You can not select more than 25 topics Topics must start with a chinese character,a letter or number, can include dashes ('-') and can be up to 35 characters long.

sqlite.patch001 7.6 kB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144
  1. diff -Npur -x .git sqlite.3.31.1/manifest sqlite.3.31.1_CVE-2020-9327_bf48ce49_78d1d225_patch001/manifest
  2. --- sqlite.3.31.1/manifest 2020-04-20 10:21:03.622574899 +0800
  3. +++ sqlite.3.31.1_CVE-2020-9327_bf48ce49_78d1d225_patch001/manifest 2020-04-20 11:05:54.613993594 +0800
  4. @@ -482,8 +482,8 @@ F src/ctime.c 1b0724e66f95f33b160b1af85c
  5. F src/date.c 6c408fdd2e9ddf6e8431aba76315a2d061bea2cec8fbb75e25d7c1ba08274712
  6. F src/dbpage.c 8a01e865bf8bc6d7b1844b4314443a6436c07c3efe1d488ed89e81719047833a
  7. F src/dbstat.c 0f55297469d4244ab7df395849e1af98eb5e95816af7c661e7d2d8402dea23da
  8. -F src/delete.c a5c59b9c0251cf7682bc52af0d64f09b1aefc6781a63592c8f1136f7b73c66e4
  9. -F src/expr.c 003c59158b33d7f3b198122cb0d1e13c06517cc3932e56b42283eb0e96696d66
  10. +F src/delete.c 11000121c4281c0bce4e41db29addfaea0038eaa127ece02557c9207bc3e541d
  11. +F src/expr.c 4b25db7f9472b3532560242193bc4eefaefc7720dc4f2d7ec9a89ada410c6ea2
  12. F src/fault.c 460f3e55994363812d9d60844b2a6de88826e007
  13. F src/fkey.c 92a248ec0fa4ed8ab60c98d9b188ce173aaf218f32e7737ba77deb2a684f9847
  14. F src/func.c 108577cebe8a50c86d849a93b99493a54e348dd0b846f00d13b52ca973d5baf4
  15. @@ -536,8 +536,8 @@ F src/shell.c.in c2e20c43a44fb5588a6c27c
  16. F src/sqlite.h.in 75d0304247a2154122d6d06f12219c1e29291d72304f0eeef4c1ec6b1409b443
  17. F src/sqlite3.rc 5121c9e10c3964d5755191c80dd1180c122fc3a8
  18. F src/sqlite3ext.h 27951f294f29cd875c6027f2707d644ef99f469bd97514568b5a8581a114db8c
  19. -F src/sqliteInt.h 7a29ba700a51eeb925731749a570cf3859f6a58ed94797ecf47508875b0ba279
  20. -F src/sqliteLimit.h 1513bfb7b20378aa0041e7022d04acb73525de35b80b252f1b83fedb4de6a76b
  21. +F src/sqliteInt.h d736043dc6291d3af289d911237da0801b6c05be086ae322eedd47a089ae8d2f
  22. +F src/sqliteLimit.h 95cb8479ca459496d9c1c6a9f76b38aee12203a56ce1092fe13e50ae2454c032
  23. F src/status.c 9ff2210207c6c3b4d9631a8241a7d45ab1b26a0e9c84cb07a9b5ce2de9a3b278
  24. F src/table.c b46ad567748f24a326d9de40e5b9659f96ffff34
  25. F src/tclsqlite.c 97590069efaba5a4928ecffb606e3771dd93ee8e6bf248a62a6507c37a2b2e46
  26. @@ -619,8 +619,8 @@ F src/wal.h 606292549f5a7be50b6227bd685f
  27. F src/walker.c a137468bf36c92e64d2275caa80c83902e3a0fc59273591b96c6416d3253d05d
  28. F src/where.c 2005d0511e05e5f7b6fb3be514b44f264f23d45f3b0cc5e150c63e3006a003e5
  29. F src/whereInt.h 9157228db086f436a574589f8cc5749bd971e94017c552305ad9ec472ed2e098
  30. -F src/wherecode.c ec8870d6fe79668dd12d7edc65ae9771828d6cdfe478348c8abd872a89fdbadd
