summaryrefslogtreecommitdiffstats
path: root/src/3rdparty/sqlite/patches/0003-sqlite-Fix-CVE-2020-11656.patch
blob: c5ceb0a00c169f7a72f632f2a51cfb2b67e4867d (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
From 99cdbed3bb5368ae2ec80d15635a2dd57961310c Mon Sep 17 00:00:00 2001
From: Andy Shaw <andy.shaw@qt.io>
Date: Mon, 20 Apr 2020 10:49:57 +0200
Subject: [PATCH] sqlite: Fix CVE-2020-11656

This was taken from d09f8c3621d5f7f8 and b64674919f673602 in SQLite,
ref: https://www3.sqlite.org/cgi/src/info/d09f8c3621d5f7f8
https://www.sqlite.org/cgi/src/info/b64674919f673602

[ChangeLog][QtSQL][sqlite] Fixed CVE-2020-11656

Fixes: QTBUG-83652
Change-Id: I99bd59dc10b753ff19822c902dff1fc339d330a8
---
 src/3rdparty/sqlite/sqlite3.c | 18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

diff --git a/src/3rdparty/sqlite/sqlite3.c b/src/3rdparty/sqlite/sqlite3.c
index 054be43d95..6ff9ba42aa 100644
--- a/src/3rdparty/sqlite/sqlite3.c
+++ b/src/3rdparty/sqlite/sqlite3.c
@@ -97945,7 +97945,7 @@ static int resolveOrderByTermToExprList(
   nc.nErr = 0;
   db = pParse->db;
   savedSuppErr = db->suppressErr;
-  db->suppressErr = 1;
+  if( IN_RENAME_OBJECT==0 ) db->suppressErr = 1;
   rc = sqlite3ResolveExprNames(&nc, pE);
   db->suppressErr = savedSuppErr;
   if( rc ) return 0;
@@ -105383,6 +105383,21 @@ static void renameWalkWith(Walker *pWalker, Select *pSelect){
   }
 }
 
+/*
+** Unmap all tokens in the IdList object passed as the second argument.
+*/
+static void unmapColumnIdlistNames(
+  Parse *pParse,
+  IdList *pIdList
+){
+  if( pIdList ){
+    int ii;
+    for(ii=0; ii<pIdList->nId; ii++){
+      sqlite3RenameTokenRemap(pParse, 0, (void*)pIdList->a[ii].zName);
+    }
+  }
+}
+      
 /*
 ** Walker callback used by sqlite3RenameExprUnmap().
 */
@@ -105404,6 +105419,7 @@ static int renameUnmapSelectCb(Walker *pWalker, Select *p){
     for(i=0; i<pSrc->nSrc; i++){
       sqlite3RenameTokenRemap(pParse, 0, (void*)pSrc->a[i].zName);
       if( sqlite3WalkExpr(pWalker, pSrc->a[i].pOn) ) return WRC_Abort;
+      unmapColumnIdlistNames(pParse, pSrc->a[i].pUsing);
     }
   }
 
-- 
2.24.2 (Apple Git-127)