From ad9f515f52f5a73130fefd056fe2a43daa42ef4b Mon Sep 17 00:00:00 2001 From: drh Date: Thu, 9 Aug 2018 21:45:45 +0000 Subject: [PATCH] Fix the isLikeOrGlob() routine in the WHERE clause processing logic so that it avoids signed/unsigned character comparisons, as that can lead to an incorrect answer if the ESCAPE clause is an invalid UTF8 string. Problem found by OSSFuzz. FossilOrigin-Name: 4195a3f8b5d2c2ec63771890c5aa7b5e2de60b9fa2273652730239b8577ae418 --- manifest | 14 +++++++------- manifest.uuid | 2 +- src/whereexpr.c | 8 ++++---- test/fuzzdata5.db | Bin 7196672 -> 7196672 bytes 4 files changed, 12 insertions(+), 12 deletions(-) diff --git a/manifest b/manifest index 2ebf291cb5..778efc0056 100644 --- a/manifest +++ b/manifest @@ -1,5 +1,5 @@ -C When\sa\scolumn\smust\sbe\sa\sconstant\sdue\sto\sWHERE\sclause\sand\sthe\svalue\sof\sthat\ncolumn\sis\sbeing\scoded\sas\sa\sconstant,\smake\ssure\sthe\saffinity\sis\scorrect. -D 2018-08-09T18:36:54.837 +C Fix\sthe\sisLikeOrGlob()\sroutine\sin\sthe\sWHERE\sclause\sprocessing\slogic\sso\sthat\nit\savoids\ssigned/unsigned\scharacter\scomparisons,\sas\sthat\scan\slead\sto\san\nincorrect\sanswer\sif\sthe\sESCAPE\sclause\sis\san\sinvalid\sUTF8\sstring.\s\sProblem\nfound\sby\sOSSFuzz. +D 2018-08-09T21:45:45.368 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea F Makefile.in 0a3a6c81e6fcb969ff9106e882f0a08547014ba463cb6beca4c4efaecc924ee6 @@ -586,7 +586,7 @@ F src/walker.c ba7225773931760cf60bf22f34d0cce2588df7ce5ce0f215a52eb88234b55ac4 F src/where.c 155809967fbab889374dedf970ea6561b8fb519fcb165d6ba00776552ecc5cde F src/whereInt.h b90ef9b9707ef750eab2a7a080c48fb4900315033274689def32d0cf5a81ebe4 F src/wherecode.c 2b6cd1b27736cc803060289e04ecf9849976106f4077aa67d1a2c0e3ec420159 -F src/whereexpr.c dc34f0df69418dedb4619f7ad61b7d31f447971223540b957a1b836a62c0ce7b +F src/whereexpr.c 5a57a974aeadef4443b39bd44594fdf0c884b62a4c72286de880999018df8317 F src/window.c 4b503da928dace3e845b891381a4d98eeb8c5744313ae3643df8d8d21fdcca65 F test/8_3_names.test ebbb5cd36741350040fd28b432ceadf495be25b2 