SQLite

The ALTER TABLE statement in the following SQL causes an out-of-bounds memory access:

CREATE TABLE t1(x);
CREATE VIEW t2 AS SELECT 1 FROM t1, (t1 AS a0, t1);
ALTER TABLE t1 RENAME TO t3;

This problem was discovered and reported by sakura(@eternalsakura13) of Alpha Team, Qihoo 360

The OOB memory access occurs inside the renameTokenCheckAll() procedure, which is a debugging procedure that only exists for debugging builds. It is unclear whether or not this problem exists in release builds.

The test case shown above is indeed harmless for release builds. However, Sakura provides another more complex test case (not shown here) that does cause an OOB memory access on release builds due to the two-size lookaside memory allocator added in version 3.31.0. It is the same problem in both cases, and is fixed by check-in [c431b3fd8fd0f6a6].