From: drh <>
Date: Wed, 31 Mar 2021 17:49:52 +0000 (+0000)
Subject: When resolving column names in the RETURNING clause, do not ignore an
X-Git-Tag: version-3.35.4~3
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=378c763eb354b763109f3c9a6b65b07a33ccf321;p=thirdparty%2Fsqlite.git

When resolving column names in the RETURNING clause, do not ignore an
incorrect table name qualifier.  Raise an error instead.

FossilOrigin-Name: 3b916924cef383f3d395e1f10aed6584d22d39a26f3b3c9919bd1afc0db635aa
---

diff --git a/manifest b/manifest
index 10208f7a60..bd7a037643 100644
--- a/manifest
+++ b/manifest
@@ -1,5 +1,5 @@
-C Defer\sdeletion\sof\sexpressions\sthat\sare\soptimized\sout\sby\sthe\sAND\soptimizer\nin\sthe\ssqlite3ExprAnd()\sroutine\suntil\sthe\scorresponding\sParse\sobject\sis\ndeleted.\s\sThis\savoids\sa\sdangling\spointer\sin\sAggInfo\sif\ssqlite3ExprAnd()\nis\sinvoked\sby\sthe\spush-down\soptimization.\s\sThe\sdangling\spointer\sappears\nto\sbe\sharmless\sin\srelease\sbuilds,\sonly\sshowing\sup\sin\sdebug\sbuilds.\nProblem\sfound\sby\sdbsqlfuzz.
-D 2021-03-31T13:51:07.431
+C When\sresolving\scolumn\snames\sin\sthe\sRETURNING\sclause,\sdo\snot\signore\san\nincorrect\stable\sname\squalifier.\s\sRaise\san\serror\sinstead.
+D 2021-03-31T17:49:52.900
 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
 F LICENSE.md df5091916dbb40e6e9686186587125e1b2ff51f022cc334e886c19a0e9982724
@@ -540,7 +540,7 @@ F src/pragma.h 8dc78ab7e9ec6ce3ded8332810a2066f1ef6267e2e03cd7356ee00276125c6cf
 F src/prepare.c e21b54489b5c73b06ada15e6fc79b5c6f64b06701924a6ca98944ae59e06256f
 F src/printf.c 2b03a80d7c11bb422115dca175a18bf430e9c9dbaa0eee63b758f0c022f8f34f
 F src/random.c 80f5d666f23feb3e6665a6ce04c7197212a88384
-F src/resolve.c dd47248c2c914feb0d4428c27d782e2723971d32cfa5536f49306d080df4d45a
+F src/resolve.c 317086e685c7764e8e45626826b84a4fde7dcfce82543feb47143d633f355621
 F src/rowset.c ba9515a922af32abe1f7d39406b9d35730ed65efab9443dc5702693b60854c92
 F src/select.c 734cf12e42f81f2fe461e41214e6552375e55b62a802784a4f0066ac592e7f4a
 F src/shell.c.in aa28256887d049badaf93aa30ab5c76a2ec88143a674d685c0e739056702e5c3
@@ -1295,7 +1295,7 @@ F test/releasetest.tcl fb76d8fcc95ac29d6356cd9e52b726ab9e43a24082897618dfbcb7c2b
 F test/releasetest_data.tcl 3d41ddb3f04f474ac9d925485da24ce6576ff0ebc4c7201c8a340bc09846c261
 F test/resetdb.test 8062cf10a09d8c048f8de7711e94571c38b38168db0e5877ba7561789e5eeb2b
 F test/resolver01.test f4022acafda7f4d40eca94dbf16bc5fc4ac30ceb
-F test/returning1.test d0dfd079e5ff16402edd44f9b94b8cf7c912815f50699faa43096c5916f0abf1
+F test/returning1.test 8cee2d563f7b0fcd77cfaaa277805566fa0868e54dab299d44600e4e0a0b01df
 F test/rollback.test 06680159bc6746d0f26276e339e3ae2f951c64812468308838e0a3362d911eaa
 F test/rollback2.test bc868d57899dc6972e2b4483faae0e03365a0556941474eec487ae21d8d38bb6
 F test/rollbackfault.test 0e646aeab8840c399cfbfa43daab46fd609cf04a
@@ -1910,8 +1910,8 @@ F vsixtest/vsixtest.tcl 6a9a6ab600c25a91a7acc6293828957a386a8a93
 F vsixtest/vsixtest.vcxproj.data 2ed517e100c66dc455b492e1a33350c1b20fbcdc
 F vsixtest/vsixtest.vcxproj.filters 37e51ffedcdb064aad6ff33b6148725226cd608e
 F vsixtest/vsixtest_TemporaryKey.pfx e5b1b036facdb453873e7084e1cae9102ccc67a0
-P 2d179f58bfe21454bc1b11d5a9ae4e86148180f714076047824e145add5ca522
-Q +c36b43589abd9f62a709bdb47b8748e0c1e8743487a3d83d1eb35eb06b65d763
-R 5f7c6d536dc854ad405e7eae8091fa5f
+P 77a30f3f7a4094cf43d24f062f6fd5c5981268899f809ba068bb28287fc87839
+Q +51d5c50b2fb373e4c7ddb7e26657c26ad39dc9c2fc629bba5c2522b4150d8fac
+R c95f4a5567d1ff895225c476453fcc5f
 U drh
-Z 2ae60f02bd7b0544cd83f6d29679a5e8
+Z 2b95241ee49decf487cf2d2a9bf3f21e
diff --git a/manifest.uuid b/manifest.uuid
index 4f72032d88..c0f5e55322 100644
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-77a30f3f7a4094cf43d24f062f6fd5c5981268899f809ba068bb28287fc87839
\ No newline at end of file
+3b916924cef383f3d395e1f10aed6584d22d39a26f3b3c9919bd1afc0db635aa
\ No newline at end of file
diff --git a/src/resolve.c b/src/resolve.c
index ee75d2acb8..f2578abfff 100644
--- a/src/resolve.c
+++ b/src/resolve.c
@@ -376,15 +376,17 @@ static int lookupName(
       if( pParse->pTriggerTab!=0 ){
         int op = pParse->eTriggerOp;
         assert( op==TK_DELETE || op==TK_UPDATE || op==TK_INSERT );
-        if( op!=TK_DELETE && zTab && sqlite3StrICmp("new",zTab) == 0 ){
+        if( pParse->bReturning && (pNC->ncFlags & NC_UBaseReg)!=0 ){
+          if( zTab==0 || sqlite3StrICmp(zTab,pParse->pTriggerTab->zName)==0 ){
+            pExpr->iTable = op!=TK_DELETE;
+            pTab = pParse->pTriggerTab;
+          }
+        }else if( op!=TK_DELETE && zTab && sqlite3StrICmp("new",zTab) == 0 ){
           pExpr->iTable = 1;
           pTab = pParse->pTriggerTab;
         }else if( op!=TK_INSERT && zTab && sqlite3StrICmp("old",zTab)==0 ){
           pExpr->iTable = 0;
           pTab = pParse->pTriggerTab;
-        }else if( pParse->bReturning && (pNC->ncFlags & NC_UBaseReg)!=0 ){
-          pExpr->iTable = op!=TK_DELETE;
-          pTab = pParse->pTriggerTab;
         }
       }
 #endif /* SQLITE_OMIT_TRIGGER */
diff --git a/test/returning1.test b/test/returning1.test
index 92f20e2b74..6c12b68338 100644
--- a/test/returning1.test
+++ b/test/returning1.test
@@ -129,5 +129,43 @@ do_catchsql_test 6.1 {
   SELECT * FROM t1 ORDER BY id;
 } {0 {29 | 1 2 9 29}}
 