F test/affinity2.test a6d901b436328bd67a79b41bb0ac2663918fe3bd @@ -955,7 +955,7 @@ F test/fuzzdata1.db 7ee3227bad0e7ccdeb08a9e6822916777073c664 F test/fuzzdata2.db 128b3feeb78918d075c9b14b48610145a0dd4c8d6f1ca7c2870c7e425f5bf31f F test/fuzzdata3.db c6586d3e3cef0fbc18108f9bb649aa77bfc38aba F test/fuzzdata4.db b502c7d5498261715812dd8b3c2005bad08b3a26e6489414bd13926cd3e42ed2 -F test/fuzzdata5.db 5e8394be0245224340c26fc592746dd560479b0dcb12d4b43edf2c612848e748 +F test/fuzzdata5.db 3e7a403c9daea38f104410842b3b0761ad3706056df066e71c96399c17adf0a6 F test/fuzzdata6.db 92a80e4afc172c24f662a10a612d188fb272de4a9bd19e017927c95f737de6d7 F test/fuzzer1.test 3d4c4b7e547aba5e5511a2991e3e3d07166cfbb8 F test/fuzzer2.test a85ef814ce071293bce1ad8dffa217cbbaad4c14 @@ -1754,7 +1754,7 @@ F vsixtest/vsixtest.tcl 6a9a6ab600c25a91a7acc6293828957a386a8a93 F vsixtest/vsixtest.vcxproj.data 2ed517e100c66dc455b492e1a33350c1b20fbcdc F vsixtest/vsixtest.vcxproj.filters 37e51ffedcdb064aad6ff33b6148725226cd608e F vsixtest/vsixtest_TemporaryKey.pfx e5b1b036facdb453873e7084e1cae9102ccc67a0 -P 60bbca2b9a591800cd8e7b374e62d75b1df0e8fd2d2f71f9b4d5fd044da78be0 -R ef663a1df8c5f6cbefbb7dcd86b83b66 +P 7404ea83168e6c739ebe8fc5d65bbf0265432ccb35b3418bb0381d74362f7527 +R ead5801a282cafcaccf5c2894c10f6f8 U drh -Z 68dbd529c4e95246b96ffd22fa0b508e +Z 01aec118d9103a512fac51295e82f6a7 diff --git a/manifest.uuid b/manifest.uuid index e0abbb9304..90e55c90a4 100644 --- a/manifest.uuid +++ b/manifest.uuid @@ -1 +1 @@ -7404ea83168e6c739ebe8fc5d65bbf0265432ccb35b3418bb0381d74362f7527 \ No newline at end of file +4195a3f8b5d2c2ec63771890c5aa7b5e2de60b9fa2273652730239b8577ae418 \ No newline at end of file diff --git a/src/whereexpr.c b/src/whereexpr.c index 752a0842c0..a72c94f2db 100644 --- a/src/whereexpr.c +++ b/src/whereexpr.c @@ -194,18 +194,18 @@ static int isLikeOrGlob( int *pisComplete, /* True if the only wildcard is % in the last character */ int *pnoCase /* True if uppercase is equivalent to lowercase */ ){ - const u8 *z = 0; /* String on RHS of