[sqlite] Assertion Bug in Sqlite

2019-12-29 Thread Yongheng Chen
Hi, We found an assertion bug in Sqlite. Here’s the PoC: — CREATE TABLE v0 ( v1 ) ; CREATE TABLE v2 ( v3 INTEGER UNIQUE ON CONFLICT ABORT ) ; CREATE TRIGGER x AFTER INSERT ON v2 WHEN ( ( SELECT v1 AS PROMO_REVENUE FROM v2 JOIN v0 USING ( VALUE ) ) AND 0 ) BEGIN DELETE FROM v2 ; END ; CREATE

[sqlite] Assertion Bug in sqlite

2019-12-27 Thread Yongheng Chen
Hi, There’s one bug that triggers assertion failed in sqlite: — CREATE TABLE v0 ( v1 ) ; CREATE TABLE v2 ( v3 VARCHAR(1) UNIQUE ) ; SELECT * FROM v0 WHERE v1 IN ( 'AIR' ) GROUP BY v1 , v1 ; CREATE INDEX v4 ON v0 ( v1 , v1 , v1 , v1 , v1 , v1 , v1 , v1 , v1 , v1 , v1 , v1 , v1 , v1 , v1 )