Change the SQLITE_READ authorization call for unreferenced tables to use

an empty string for the column name, as this is less likely to impact legacy
authorization callbacks that assume column names are always non-NULL.

FossilOrigin-Name: 4139953ab528f20fa346409810edcb22adb6c1edc9d22f40b1b077ef842a2441

diff --git a/manifest b/manifest
index 08456e389b2c067a49fb3320a1e1e84912dc0221..2ebdfee6504c5ac2673d02af2d931f4be722910b 100644 (file)
--- a/manifest
+++ b/manifest
@@ -1,5 +1,5 @@
-C Rename\sfields\sof\sthe\sinternal\sAuxData\sobject\sto\smake\sthem\sunique\sand\seasier\nto\ssearch\sfor.
-D 2017-05-10T19:42:52.377
+C Change\sthe\sSQLITE_READ\sauthorization\scall\sfor\sunreferenced\stables\sto\suse\nan\sempty\sstring\sfor\sthe\scolumn\sname,\sas\sthis\sis\sless\slikely\sto\simpact\slegacy\nauthorization\scallbacks\sthat\sassume\scolumn\snames\sare\salways\snon-NULL.
+D 2017-05-11T12:05:23.185
 F Makefile.in 1cc758ce3374a32425e4d130c2fe7b026b20de5b8843243de75f087c0a2661fb
 F Makefile.linux-gcc 7bc79876b875010e8c8f9502eb935ca92aa3c434
 F Makefile.msc 6a8c838220f7c00820e1fc0ac1bccaaa8e5676067e1dbfa1bafa7a4ffecf8ae6
@@ -402,9 +402,9 @@ F src/printf.c 8757834f1b54dae512fb25eb1acc8e94a0d15dd2290b58f2563f65973265adb2
 F src/random.c 80f5d666f23feb3e6665a6ce04c7197212a88384
 F src/resolve.c 3e518b962d932a997fae373366880fc028c75706
 F src/rowset.c 7b7e7e479212e65b723bf40128c7b36dc5afdfac
-F src/select.c 275ad2697c50392f5b198bd1e79fc3559573e00ec504d46741f02b158b151e4d
+F src/select.c d74b1cde1d9ca6d08bec50b60a5be19440273646bc8ae16648d748c38161d5b7
 F src/shell.c a37d96b20b3644d0eb905df5aa7a0fcf9f6e73c15898337230c760a24a8df794
-F src/sqlite.h.in a13eae90f740278018605ae30e561f9789c227dc3b87a684054e07022d721719
+F src/sqlite.h.in a0b959830616ab1849f340285014610eed39562127ec847d9d00c6d75ce2dc2c
 F src/sqlite3.rc 5121c9e10c3964d5755191c80dd1180c122fc3a8
 F src/sqlite3ext.h 58fd0676d3111d02e62e5a35992a7d3da5d3f88753acc174f2d37b774fbbdd28
 F src/sqliteInt.h aea3aa1b81e0d07d5b1c39b8c5a54a1dc5e4f10136cb63da392aef9eb2a5108b
@@ -1579,7 +1579,7 @@ F vsixtest/vsixtest.tcl 6a9a6ab600c25a91a7acc6293828957a386a8a93
 F vsixtest/vsixtest.vcxproj.data 2ed517e100c66dc455b492e1a33350c1b20fbcdc
 F vsixtest/vsixtest.vcxproj.filters 37e51ffedcdb064aad6ff33b6148725226cd608e
 F vsixtest/vsixtest_TemporaryKey.pfx e5b1b036facdb453873e7084e1cae9102ccc67a0
-P 92c5ea7047323d10f762877c5f56d20a3e609e8b55efcfe4880ef3048821ac1f
-R a1dfb8ab33a614a9584dd808f82aa7c9
+P 2be9850cef6492e168243807c34af72119ffbe414027a12c4eda6c421b5b950d
+R cc2897f8815fc5891c267021967cf110
 U drh
-Z b1e990c3c0d70850169897a6b280d967
+Z 1c34db1a72aa8aee36e8a2e6fd670e70

diff --git a/manifest.uuid b/manifest.uuid
index d43601b4e10a096beda82c5971990bcd4e7931b0..a6263cfe0abed6441762caea4c7c5df6532bd0de 100644 (file)
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-2be9850cef6492e168243807c34af72119ffbe414027a12c4eda6c421b5b950d
\ No newline at end of file
+4139953ab528f20fa346409810edcb22adb6c1edc9d22f40b1b077ef842a2441
\ No newline at end of file

diff --git a/src/select.c b/src/select.c
index 57d0b93fb7504034c3992511af0889913c0a9850..eabbcc8c94651a9253ec493745136c911cbe310f 100644 (file)
--- a/src/select.c
+++ b/src/select.c
@@ -5124,15 +5124,23 @@ int sqlite3Select(
     SelectDest dest;
     Select *pSub;
 
-    /* Issue SQLITE_READ authorizations with a NULL column name for any tables that
+    /* Issue SQLITE_READ authorizations with a fake column name for any tables that
     ** are referenced but from which no values are extracted. Examples of where these
     ** kinds of null SQLITE_READ authorizations would occur:
     **
-    **     SELECT count(*) FROM t1;   -- SQLITE_READ t1 null
-    **     SELECT t1.* FROM t1, t2;   -- SQLITE_READ t2 null
+    **     SELECT count(*) FROM t1;   -- SQLITE_READ t1.""
+    **     SELECT t1.* FROM t1, t2;   -- SQLITE_READ t2.""
+    **
+    ** The fake column name is an empty string.  It is possible for a table to
+    ** have a column named by the empty string, in which case there is no way to
+    ** distinguish between an unreferenced table and an actual reference to the
+    ** "" column.  The original design was for the fake column name to be a NULL,
+    ** which would be unambiguous.  But legacy authorization callbacks might
+    ** assume the column name is non-NULL and segfault.  The use of an empty string
+    ** for the fake column name seems safer.
     */
     if( pItem->colUsed==0 ){
-      sqlite3AuthCheck(pParse, SQLITE_READ, pItem->zName, pItem->zDatabase, 0);
+      sqlite3AuthCheck(pParse, SQLITE_READ, pItem->zName, "", pItem->zDatabase);
     }
 
 #if !defined(SQLITE_OMIT_SUBQUERY) || !defined(SQLITE_OMIT_VIEW)

diff --git a/src/sqlite.h.in b/src/sqlite.h.in
index 2761ce66db3eae93438d1df9040de96cdc8610c2..74edcb56b51641bd8d682800afdfdc1b304b2e12 100644 (file)
--- a/src/sqlite.h.in
+++ b/src/sqlite.h.in
@@ -2714,7 +2714,7 @@ void sqlite3_randomness(int N, void *P);
 ** ^When a table is referenced by a [SELECT] but no column values are
 ** extracted from that table (for example in a query like
 ** "SELECT count(*) FROM tab") then the [SQLITE_READ] authorizer callback
-** is invoked once for that table with a NULL column name.
+** is invoked once for that table with a column name that is an empty string.
 ** ^If the action code is [SQLITE_DELETE] and the callback returns
 ** [SQLITE_IGNORE] then the [DELETE] operation proceeds but the
 ** [truncate optimization] is disabled and all rows are deleted individually.