LIKE operator */ + const u8 *z = 0; /* String on RHS of LIKE operator */ Expr *pRight, *pLeft; /* Right and left size of LIKE operator */ ExprList *pList; /* List of operands to the LIKE operator */ - int c; /* One character in z[] */ + u8 c; /* One character in z[] */ int cnt; /* Number of non-wildcard prefix characters */ - char wc[4]; /* Wildcard characters */ + u8 wc[4]; /* Wildcard characters */ sqlite3 *db = pParse->db; /* Database connection */ sqlite3_value *pVal = 0; int op; /* Opcode of pRight */ int rc; /* Result code to return */ - if( !sqlite3IsLikeFunction(db, pExpr, pnoCase, wc) ){ + if( !sqlite3IsLikeFunction(db, pExpr, pnoCase, (char*)wc) ){ return 0; } #ifdef SQLITE_EBCDIC diff --git a/test/fuzzdata5.db b/test/fuzzdata5.db index f111a43b95a6a2f9ca7abee1f5c2148f868d2e48..021bed7166148b708a7262cda877832d24ec1e6a 100644 GIT binary patch delta 6271 zc-pO4d3Y4ZmG7GA)`>I-NsJDJMk5IwGm>TymkuNiXg~)#5r|tQ#HCUfNFWXgBq2c= zC$Yg`o96_~VeDW#iNQFbHx9O8y6rfh!NFe~JDas*$Jrd;#tC*dhuJ08z8={UB)k7@ ze>1=7`n~t6>b<&N&Hgi*bw7R|N{-Kyq~u;{;+cY98O}zQxsEonG2g0=~Y z@o5)yy`UX}ZV+^%pqm8U{5`rwOlfb&*hc6SF+^X9sOZZPWxWN_sy8EA^aezt*C9%J ztt2Il>NSX;>kAQY>lKKf>1BwY=<^Z3ug^jJ7kw7u3%dKzqS!6??bH^2-a zb(Q5a%cGVSOP(dg5=nkdu96GnYowQ~CrxCM^h0SMDg~d#fecu+hE8J*RWDJ^P^3n^P>X}tCYUfzr??=#nJ9wKWYo4TBXbhB6l<{Fx@H@e8H@4U)$_! zUOC$AOADmH3u{^WtZ5S!v}Aj8oPlJkRQm<7q`KCh?L6yr&vhf_IGwFk{${_^sr`B_ z`!_4e)vmR(*@WakX$Q-Lj1Fce+2(sC$%5eymPBU2$qqJ+WSU-N!UuZ`Ltxq)o2DJ# zz|Ihtc6I~1AQQLN)X8jClCQO^Y^6oXlOUV5mKOi+{1ojQD(~0{gI|h3asp4lVP-*rE6I`*(IWQW$9p(DY9#S*~Mx} zR>^pLoQ`(q3{Om;*ed0G;qYK_V~LOY<^_si^Bz`0=E1o=>>!y7*?p`!Zq7t#dp-CW z-Wiw;qL2NJ%z}Y_)<6oi8~yBlLh2xYfK7#)2iO!C+=l^J0w?yd#Y(L#4adXjeXKmp znd@BQTo9-+H7g-+fH~oj0hSKiO~V@ltbiWkdo9B+JJ9q|3k-mumx zdA|^%z#YUKuPv}13AA7$7{=T2(kydaGvuv^)T87yy zvJAd5%rZy|JU5K8rSRS`bCYHWA3?GS@<-Tzkw(Zlz-p8Rj9H`^=L|S`fTbw)SdJMl z+u`;B_O^$OH|}zIOI@>UfzG=ad_Mce%)k~|`fleK2i~tS2T)^ktmY9cl#tCZ?