| Andrew Geissler | 4b740dc | 2020-05-05 08:54:39 -0500 | [diff] [blame^] | 1 | From a4601326d61bf1a11151ac6b78b50804bfd03b4d Mon Sep 17 00:00:00 2001 |
| 2 | From: Sakib Sajal <sakib.sajal@windriver.com> |
| 3 | Date: Thu, 30 Apr 2020 10:46:16 -0700 |
| 4 | Subject: [PATCH 2/2] In the event of a semantic error in an aggregate query, |
| 5 | early-out the resetAccumulator() function to prevent problems due to |
| 6 | incomplete or incorrect initialization of the AggInfo object. Fix for ticket |
| 7 | [af4556bb5c285c08]. |
| 8 | |
| 9 | FossilOrigin-Name: 4a302b42c7bf5e11ddb5522ca999f74aba397d3a7eb91b1844bb02852f772441 |
| 10 | Upstream Status: Backport [c415d91007e1680e4eb17def583b202c3c83c718] |
| 11 | |
| 12 | CVE: CVE-2020-11655 |
| 13 | Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com> |
| 14 | --- |
| 15 | sqlite3.c | 1 + |
| 16 | 1 file changed, 1 insertion(+) |
| 17 | |
| 18 | diff --git a/sqlite3.c b/sqlite3.c |
| 19 | index 1df6633..726adf7 100644 |
| 20 | --- a/sqlite3.c |
| 21 | +++ b/sqlite3.c |
| 22 | @@ -133242,6 +133242,7 @@ static void resetAccumulator(Parse *pParse, AggInfo *pAggInfo){ |
| 23 | struct AggInfo_func *pFunc; |
| 24 | int nReg = pAggInfo->nFunc + pAggInfo->nColumn; |
| 25 | if( nReg==0 ) return; |
| 26 | + if( pParse->nErr ) return; |
| 27 | #ifdef SQLITE_DEBUG |
| 28 | /* Verify that all AggInfo registers are within the range specified by |
| 29 | ** AggInfo.mnReg..AggInfo.mxReg */ |
| 30 | -- |
| 31 | 2.17.1 |
| 32 | |