
#ifdef SQLITE_DEBUG
    p->bInverse = 1;
#endif
  }
}   


#endif

/*
** Routines to implement min() and max() aggregate functions.
*/
static void minmaxStep(
  sqlite3_context *context, 
  int NotUsed, 








>
>
|








1608
1609
1610
1611
1612
1613
1614
1615
1616
1617
1618
1619
1620
1621
1622
1623
1624

  if( (argc==0 || SQLITE_NULL!=sqlite3_value_type(argv[0])) && p ){
    p->n--;
#ifdef SQLITE_DEBUG
    p->bInverse = 1;
#endif
  }
}   
#else
# define countInverse 0
#endif /* SQLITE_OMIT_WINDOWFUNC */

/*
** Routines to implement min() and max() aggregate functions.
*/
static void minmaxStep(
  sqlite3_context *context, 
  int NotUsed,
︙︙
Changes to src/whereexpr.c.
︙︙
252
253
254
255
256
257
258

259
260
261

262
263
264
265
266
267
268
269
270

    while( (c=z[cnt])!=0 && c!=wc[0] && c!=wc[1] && c!=wc[2] ){
      cnt++;
      if( c==wc[3] && z[cnt]!=0 ) cnt++;
    }

    /* The optimization is possible only if (1) the pattern does not begin
    ** with a wildcard and if (2) the non-wildcard prefix does not end with

    ** an (illegal 0xff) character.  The second condition is necessary so
    ** that we can increment the prefix key to find an upper bound for the
    ** range search. 

    */
    if( cnt!=0 && 255!=(u8)z[cnt-1] ){
      Expr *pPrefix;

      /* A "complete" match if the pattern ends with "*" or "%" */
      *pisComplete = c==wc[0] && z[cnt+1]==0;

      /* Get the pattern prefix.  Remove all escapes from the prefix. */
      pPrefix = sqlite3Expr(db, TK_STRING, (char*)z);








>
|

|
>
|
|








252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272

    while( (c=z[cnt])!=0 && c!=wc[0] && c!=wc[1] && c!=wc[2] ){
      cnt++;
      if( c==wc[3] && z[cnt]!=0 ) cnt++;
    }

    /* The optimization is possible only if (1) the pattern does not begin
    ** with a wildcard and if (2) the non-wildcard prefix does not end with
    ** an (illegal 0xff) character, or (3) the pattern does not consist of
    ** a single escape character. The second condition is necessary so
    ** that we can increment the prefix key to find an upper bound for the
    ** range search. The third is because the caller assumes that the pattern
    ** consists of at least one character after all escapes have been
    ** removed.  */
    if( cnt!=0 && 255!=(u8)z[cnt-1] && (cnt>1 || z[0]!=wc[3]) ){
      Expr *pPrefix;

      /* A "complete" match if the pattern ends with "*" or "%" */
      *pisComplete = c==wc[0] && z[cnt+1]==0;

      /* Get the pattern prefix.  Remove all escapes from the prefix. */
      pPrefix = sqlite3Expr(db, TK_STRING, (char*)z);
︙︙
Changes to test/window6.test.
︙︙
142
143
144
145
146
147
148

149




150
151

152
153
154












155
156
157

do_execsql_test 5.5 {
  SELECT count(*) OVER win FROM over
  WINDOW win AS (ORDER BY x ROWS BETWEEN +2 FOLLOWING AND +3 FOLLOWING)
} {1 0 0}

#-------------------------------------------------------------------------
#

do_execsql_test 6.0 {




  SELECT LIKE("!","","!")""WHeRE"";
} {1}

do_catchsql_test 6.1 {
  SELECT LIKE("!","","!")""window"";
} {1 {near "window": syntax error}}













finish_test









>

>
>
>
>

|
>
|


>
>
>
>
>
>
>
>
>
>
>
>




142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175

do_execsql_test 5.5 {
  SELECT count(*) OVER win FROM over
  WINDOW win AS (ORDER BY x ROWS BETWEEN +2 FOLLOWING AND +3 FOLLOWING)
} {1 0 0}

#-------------------------------------------------------------------------
#

do_execsql_test 6.0 {
  SELECT LIKE('!', '', '!') x WHERE x;
} {}

do_execsql_test 6.1 {
  SELECT LIKE("!","","!")""WHeRE"";
} {}

do_catchsql_test 6.2 {
  SELECT LIKE("!","","!")""window"";
} {1 {near "window": syntax error}}

reset_db 
do_execsql_test 7.0 {
  CREATE TABLE t1(x TEXT);
  CREATE INDEX i1 ON t1(x COLLATE nocase);
  INSERT INTO t1 VALUES('');
}

do_execsql_test 7.1 {
  SELECT count(*) FROM t1 WHERE x LIKE '!' ESCAPE '!';
} {0}


finish_test