><&R zHbLKgIO8|M%lEN$Q#Oo8HTU0NeD|H%fey$&#O9Lqu;~!XCGBwZ5G#_YRqBDX-HGwq zuMV*tlawx5I@}7U&aw{Zeu8b+Jdd(h6-C9ln>fxM1J4N-bNnRxJK@^rC)o*^Y=du{ zWm}c4vUF%iP)|d>7orljPdHNUa+Ny{)CYP{C(YEU(Dq(r4-%#OE~86qorMsX{5|G@ z(eE;wMVHKiPZ^S>hn7Oqt86;F^8MUU*!w;7bP%rMk1~KkO)+IjkbaqYqV{1~8EZ8! z8;*udjf39H%$d7)yfb;(9{2M(ae@Bv4asD@IYn-qylVq}aP=~4BYVK1vDu-!tx^Lj z!RTc+Jt;1*Yr@9SzJ3SpRA^Hb*a?qltR}X1q78?`yK$y1utWP)V`(x`p!_vlRv-V6 zML@+BHi^ilXG!qE5k3iaTw%$?svWt)&RGQ=32=$Mk3J2(&R!!!uJPWLKjj z@sfrG$Yf72i<%qivTb_Sy^O=A&zN9*^_9hs+4RhNm^@@MhVG$U7_RgQrYILX6sjwl_E#`1K_Hib^sK8r*I#Yv8!5Ee6$@N6( z@#Br>d-5?9aT7)!*F4uen;xru`UWeSJa^W(WYBz2w{U_%=ghe|^KJ%bVv+8J_V@6F z^T6Zpu_96c@4m-M$c_u+G#iM47aCEnC-q^OIvwvey6t3f$n>Z$l*73AWU)EUZYw?dIEP7F} zP4&x(fZd;W50ma0e!pLzt4IfauzQTnUhZ3>J$0q)RH{-YOP|lz-ukF3oxrx=&J2N5 zKbW}`Qr8zQ&_aIE)oxKLWa%r5O@&EB+w;q=7DCFk8y|Ij6hjtj7ysN#e^PK5dh zoQhOKwLjhI>XJ#FwvMRnge=jnTGXi)xE`VY6sTQ|0d7%iLzgu-AK0$fYtbQUrUg$y zRNf00!qng3QFtRleHtE$RO4Z3gxUv>hO5uO9UI|gtq054A&qk^*DJ^&eq?!%y zHZ4~{bgZf$k5=a?OHmLzF4zjLD0K=%+tg6_W0*Qu+ip`&6J{~4hJRHs{Lg15PSt)pL%o(3(ymCu4|HmDt$NY|H`l41u-~m#Yj4=DPE;-i&t|m+E_SGO$1hY?fag->BJIv*wUZ3(#_K_ku@kY|XhrNa z8WFb`e#Fg23F1bh7;%F!8?nR4M_g~X5ZjGhL~7(9wi(%oYm6C)tBrKTRfZFBg^`B1 z+?bBI%t%ITF_I9M8i|NahJ6Ts8jY!l4Msd-oe_svW5gmZHt@!n>^EW%7aEfheTEIO z#E3@p8j*+vMhIfQp&+^q8PR1}5pxX-VwQoIk>nY=*-EB9h?t@8LrmBAB0BYcX-G;= z)BCXC(9KAs>bnr9>st|1^iISiy#p~pUym58|G!_mhW_#1g?LFvzmqQN=u^^jIzjwS zU_0V7fo+IS2RP#SfQtCdKo{Z@0fu-s(1v&>fDI>|4&cBgoeJP}Ea~xp2k~S82QKME zz^wlp0UW-huLp4WlB|yfGPDg{YK0Q@p zY5|<+QR6XV#CN~4L6#m1HK$k;T)a^}875y?7!7A0sqE5zx?Md*>{}<6&I149>iR03 z2d@!ld(}K}^m4m(fv&<^y=o=g>{Ux)|5kr!n8?tXEPb^O(sni{0^R1HseNmwdfg)L zLR+}DN1YQ@R^o63m&dS0-w7}8Q3brTM{R~j`_w{thp84bq9#E2Hxm<};)p#yq*%wi zaxV-EHGk5$af#joP5tV8(hW!Y)f%!*`+2{*$U=5&X#?uVGU&X>XW$m^7~c0Mtc*E5zTi2$ zFKCGms^5~8L31^0NQ4o%b*?20h7R-8un}3utn^^ic@&V#kEr>C3~5+<4ACl%tBIBn zL&Az0OuGW2b@wLp63uc#eJPw+OtrTy3X!F=q0qzmCKx@hR$y{i@w7Tu#z#7A#v@hR z-;`Rq{*PI6rT~*I1 zbB@Lt;Xy{3g|A`e>p3%5dpOUm?rrUku0EAPqQ{KN;MDKbbK#{AL>rTEvZQJ4Kl4Rf zv^&37Ka7`c$Y|}o3Dc0U@=!&YEK4W2sq$xJBKe;}NQ`!C3O}GIQ)KCs&6EhMb|;yi z57W+h_!_G=n#G?CQ{rUlJDH}m1*L`D8%p9Kzl8r;nJP<1%1yx*D;z23KT+)HW{_B5 z)t*_%56UFb3?H$8V_QN44A$_2O2S>Cspb7j657~Jo7+U|t>-UVNU~}35z%6n@(iL( zm!+fjvA~~c;j)tQMK*!