+# Forum https://sqlite.org/forum/forumpost/85aef8bc01
+# Do not silently ignore nonsense table names in the RETURNING clause.
+# Raise an error.
+#
+reset_db
+do_execsql_test 7.1 {
+  CREATE TABLE t1(a INT, b INT);
+  CREATE TABLE t2(x INT, y INT);
+  INSERT INTO t1(a,b) VALUES(1,2);
+  INSERT INTO t2(x,y) VALUES(1,30);
+} {}
+do_catchsql_test 7.2 {
+  UPDATE t1 SET b=b+1 RETURNING new.b;
+} {1 {no such column: new.b}}
+do_catchsql_test 7.3 {
+  UPDATE t1 SET b=b+1 RETURNING old.b;
+} {1 {no such column: old.b}}
+do_catchsql_test 7.4 {
+  UPDATE t1 SET b=b+1 RETURNING another.b;
+} {1 {no such column: another.b}}
+do_catchsql_test 7.5 {
+  UPDATE t1 SET b=b+y FROM t2 WHERE t2.x=t1.a RETURNING t2.x;
+} {1 {no such column: t2.x}}
+do_catchsql_test 7.6 {
+  UPDATE t1 SET b=b+y FROM t2 WHERE t2.x=t1.a RETURNING t1.b;
+} {0 32}
+
+# This is goofy:  The RETURNING clause does not honor the alias
+# for the table being modified.  This might change in the future.
+#
+do_catchsql_test 7.7 {
+  UPDATE t1 AS alias SET b=123 RETURNING alias.b;
+} {1 {no such column: alias.b}}
+do_catchsql_test 7.8 {
+  UPDATE t1 AS alias SET b=alias.b+1000 RETURNING t1.b;
+} {0 1032}
+
+
 finish_test