From: drh <drh@noemail.net>
Date: Mon, 6 May 2013 13:22:50 +0000 (+0000)
Subject: Make sure the authorizer callback gets a valid pointer to "ROWID" for the
X-Git-Tag: version-3.7.17~32
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=2722898c6ce4298d7564277e9aad18ff7aa14dad;p=thirdparty%2Fsqlite.git

Make sure the authorizer callback gets a valid pointer to "ROWID" for the
column-name parameter when doing an UPDATE that changes the rowid.
Fix for ticket [0eb70d77cb05bb2272].

FossilOrigin-Name: 26a59bb88d4082758eb281b365b57f9a0c059d89
---

diff --git a/manifest b/manifest
index 94a31dd226..2e943a7503 100644
--- a/manifest
+++ b/manifest
@@ -1,5 +1,5 @@
-C Add\smagic\snumbers\sfor\sBentley\sSystems\sapplication\sfiles.
-D 2013-05-03T20:08:16.683
+C Make\ssure\sthe\sauthorizer\scallback\sgets\sa\svalid\spointer\sto\s"ROWID"\sfor\sthe\ncolumn-name\sparameter\swhen\sdoing\san\sUPDATE\sthat\schanges\sthe\srowid.\nFix\sfor\sticket\s[0eb70d77cb05bb2272].
+D 2013-05-06T13:22:50.843
 F Makefile.arm-wince-mingw32ce-gcc d6df77f1f48d690bd73162294bbba7f59507c72f
 F Makefile.in ce81671efd6223d19d4c8c6b88ac2c4134427111
 F Makefile.linux-gcc 91d710bdc4998cb015f39edf3cb314ec4f4d7e23
@@ -247,7 +247,7 @@ F src/test_vfstrace.c 34b544e80ba7fb77be15395a609c669df2e660a2
 F src/test_wsd.c 41cadfd9d97fe8e3e4e44f61a4a8ccd6f7ca8fe9
 F src/tokenize.c 1e86210d3976717a19238ea7b047fac481fe8c12
 F src/trigger.c cd95ac64efa60e39faf9b5597443192ff27a22fa
-F src/update.c a2a5631d618cbe240fc83725fa9e95c56ae0084c
+F src/update.c 4c0c6864c4349ba292042e984a56d15985b57f4e
 F src/utf.c 8d819e2e5104a430fc2005f018db14347c95a38f
 F src/util.c f566b5138099a2df8533b190d0dcc74b7dfbe0c9
 F src/vacuum.c ddf21cc9577c4cb459d08bee9863a78ec000c5bb
@@ -293,7 +293,7 @@ F test/attach2.test e54436ed956d3d88bdee61221da59bf3935a0966
 F test/attach3.test d89ccfe4fe6e2b5e368d480fcdfe4b496c54cf4e
 F test/attach4.test 53bf502f17647c6d6c5add46dda6bac8b6f4665c
 F test/attachmalloc.test 3a4bfca9545bfe906a8d2e622de10fbac5b711b0
-F test/auth.test 1b21145e888130d60a03db0cb829d59df8f29266
+F test/auth.test 4a4c3b034fff7750513520defa910f376c96ab49
 F test/auth2.test a2a371aa6df15f8b0c8109b33d3d7f0f73e4c9aa
 F test/auth3.test a4755e6a2a2fea547ffe63c874eb569e60a28eb5
 F test/autoinc.test bd30d372d00045252f6c2e41b5f41455e1975acf
@@ -1061,7 +1061,7 @@ F tool/vdbe-compress.tcl f12c884766bd14277f4fcedcae07078011717381
 F tool/warnings-clang.sh f6aa929dc20ef1f856af04a730772f59283631d4
 F tool/warnings.sh fbc018d67fd7395f440c28f33ef0f94420226381
 F tool/win/sqlite.vsix 97894c2790eda7b5bce3cc79cb2a8ec2fde9b3ac
-P b2efe4f225adc5f4c2e3080bf459cc52fff82e18
-R 0b688f16fe96205d735d9d6969fa7bcb
+P 9314b08099e7ac99a507a4799f2c6cdd6d597abb
+R 838a83e273da8f276170acdb509d4aac
 U drh
-Z b278f2182b5b0ccf50dbdcca9690db25
+Z be0fc56bce8babfb180ef06d811f28d4
diff --git a/manifest.uuid b/manifest.uuid
index 8169773910..1c3879a604 100644
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-9314b08099e7ac99a507a4799f2c6cdd6d597abb
\ No newline at end of file
+26a59bb88d4082758eb281b365b57f9a0c059d89
\ No newline at end of file
diff --git a/src/update.c b/src/update.c
index 1125e5971a..3ab1ab2a4b 100644
--- a/src/update.c
+++ b/src/update.c
@@ -208,6 +208,7 @@ void sqlite3Update(
     }
     if( j>=pTab->nCol ){
       if( sqlite3IsRowid(pChanges->a[i].zName) ){
+        j = -1;
         chngRowid = 1;
         pRowidExpr = pChanges->a[i].pExpr;
       }else{
@@ -220,7 +221,8 @@ void sqlite3Update(
     {
       int rc;
       rc = sqlite3AuthCheck(pParse, SQLITE_UPDATE, pTab->zName,
-                           pTab->aCol[j].zName, db->aDb[iDb].zName);
+                            j<0 ? "ROWID" : pTab->aCol[j].zName,
+                            db->aDb[iDb].zName);
       if( rc==SQLITE_DENY ){
         goto update_cleanup;
       }else if( rc==SQLITE_IGNORE ){
diff --git a/test/auth.test b/test/auth.test
index 190b490003..fd402b1d9e 100644
--- a/test/auth.test
+++ b/test/auth.test
@@ -2368,6 +2368,29 @@ ifcapable trigger {
   } {1}
 }
 
+# Ticket [0eb70d77cb05bb22720]:  Invalid pointer passsed to the authorizer
+# callback when updating a ROWID.
+#
+do_test auth-6.1 {
+  execsql {
+    CREATE TABLE t6(a,b,c,d,e,f,g,h);
+    INSERT INTO t6 VALUES(1,2,3,4,5,6,7,8);
+  }
+} {}
+set ::authargs [list]
+proc auth {args} {
+  eval lappend ::authargs $args
+  return SQLITE_OK
+}
+do_test auth-6.2 {
+  execsql {UPDATE t6 SET rowID=rowID+100}
+  set ::authargs
+} [list SQLITE_READ   t6 ROWID main {} \
+        SQLITE_UPDATE t6 ROWID main {} \
+]
+do_test auth-6.3 {
+  execsql {SELECT rowid, * FROM t6}
+} {101 1 2 3 4 5 6 7 8}
 
 rename proc {}
 rename proc_real proc