From 7d47517d579601bb6e59e33bf0896f0ed36aa0aa Mon Sep 17 00:00:00 2001 From: Ondrej Dubaj Date: Mon, 20 Jan 2020 09:34:41 +0100 Subject: [PATCH] Continue to back away from the LEFT JOIN optimization of check-in by disallowing query flattening if the outer query is DISTINCT. Without this fix, if an index scan is run on the table within the view on the right-hand side of the LEFT JOIN, stale result registers might be accessed yielding incorrect results, and/or an OP_IfNullRow opcode might be invoked on the un-opened table, resulting in a NULL-pointer dereference. This problem was found by the Yongheng and Rui fuzzer. --- src/select.c | 8 ++++++-- test/join.test | 13 +++++++++++++ 2 files changed, 19 insertions(+), 2 deletions(-) diff --git a/src/select.c b/src/select.c index c60ff27..0205a08 100644 --- a/src/select.c +++ b/src/select.c @@ -3569,6 +3569,7 @@ static void substSelect( ** (3b) the FROM clause of the subquery may not contain a virtual ** table and ** (3c) the outer query may not be an aggregate. +** (3d) the outer query may not be DISTINCT. ** ** (4) The subquery can not be DISTINCT. ** @@ -3765,8 +3766,11 @@ static int flattenSubquery( */ if( (pSubitem->fg.jointype & JT_OUTER)!=0 ){ isLeftJoin = 1; - if( pSubSrc->nSrc>1 || isAgg || IsVirtual(pSubSrc->a[0].pTab) ){ - /* (3a) (3c) (3b) */ + if( pSubSrc->nSrc>1 /* (3a) */ + || isAgg /* (3b) */ + || IsVirtual(pSubSrc->a[0].pTab) /* (3c) */ + || (p->selFlags & SF_Distinct)!=0 /* (3d) */ + ){ return 0; } } diff --git a/test/join.test b/test/join.test index 8c6f463..8c6a53d 100644 --- a/test/join.test +++ b/test/join.test @@ -844,4 +844,17 @@ do_execsql_test join-15.110 { ORDER BY a1, a2, a3, a4, a5; } {1 {} {} {} {} 1 11 {} {} {} 1 12 {} {} {} 1 12 121 {} {} 1 13 {} {} {}} +# 2019-12-18 problem with a LEFT JOIN where the RHS is a view. +# Detected by Yongheng and Rui. +# Follows from the optimization attempt of check-in 41c27bc0ff1d3135 +# on 2017-04-18 +# +reset_db +do_execsql_test join-22.10 { + CREATE TABLE t0(a, b); + CREATE INDEX t0a ON t0(a); + INSERT INTO t0 VALUES(10,10),(10,11),(10,12); + SELECT DISTINCT c FROM t0 LEFT JOIN (SELECT a+1 AS c FROM t0) ORDER BY c ; +} {11} + finish_test -- 2.19.1