Do not allow recursion in extension functions sha1_query() or sha3_query().

[bugs:/info/2026-07-29T06:29:33Z|Bug 2026-07-29T06:29:33Z].

FossilOrigin-Name: 4687e04d948b787cee748279b13774ee1389bb179f8762720631a540f5cd9136

diff --git a/ext/misc/sha1.c b/ext/misc/sha1.c
index b70ace9fa1480b43b1892325cdd74190fb63d8f5..b50cf5e7b747546b28d6d0b7d2e30493d868b1d5 100644 (file)
--- a/ext/misc/sha1.c
+++ b/ext/misc/sha1.c
@@ -310,9 +310,17 @@ static void sha1QueryFunc(
   const char *z;
   SHA1Context cx;
   char zOut[44];
+  int isRecursive = 0;
+  int *pIsRecursive;
 
   assert( argc==1 );
   if( zSql==0 ) return;
+  pIsRecursive = sqlite3_get_clientdata(db, "sha1_query()");
+  if( pIsRecursive ){
+    *pIsRecursive = 1;
+    return;
+  }
+  sqlite3_set_clientdata(db, "sha1_query()", &isRecursive, 0);
   hash_init(&cx);
   while( zSql[0] ){
     rc = sqlite3_prepare_v2(db, zSql, -1, &pStmt, &zSql);
@@ -395,7 +403,12 @@ static void sha1QueryFunc(
     sqlite3_finalize(pStmt);
   }
   hash_finish(&cx, zOut, 0);
-  sqlite3_result_text(context, zOut, 40, SQLITE_TRANSIENT);
+  sqlite3_set_clientdata(db, "sha1_query()", &isRecursive, 0);
+  if( isRecursive ){
+    sqlite3_result_error(context, "recursive use of sha1_query()", -1);
+  }else{
+    sqlite3_result_text(context, zOut, 40, SQLITE_TRANSIENT);
+  }
 }
 
 

diff --git a/ext/misc/shathree.c b/ext/misc/shathree.c
index b08eb813e5160e61773b70814ec4939734e79556..f4f0a137280e530df525131b9347db11170456b4 100644 (file)
--- a/ext/misc/shathree.c
+++ b/ext/misc/shathree.c
@@ -722,6 +722,8 @@ static void sha3QueryFunc(
   const char *z;
   SHA3Context cx;
   int iSize;
+  int isRecursive = 0;
+  int *pIsRecursive;
 
   if( argc==1 ){
     iSize = 256;
@@ -735,6 +737,12 @@ static void sha3QueryFunc(
   }
   if( zSql==0 ) return;
   SHA3Init(&cx, iSize);
+  pIsRecursive = (int*)sqlite3_get_clientdata(db,"sha3_query()");
+  if( pIsRecursive ){
+    *pIsRecursive = 1;
+    return;
+  }
+  sqlite3_set_clientdata(db, "sha3_query()", &isRecursive, 0);
   while( zSql[0] ){
     rc = sqlite3_prepare_v2(db, zSql, -1, &pStmt, &zSql);
     if( rc ){
@@ -769,7 +777,12 @@ static void sha3QueryFunc(
     }
     sqlite3_finalize(pStmt);
   }
-  sqlite3_result_blob(context, SHA3Final(&cx), iSize/8, SQLITE_TRANSIENT);
+  sqlite3_set_clientdata(db, "sha3_query()", 0, 0);
+  if( isRecursive ){
+    sqlite3_result_error(context, "recursive use of sha3_query()", -1);
+  }else{
+    sqlite3_result_blob(context, SHA3Final(&cx), iSize/8, SQLITE_TRANSIENT);
+  }
 }
 
