Fix a faulty assert() in the validation logic for the LEFT JOIN strength

reduction optimization.  Problem found by OSSFuzz.

FossilOrigin-Name: 8694c3d565f6f8209e24230765efa476e10048abb69a300b9df5cbaa45824ab8

diff --git a/manifest b/manifest
index dc05a63af03386216db84daa46384ae4e545c26b..28485c04e69daf4f1a6007e78876455b2584dca9 100644 (file)
--- a/manifest
+++ b/manifest
@@ -1,5 +1,5 @@
-C Fix\sthe\s"sqlite3"\scommand\sin\sthe\sTCL\sinterface\sso\sthat\sit\scorrectly\sreturns\nan\serror\sif\sinvoked\swith\sno\sarguments.
-D 2018-09-24T19:21:46.752
+C Fix\sa\sfaulty\sassert()\sin\sthe\svalidation\slogic\sfor\sthe\sLEFT\sJOIN\sstrength\nreduction\soptimization.\s\sProblem\sfound\sby\sOSSFuzz.
+D 2018-09-24T19:32:16.510
 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
 F Makefile.in 6b650013511fd9d8b094203ac268af9220d292cc7d4e1bc9fbca15aacd8c7995
@@ -453,7 +453,7 @@ F src/date.c ebe1dc7c8a347117bb02570f1a931c62dd78f4a2b1b516f4837d45b7d6426957
 F src/dbpage.c 4aa7f26198934dbd002e69418220eae3dbc71b010bbac32bd78faf86b52ce6c3
 F src/dbstat.c edabb82611143727511a45ca0859b8cd037851ebe756ae3db289859dd18b6f91
 F src/delete.c 107e28d3ef8bd72fd11953374ca9107cd74e8b09c3ded076a6048742d26ce7d2
-F src/expr.c dad286e9fe4ffa9cc2dcbac069a3d8e1afa476d9ce58039a77e620aa64a6cfd6
+F src/expr.c d8da79a5cb19bbded56181337a221ead5f4ad3cbf0fbcb5da2156abefab566cd
 F src/fault.c 460f3e55994363812d9d60844b2a6de88826e007
 F src/fkey.c f59253c0be4b1e9dfcb073b6d6d6ab83090ae50c08b5c113b76013c4b157cd6a
 F src/func.c 7c288b4ce309b5a8b8473514b88e1f8e69a80134509a8c0db8e39c858e367e7f
@@ -964,7 +964,7 @@ F test/fuzzdata1.db 7ee3227bad0e7ccdeb08a9e6822916777073c664
 F test/fuzzdata2.db 128b3feeb78918d075c9b14b48610145a0dd4c8d6f1ca7c2870c7e425f5bf31f
 F test/fuzzdata3.db c6586d3e3cef0fbc18108f9bb649aa77bfc38aba
 F test/fuzzdata4.db b502c7d5498261715812dd8b3c2005bad08b3a26e6489414bd13926cd3e42ed2
-F test/fuzzdata5.db 7a3467a24e7112c1f1041ae9ad1e7060c2074da82d420ce786953cc3d3dd20b5
+F test/fuzzdata5.db e35f64af17ec48926481cfaf3b3855e436bd40d1cfe2d59a9474cb4b748a52a5
 F test/fuzzdata6.db 92a80e4afc172c24f662a10a612d188fb272de4a9bd19e017927c95f737de6d7
 F test/fuzzer1.test 3d4c4b7e547aba5e5511a2991e3e3d07166cfbb8
 F test/fuzzer2.test a85ef814ce071293bce1ad8dffa217cbbaad4c14
@@ -1765,8 +1765,8 @@ F vsixtest/vsixtest.tcl 6a9a6ab600c25a91a7acc6293828957a386a8a93
 F vsixtest/vsixtest.vcxproj.data 2ed517e100c66dc455b492e1a33350c1b20fbcdc
 F vsixtest/vsixtest.vcxproj.filters 37e51ffedcdb064aad6ff33b6148725226cd608e
 F vsixtest/vsixtest_TemporaryKey.pfx e5b1b036facdb453873e7084e1cae9102ccc67a0
-P 1c0ecbbdf1f309feaca747230d8925e61ddc6049a46c1dbbac7344bb933ab5e3
-Q +2034fa8089676132b5e2f71bdebf1af9ca141da2e173920c6e84fb974ab0f022
-R 368b2205d94094f5a24094ce454d1f87
+P 8a82fcf05fa84def1433489f71dc28b47c1e082d044512b8756ec1bb4b913fab
+Q +2fd62fccd13e326dbd7dd730112542c6faa56e466bf4f7b8e22ced543031280c
+R cd533f606a3f6ed5965d62855a238855
 U drh
-Z 5ca2558bc16a2fda1670c1acf4e7e8f3
+Z 567acba726ea34d997b341fee438cc18

diff --git a/manifest.uuid b/manifest.uuid
index c338a976ae80d0e767b405f8afb4566c48342f2e..4a0193422c12d527767ed880cf779c311156a63c 100644 (file)
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-8a82fcf05fa84def1433489f71dc28b47c1e082d044512b8756ec1bb4b913fab
\ No newline at end of file
+8694c3d565f6f8209e24230765efa476e10048abb69a300b9df5cbaa45824ab8
\ No newline at end of file

diff --git a/src/expr.c b/src/expr.c
index 634fd8ed7a99496eec3b14cd2ef3fb67241d9f95..3372feff332301b3d3c48e9ce79885203677e373 100644 (file)
--- a/src/expr.c
+++ b/src/expr.c
@@ -4846,18 +4846,15 @@ int sqlite3ExprImpliesExpr(Parse *pParse, Expr *pE1, Expr *pE2, int iTab){
 /*
 ** This is the Expr node callback for sqlite3ExprImpliesNotNullRow().
 ** If the expression node requires that the table at pWalker->iCur
-** have a non-NULL column, then set pWalker->eCode to 1 and abort.
+** have one or more non-NULL column, then set pWalker->eCode to 1 and abort.
+**
+** This routine controls an optimization.  False positives (setting
+** pWalker->eCode to 1 when it should not be) are deadly, but false-negatives
+** (never setting pWalker->eCode) is a harmless missed optimization.
 */
 static int impliesNotNullRow(Walker *pWalker, Expr *pExpr){
-  /* This routine is only called for WHERE clause expressions and so it
-  ** cannot have any TK_AGG_COLUMN entries because those are only found
-  ** in HAVING clauses.  We can get a TK_AGG_FUNCTION in a WHERE clause,
-  ** but that is an illegal construct and the query will be rejected at
-  ** a later stage of processing, so the TK_AGG_FUNCTION case does not
-  ** need to be considered here. */
-  assert( pExpr->op!=TK_AGG_COLUMN );
+  testcase( pExpr->op==TK_AGG_COLUMN );
   testcase( pExpr->op==TK_AGG_FUNCTION );
-
   if( ExprHasProperty(pExpr, EP_FromJoin) ) return WRC_Prune;
   switch( pExpr->op ){
     case TK_ISNOT:

diff --git a/test/fuzzdata5.db b/test/fuzzdata5.db
index bf63944a54afe2c929d2de0ec1771aedfef60fa3..cfb0ebe7d8cf01899814f38e21c30b62acd9184c 100644 (file)
Binary files a/test/fuzzdata5.db and b/test/fuzzdata5.db differ