<)H zaN$B?G+c-*O996u606EL-?4JI)*Yn9=Jxkq>n zCX*vacnK-cUOvKa5TzJ5kyg0&aoIHZ_EBCdW2QGSUJM7vF&>W#0&9$g>SKH^nG3_m zcr9j{H;(aDic%s=r!&EKnkT}ukMRtx^D+L0HJE0l!L^foC)_-VvjxEkS0Cq5VZ$K? z=2#;!rf|gCV=RQ5kMkYM0_;Vo$$3q+5Ewee!_5Ch`pl~1;mj$XPAXu&+06T=xJxd# zN}Xe(1NCuJBJiep{jcvly}&3lbt<9sGXxcWD<-X&X4JvjC;0TtC05DaTIH`&LX29g6x&**L>ZWGreQ+6%)iuu zZF!7pIP(NABvtVC6Z|Au3_a)g*uOxnrW20i=P+CsPjVZ+#F!q*K+o~$%TMz31kwr_ zSJ0j1P<4f8WG=&#!|Z}%V>WkpyZdZL%RNj^-x6af9KFKpF@gN>3XX4+*7Oojvyz># z<0{W4y>Rj>pPRkIDkTrzDIvE$DG4#~42Z?EKicTQM80pdZuE;M*XV}-zRKMh+mPRr zRqxBlaWrS=?FljP0E^uz2h%z=~wAMuU>U~RAuJT938Jnz9!RjyjP+h;Y#qX=k84fcx z;!KEN-RxfoX#q~5`*K<&3H-TWr63F*VYkYLTZ(D7ql1W7;Ui6MACA4r*CAO9bv-8TdP delta 6218 zc-pO4dstN0wLg3299{||0uG?a@DhgMF(bZUP#6V8kcT`(MPMTuWOKHH;sX>AbVt*s z5;bw9(fEi>)ASLIZ9HvC6PZ_=jeBlo*auSsv4CimKK*BKJf-h2PM z^TBV<`K`6~UTf{w+H>%{W<7}ikIatAl%(0c($pss|7Ex^ZJFzMjZ89!sh~tqi=b9P zWkD4|g9Hs0G(^x)LBj-{Cg^lQ!v&2H)F$W*K_dm7DQJ|S(SpVZI!jQyps|9+2^ufx zY(eJ;njq+0K@$aa2%02lvY;t~rV5%S=sZEw1?f_em< zFKC{i3j|##=psQE3%W$md_fBY^$J=j=u$zK30fp*v7kOdmkYW=&=NsQ1zjoVDnZKx zT`g$2pcR6y5wud!DnY9Str2vsptXY530f~`gP`jKZ4`99pc@3;C}@+Qn*?nZv_;TX zK`}pVf^HVHUC=FpZWZ(aK|5Zc+r-Q^in$HbTM>iw^@xhzfGF#Ah*o_qqD8MlB>Eae zNiUbA_;GzT;%EAD#834i#8334h#%^Oh(FL5B7R@bL;SApId!OT8uAl3|dD)~2!z79~rTgbhCIVgCxx z>|iIATv>Xs72fP;QSg2@I|{{nS*Z5gZWcmFj`l$h`-4UC$kNeirb+^AXlFBEyql$H z>ATq#qPS)0@LE%3*Z#VPRgm<8$xxFWZOQZ8k^X$EQ(7z*0anm5&avT(SzjKY;mK34b48X-X-ohn^Zl z;nG2tDVJEK27HTwgM%zmUSX9=@hy6q)9KCfWMp~L{mbEdgUm^M@T)Ld0PY5y^%Sx;A zvph~1KFI8F@F0_`H(4dm=Tekp1<>iS`I{!23-HKnyr0Rk`8V9hIMMy}@biP{ek1(- zAj>A}z%|S=NCVUlvjwCc9va3;T?fw%qpTL*9%fl&ErgCBSpzvE>_160I1jOMr3#Za z&CGEsoH@i2luCS$oP4*#r-#@rcjsj1E|;g!wZP`zb`OJ}Po9|X?~tYMbxv^L`7(0= zH9Dd+w_w49JOE1`WW{7F^gW2!khRQgpG<4!?_PZC_Co(=$T`9mlQwwZ2+JfC zjvrz9a;sJ9fuy~0G1_mBuwBy?CQHW};p_$04&6_&otpbG_KKo(;k=ETWKV$mG>bfS zhW(wW+Gl6jX_;(?CoZt<3YVoLy8?O|>U}pnwr47kBA2Vkaj44QjXFuDPO-NCGW!Zq zcHCohg|%3~_5$<3`1hF2;va$;FEF1nC`*sj!P-~YTzL5hnZdCC1&nh5uHlz*08^S^ z%HkpADszYL$9H9-&+H619yBW&dattN%>GGNvNPOS&pV_2eUrP2$#|UkSvYr_{rlkB zRn|)Of17rS