SQLite User Forum

A testcase causing SEGV in sqlite3WindowRewrite
Login

A testcase causing SEGV in sqlite3WindowRewrite

(1) By Jingzhou Fu (fuboat) on 2022-03-10 15:33:08 [source]

System Information:

compile-time options: CC=clang-12 ./configure --enable-debug (can also be triggered in release version)
sqlite_source_id: 2022-03-10 11:48:16 4173819cd285a1c133645eda27b9f6dc5a2247eaa0c834bdc60058ef3109b102

PoC:

CREATE TABLE t7(x);
PRAGMA writable_schema=ON;
UPDATE sqlite_master SET sql='CREATE TABLE b AS SELECT
    sum(a) OVER win,
    min(a) OV FROM t1
  WINDOW win AS (ORDER BY a)';
CREATE TABLE t1(a);
CREATE TABLE x(y);
ALTER TABLE x RENAME y TO sqlsim0;

output when enable ASAN:

AddressSanitizer:DEADLYSIGNAL
=================================================================
==127348==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000004 (pc 0x556923fda076 bp 0x7ffecbb7acb0 sp 0x7ffecbb7ab30 T0)
==127348==The signal is caused by a READ memory access.
==127348==Hint: address points to the zero page.
    #0 0x556923fda075 in sqlite3WindowRewrite /root/bld_debug_asan/sqlite3.c:159441
    #1 0x556923f6655d in sqlite3Select /root/bld_debug_asan/sqlite3.c:140846
    #2 0x556923eefc4c in sqlite3EndTable /root/bld_debug_asan/sqlite3.c:116949
    #3 0x556923fe8906 in yy_reduce /root/bld_debug_asan/sqlite3.c:165153
    #4 0x556923ff8368 in sqlite3Parser /root/bld_debug_asan/sqlite3.c:166761
    #5 0x556923ffdc25 in sqlite3RunParser /root/bld_debug_asan/sqlite3.c:168059
    #6 0x556923ecbbe4 in renameParseSql /root/bld_debug_asan/sqlite3.c:110177
    #7 0x556923ed1b2b in renameTableTest /root/bld_debug_asan/sqlite3.c:111025
    #8 0x556923e77826 in sqlite3VdbeExec /root/bld_debug_asan/sqlite3.c:95772
    #9 0x556923e37ac1 in sqlite3Step /root/bld_debug_asan/sqlite3.c:85948
    #10 0x556923e38305 in sqlite3_step /root/bld_debug_asan/sqlite3.c:86005
    #11 0x556923d0852f in exec_prepared_stmt /root/bld_debug_asan/shell.c:14648
    #12 0x556923d0a653 in shell_exec /root/bld_debug_asan/shell.c:14969
    #13 0x556923d342c6 in runOneSqlLine /root/bld_debug_asan/shell.c:22502
    #14 0x556923d34f8c in process_input /root/bld_debug_asan/shell.c:22630
    #15 0x556923d38700 in main /root/bld_debug_asan/shell.c:23464
    #16 0x7f6030a520b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x240b2)
    #17 0x556923ccc0ad in _start (/root/bin_debug_asan/usr/local/bin/sqlite3+0xd00ad)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /root/bld_debug_asan/sqlite3.c:159441 in sqlite3WindowRewrite
==127348==ABORTING

(2) By Richard Hipp (drh) on 2022-03-10 16:29:24 in reply to 1 [link] [source]