  31. -F src/whereexpr.c 4b34be1434183e7bb8a05d4bf42bd53ea53021b0b060936fbd12062b4ff6b396
  32. +F src/wherecode.c f5df56e395ade2240cabb2d39500c681bd29f8cc0636c3301c4996ad160df94d
  33. +F src/whereexpr.c 264d58971eaf8256eb5b0917bcd7fc7a1f1109fdda183a8382308a1b18a2dce7
  34. F src/window.c f8ba2ee12a19b51d3ba42c16277c74185ee9215306bc0d5a03974ade8b5bc98f
  35. F test/8_3_names.test ebbb5cd36741350040fd28b432ceadf495be25b2
  36. F test/affinity2.test ce1aafc86e110685b324e9a763eab4f2a73f737842ec3b687bd965867de90627
  37. @@ -1857,10 +1857,10 @@ F vsixtest/vsixtest.tcl 6a9a6ab600c25a91
  38. F vsixtest/vsixtest.vcxproj.data 2ed517e100c66dc455b492e1a33350c1b20fbcdc
  39. F vsixtest/vsixtest.vcxproj.filters 37e51ffedcdb064aad6ff33b6148725226cd608e
  40. F vsixtest/vsixtest_TemporaryKey.pfx e5b1b036facdb453873e7084e1cae9102ccc67a0
  41. -P 6fb9a8fb85486a8fccc462856316ef523450c23a7a7a81c8dfb323fbe809f8f5
  42. -R bf075f6bcc1758c5c1ecd13052997456
  43. +P 9d0d4ab95dc0c56e053c2924ed322a9ea7b25439e6f74599f706905a1994e454
  44. +R 1c052b7cdf4947664b7043564b643ac3
  45. T +bgcolor * #d0c0ff
  46. T +sym-release *
  47. T +sym-version-3.31.1 *
  48. U drh
  49. -Z 7c50801eed3eaef969e028ef5a0a641a
  50. +Z e960557a43b001a47933dacf8bc1d10e
  51. diff -Npur -x .git sqlite.3.31.1/manifest.uuid sqlite.3.31.1_CVE-2020-9327_bf48ce49_78d1d225_patch001/manifest.uuid
  52. --- sqlite.3.31.1/manifest.uuid 2020-04-20 10:21:03.630574843 +0800
  53. +++ sqlite.3.31.1_CVE-2020-9327_bf48ce49_78d1d225_patch001/manifest.uuid 2020-04-20 11:05:54.613993594 +0800
  54. @@ -1 +1 @@
  55. -3bfa9cc97da10598521b342961df8f5f68c7388fa117345eeb516eaa837bb4d6
  56. \ 文件尾没有换行符
  57. +abc473fb8fb999005dc79a360e34f97b3b25429decf1820dd2afa5c19577753d
  58. diff -Npur -x .git sqlite.3.31.1/src/expr.c sqlite.3.31.1_CVE-2020-9327_bf48ce49_78d1d225_patch001/src/expr.c
  59. --- sqlite.3.31.1/src/expr.c 2020-04-20 10:21:03.642574758 +0800
  60. +++ sqlite.3.31.1_CVE-2020-9327_bf48ce49_78d1d225_patch001/src/expr.c 2020-04-20 11:05:54.617993541 +0800
  61. @@ -5463,19 +5463,25 @@ static int impliesNotNullRow(Walker *pWa
  62. case TK_LT:
  63. case TK_LE:
  64. case TK_GT:
  65. - case TK_GE:
  66. + case TK_GE: {
  67. + Expr *pLeft = pExpr->pLeft;
  68. + Expr *pRight = pExpr->pRight;
  69. testcase( pExpr->op==TK_EQ );
  70. testcase( pExpr->op==TK_NE );
  71. testcase( pExpr->op==TK_LT );
  72. testcase( pExpr->op==TK_LE );
  73. testcase( pExpr->op==TK_GT );
  74. testcase( pExpr->op==TK_GE );
  75. - if( (pExpr->pLeft->op==TK_COLUMN && IsVirtual(pExpr->pLeft->y.pTab))
  76. - || (pExpr->pRight->op==TK_COLUMN && IsVirtual(pExpr->pRight->y.pTab))
  77. + /* The y.pTab=0 assignment in wherecode.c always happens after the
  78. + ** impliesNotNullRow() test */