zFQW#&;&xi|GHyL@yvUr|uU}?m^6JQ`E{n1}*+n*e#{JA9n{K<8ac8@2dc+iyXX@1G z;m~ccTCl#tvf+-wqRF%g2V2Jwmb`)B1J;h=JamlMJ@D=;tc8S_ zF&045t1KPP|CkLcL8w(Zp|$c=HUcxpa4Y`!Ro0}qWCvg!W47a%Qdy80@Hugc$;%7q%)N)1A7B!u7&9!4VvbcB`hvn` zQsfBN@kmRWWH5;MNuz@NLQkQ`rpMjG;Er2w(_^QY1zD*c)Ui)7o`U%Ws55Jl$;r?4 zFBwa!O54eyP@rEJkE0A$+uZP$$_`tW`)t&lWKUvRvotCJ0A&TgTScU7h_~1ENqJ57@W~QG||1 zYf3{+iLbtNqR`Nn1o~9JmQ1+=LWsk$>x=L|$!``rxCj%RC`2FFL(kFN5bk=_-j@gZyMWxbe+2G7Ewe+-TlT~m{%2nr`{p;V7$bT5ivKB3 zKXtdO)+_;zVKoz`J_={2slnQx?{;;`WR2EB)HXsYv}+c1mW5Qo%`o*AP`erl+@e+l zH`LZ1+NoD+5kYF21rI({-w&5U)IY$DF!fn@WSSZSbzy2Bsn*c)38K{D7N2PLv)5GH z2oX`Lekwv;qST@wYErNrT;b|Wh_I=_@b4k&Vr{2QJx7!Vbicw>Y6Kps{#2>I&uF8D zt>swAdRQ8x^618?TzQj|vmJ+*>+7_aV$>@Uq*d!lRWaQykULMcLt$NQDEw$gNicLb ztMS1r_2$6gTr|)bbLv}bBjBLlDMO)4je>WcD-40|d1@-u%u|y|lWCs>kK*%eEG1lD zbmyITz=UrIB>efbxLMl!^VI7}K~#~3AMVs>vwFq?Z?veLa4<_fC}yPM53#cZXUJm)q6KQkX-Jx# zr0>HQhi+yfQQwU?SLcWc`ZmOPeKTUL-i8>Z|G(dohW_!Igm^{AxZ^MD7*qUnI^J>P zzvJ&geAd4m@f&^>@fm*?;@ABQ@hN{N;st*T;(0%I9DmM_0~deR??HUhpNn|Lj{_Hf z+Hbc1gdc}5{;Pf*zIf~7{uFIXms+gI+sqx~;ZdFnH@ekm(gDBeR=rpcCiJLPaJffy z!|5J121~-{d(={;U6vjXHYeCxxO}r{2F$p$A_C4oTGFNc(@ym)vGb|5v%GZG>Z&qb z4crkf^s3q5=;e0na=i=Q>{Uw$GrzoWaC>QRh)C5tW$8eTX5@$(3!z_+i-qD*drVM) zj@9FS7#3>I^htZK-VJN})um(yjP|SLWV`mues!gV?9q}2)DL8`4H=-aA@yTI`rz8vaQ)@xYaoZlL^&L|ytjd77sx{OIA#mqneFzL4EL{kO9?l9If=%Y4S)-lIHk-Sp-PP5nQ%U%Q(K1w-9(W8bd^p0GhEpd= zYx{*S!lK>%qxx=)9D$71)*Cwq2`dj)6q_ua=BCPDkeSB+97JYlcV_ZKiV`VHXKkiL zShc&e`7tD^21tqU~@Mk;X5w<{^8yZ_K66u)KP zudyB66{g+j=W_|v+_ujMD+;XikvwCbcC(*HSe1-GsBiZ3xPV52HfxB-T8PtJG0AXw z)NVJI%?$0sVeThpDX|Z(9O45cQ*$5Yc3H+6ZZ(`e&h1c~S05}7FEg@$ALZAH>;G&a zO>6x!W&&%wn zS<4JJEFR_MSWk|OaxclzUK-^$iIR_7N+VqVVA&k__HkYzW3e|d`5Fq26Fi12Hk*xt z)hGC3TpGhCc!k#XFpnkL?@sa+vQi*R=hDD;j>o|_ALprB=i~gR)5lb=`)*-f%9j1 z3Mqo6W;gGg0KEHlyx7#@V;VsDBrwP(CC$WYCP$~{h_3o5R27oKE$uXA5Z zCmL)i?e(oF%T6wxo@_JB-(aSQ>B+%HhgFK%6xI|LZaje5+7#xi@~zphu{12&*lLw> zo4)X2byZz`sjtL29Aa$2*$~rITe*9QpR|sc1PzR2kkKrQa@aOjr*YH>1e#=yvB1)aDwY6T#((`^FQJ9<+uUND#jjS z96*mh{>At&#`BE*R*Bz%?XUA$F!OajoAg7@>wF0wz#Xsi@}PZ~8xm+a6WV{q^CA9c PJT3?i?n4Pv?34cuLNg|{ -- 2.47.3