 /*

diff --git a/manifest b/manifest
index 481bcbf0f93f18de5c3e990b1f783de45cb5641d..fe05db45d80219c30b2e5c032105513ab3a81bff 100644 (file)
--- a/manifest
+++ b/manifest
@@ -1,5 +1,5 @@
-C Turn\sredundant\sloads\sof\sthe\sexperimental\svfsstat.c\sextension\sfrom\sa\nstack\soverflow\sinto\sa\sharmless\sno-op.\n[bugs:/info/2026-07-29T06:28:47Z|Bug\s2026-07-29T06:28:47Z].
-D 2026-07-29T17:19:00.751
+C Do\snot\sallow\srecursion\sin\sextension\sfunctions\ssha1_query()\sor\ssha3_query().\n[bugs:/info/2026-07-29T06:29:33Z|Bug\s2026-07-29T06:29:33Z].
+D 2026-07-29T17:36:16.031
 F .fossil-settings/binary-glob 61195414528fb3ea9693577e1980230d78a1f8b0a54c78cf1b9b24d0a409ed6a x
 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
@@ -397,8 +397,8 @@ F ext/misc/regexp.c 378e6e84516952a4b9f3f4df88927f20e6538e2609f55b773ed78899dab8
 F ext/misc/remember.c add730f0f7e7436cd15ea3fd6a90fd83c3f706ab44169f7f048438b7d6baa69c
 F ext/misc/rot13.c 51ac5f51e9d5fd811db58a9c23c628ad5f333c173f1fc53c8491a3603d38556c
 F ext/misc/series.c fd82b5c14849b861a299a316b0c63bfd69f7249601ee9bcc6fda2317fec0f821
-F ext/misc/sha1.c fe474ba3e4f9d8915cf58bc0a9e4c00a565a6523942136da56b01909e2ce0493
-F ext/misc/shathree.c fd22d70620f86a0467acfdd3acd8435d5cb54eb1e2d9ff36ae44e389826993df
+F ext/misc/sha1.c 5c8e36f618fe93751cdebf6d6730d9ecb132a45c6b26a43b11b83c1c54642fbc
+F ext/misc/shathree.c 6102b3edc273253eb2b189c5affa96b4ca674f668f2ae62b48527fb1f54fcce0
 F ext/misc/showauth.c 732578f0fe4ce42d577e1c86dc89dd14a006ab52
 F ext/misc/spellfix.c 9099bd2d8701d820904663242e470537e919826060042288e6bfafd3e406c9b4
 F ext/misc/sqlar.c 97c100b010159c08a7a9acd8eb1ea510a5522e64741aaafcd7b6c629de682edc
@@ -1625,7 +1625,7 @@ F test/selectH.test 0b54599f1917d99568c9b929df22ec6261ed7b6d2f02a46b5945ef81b787
 F test/session.test 78fa2365e93d3663a6e933f86e7afc395adf18be
 F test/sessionfuzz-data1.db 1f8d5def831f19b1c74571037f0d53a588ea49a6c4ca2a028fc0c27ef896dbcb
 F test/sessionfuzz.c 0ec813258fbfd222c62ba6867c6a5a015f098fcaa6d89e7e0ee623ea91145cf0
-F test/sha1.sql 5a4057dee1434144013567c8aecd2f996ec659398f04c61c0891ed1a3a8e20ac
+F test/sha1.sql 636e2e1234e7a4c426c87febac0637fd6552b9f3aeb38bf952aba1b673b7ef56
 F test/shared.test 50bd8091735b272732125928c363476a17b5fb264835de7d19e90c72055c888b
 F test/shared2.test 03eb4a8d372e290107d34b6ce1809919a698e879
 F test/shared3.test cb92d083003ddf0f313166e494ec2fcafa55fdebf648628923ded3169dba8850
@@ -2218,8 +2218,8 @@ F tool/warnings-clang.sh bbf6a1e685e534c92ec2bfba5b1745f34fb6f0bc2a362850723a9ee
 F tool/warnings.sh a554d13f6e5cf3760f041b87939e3d616ec6961859c3245e8ef701d1eafc2ca2
 F tool/win/sqlite.vsix deb315d026cc8400325c5863eef847784a219a2f
 F tool/winmain.c 00c8fb88e365c9017db14c73d3c78af62194d9644feaf60e220ab0f411f3604c
-P d6453bc80e6e717813f2f5d4a40548cbc25e83e09c209793cacfddb94a408053
-R 9c91171a65bf7daf2c758ba028357a79
+P add89fba2ffe9da5b0305182c97f8408e0dd7d2c3d81f40e0a84f6f79154c5a3
+R 4b73c8f6c7c8301ed17d2e85e6f236b9
 U drh
-Z b4c946a69b225985c58a95617dcfbcb1
+Z dea29c174681fe97f839f10198407f07
 # Remove this line to create a well-formed Fossil manifest.

diff --git a/manifest.uuid b/manifest.uuid
index 6291c33dfe53268995126b1dfa83f92e7f916db2..9a4a30ed5fac38b06d0dd95473a815a505b21d04 100644 (file)
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-add89fba2ffe9da5b0305182c97f8408e0dd7d2c3d81f40e0a84f6f79154c5a3
+4687e04d948b787cee748279b13774ee1389bb179f8762720631a540f5cd9136

diff --git a/test/sha1.sql b/test/sha1.sql
index adc3fe294f0c70a49d015a3209178b7f62d19877..56caebc42bd13c11a0a17b5577e4ea7d0b8cb5f5 100644 (file)
--- a/test/sha1.sql
+++ b/test/sha1.sql
@@ -32,3 +32,19 @@ SELECT sha1('');
 .testcase 150
 SELECT sha1(x'');
 .check da39a3ee5e6b4b0d3255bfef95601890afd80709
+
+.testcase 200
+CREATE TABLE t1(x TEXT);
+INSERT INTO t1 VALUES('SELECT sha1_query((SELECT x FROM t1))');
+.check ''
+.testcase 210
+SELECT sha1_query((SELECT x FROM t1));
+.check -glob '*recursive use of sha1_query()*'
+
+.testcase 300
+DELETE FROM t1;
+INSERT INTO t1 VALUES('SELECT sha3_query((SELECT x FROM t1))');
+.check ''
+.testcase 301
+SELECT sha3_query((SELECT x FROM t1));
+.check -glob '*recursive use of sha3_query()*'