  79. + if( (pLeft->op==TK_COLUMN && ALWAYS(pLeft->y.pTab!=0)
  80. + && IsVirtual(pLeft->y.pTab))
  81. + || (pRight->op==TK_COLUMN && ALWAYS(pRight->y.pTab!=0)
  82. + && IsVirtual(pRight->y.pTab))
  83. ){
  84. - return WRC_Prune;
  85. + return WRC_Prune;
  86. }
  87. -
  88. + }
  89. default:
  90. return WRC_Continue;
  91. }
  92. diff -Npur -x .git sqlite.3.31.1/src/sqliteInt.h sqlite.3.31.1_CVE-2020-9327_bf48ce49_78d1d225_patch001/src/sqliteInt.h
  93. --- sqlite.3.31.1/src/sqliteInt.h 2020-04-20 10:21:03.642574758 +0800
  94. +++ sqlite.3.31.1_CVE-2020-9327_bf48ce49_78d1d225_patch001/src/sqliteInt.h 2020-04-20 11:05:54.617993541 +0800
  95. @@ -2153,8 +2153,11 @@ struct Table {
  96. */
  97. #ifndef SQLITE_OMIT_VIRTUALTABLE
  98. # define IsVirtual(X) ((X)->nModuleArg)
  99. +# define ExprIsVtab(X) \
  100. + ((X)->op==TK_COLUMN && (X)->y.pTab!=0 && (X)->y.pTab->nModuleArg)
  101. #else
  102. # define IsVirtual(X) 0
  103. +# define ExprIsVtab(X) 0
  104. #endif
  105. /*
  106. diff -Npur -x .git sqlite.3.31.1/src/whereexpr.c sqlite.3.31.1_CVE-2020-9327_bf48ce49_78d1d225_patch001/src/whereexpr.c
  107. --- sqlite.3.31.1/src/whereexpr.c 2020-04-20 10:21:03.642574758 +0800
  108. +++ sqlite.3.31.1_CVE-2020-9327_bf48ce49_78d1d225_patch001/src/whereexpr.c 2020-04-20 11:05:54.617993541 +0800
  109. @@ -377,7 +377,8 @@ static int isAuxiliaryVtabOperator(
  110. ** MATCH(expression,vtab_column)
  111. */
  112. pCol = pList->a[1].pExpr;
  113. - if( pCol->op==TK_COLUMN && IsVirtual(pCol->y.pTab) ){
  114. + testcase( pCol->op==TK_COLUMN && pCol->y.pTab==0 );
  115. + if( ExprIsVtab(pCol) ){
  116. for(i=0; i<ArraySize(aOp); i++){
  117. if( sqlite3StrICmp(pExpr->u.zToken, aOp[i].zOp)==0 ){
  118. *peOp2 = aOp[i].eOp2;
  119. @@ -399,7 +400,8 @@ static int isAuxiliaryVtabOperator(
  120. ** with function names in an arbitrary case.
  121. */
  122. pCol = pList->a[0].pExpr;
  123. - if( pCol->op==TK_COLUMN && IsVirtual(pCol->y.pTab) ){
  124. + testcase( pCol->op==TK_COLUMN && pCol->y.pTab==0 );
  125. + if( ExprIsVtab(pCol) ){
  126. sqlite3_vtab *pVtab;
  127. sqlite3_module *pMod;
  128. void (*xNotUsed)(sqlite3_context*,int,sqlite3_value**);
  129. @@ -422,10 +424,12 @@ static int isAuxiliaryVtabOperator(
  130. int res = 0;
  131. Expr *pLeft = pExpr->pLeft;
  132. Expr *pRight = pExpr->pRight;
  133. - if( pLeft->op==TK_COLUMN && IsVirtual(pLeft->y.pTab) ){
  134. + testcase( pLeft->op==TK_COLUMN && pLeft->y.pTab==0 );
  135. + if( ExprIsVtab(pLeft) ){
  136. res++;
  137. }
  138. - if( pRight && pRight->op==TK_COLUMN && IsVirtual(pRight->y.pTab) ){
  139. + testcase( pRight && pRight->op==TK_COLUMN && pRight->y.pTab==0 );
  140. + if( pRight && ExprIsVtab(pRight) ){
  141. res++;
  142. SWAP(Expr*, pLeft, pRight);
  143. }