We encounter a crash when testing SQLite3. The testing query generates one binary file to the file system, then reads the binary file and triggers the crash.

Since I cannot upload the binary file to the forum, I place them into our Google Drive. The PoC binary file is in: link. The PoC query that reads the binary file and triggers the crash is in: link.

Additionally, we also upload the whole PoC query that generates the binary file and then crash the SQLite process. The complete PoC query is placed in: link.

Here is some debug information for the crash. The stack trace is:

#0  0x0000000000000000 in ?? ()
#1  0x0000000000479720 in sqlite3OsUnfetch (id=0x6aba90, iOff=0x0, p=0x0) at sqlite3.c:24924
#2  0x00000000004915c6 in sqlite3PagerSharedLock (pPager=0x6ab910) at sqlite3.c:60480
#3  0x000000000049007e in lockBtree (pBt=0x6a7200) at sqlite3.c:71232
#4  0x000000000044f5d5 in sqlite3BtreeBeginTrans (p=0x6ab3d0, wrflag=0x0, pSchemaVersion=0x7fffffff8704) at sqlite3.c:71624
#5  0x00000000004abcf5 in sqlite3VdbeExec (p=0x6b8f30) at sqlite3.c:93504
#6  0x00000000004556dd in sqlite3Step (p=0x6b8f30) at sqlite3.c:87967
#7  0x000000000044cf57 in sqlite3_step (pStmt=0x6b8f30) at sqlite3.c:88028
#8  0x000000000045d474 in sqlite3_exec (db=0x6a8a20, zSql=0x612738 "SELECT 1 FROM sqlite_schema", xCallback=0x0, pArg=0x0, pzErrMsg=0x0) at sqlite3.c:130963
#9  0x000000000042d74e in recoverExec (p=0x6aeac0, db=0x6a8a20, zSql=0x612738 "SELECT 1 FROM sqlite_schema") at shell.c:13112
#10 0x0000000000408f84 in recoverStep (p=0x6aeac0) at shell.c:15138
#11 0x0000000000408e1a in sqlite3_recover_step (p=0x6aeac0) at shell.c:15364
#12 0x0000000000409205 in sqlite3_recover_run (p=0x6aeac0) at shell.c:15376
#13 0x0000000000436516 in recoverDatabaseCmd (pState=0x7fffffffc7c0, nArg=0x1, azArg=0x7fffffffc410) at shell.c:21689
#14 0x000000000040e322 in do_meta_command (zLine=0x6a67f0 ".r", p=0x7fffffffc7c0) at shell.c:22297
#15 0x0000000000419cef in process_input (p=0x7fffffffc7c0) at shell.c:25462
#16 0x000000000040b9b7 in main (argc=0x1, argv=0x7fffffffdde8) at shell.c:26349
#17 0x00007ffff7ba5083 in __libc_start_main (main=0x409a90 <main>, argc=0x1, argv=0x7fffffffdde8, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>,
    stack_end=0x7fffffffddd8) at ../csu/libc-start.c:308
#18 0x000000000040377e in _start ()

When compiled with UBSAN, the sanitizer outputs the following error:

UndefinedBehaviorSanitizer:DEADLYSIGNAL
==3255061==ERROR: UndefinedBehaviorSanitizer: SEGV on unknown address 0x000000000000 (pc 0x000000000000 bp 0x7ffedf2a94e0 sp 0x7ffedf2a94a8 T3255061)
==3255061==Hint: pc points to the zero page.
==3255061==The signal is caused by a READ memory access.
==3255061==Hint: address points to the zero page.
    #0 0x0  (<unknown module>)
    #1 0x41f2fa in __sanitizer::HandleDeadlySignal(void*, void*, unsigned int, void (*)(__sanitizer::SignalContext const&, void const*, __sanitizer::BufferedStackTrace*), void const*) (/home/luy70/Desktop/sqlite_source_fossil/sqlite/sqlite3+0x41f2fa)
    #2 0x7f68485cd41f  (/lib/x86_64-linux-gnu/libpthread.so.0+0x1441f)

UndefinedBehaviorSanitizer can not provide additional info.
SUMMARY: UndefinedBehaviorSanitizer: SEGV (<unknown module>)
==3255061==ABORTING

The bisecting results:

bisect complete
  1 BAD     2022-10-30 11:39:47 7660db2a2e9c4f3a
  9 BAD     2022-10-26 21:14:21 346a3b12b861ce7b
 13 BAD     2022-10-26 18:41:12 a820792548da596e
 14 GOOD    2022-10-26 18:04:34 4eef562a00ae988f CURRENT
 12 GOOD    2022-10-26 15:40:17 3b5aa50c223ac35c
 11 GOOD    2022-10-26 11:11:31 3dfdfb3f12edb3f4
 10 GOOD    2022-10-25 08:41:00 9c8df130b8137cb4
  8 GOOD    2022-10-20 21:28:31 9d034ef5e1bab7c9
  7 GOOD    2022-09-30 20:59:09 aa367a3c97404132
  6 GOOD    2022-07-11 14:36:03 44d77a7f807f5dc3
  5 GOOD    2022-04-07 14:03:07 5043a3507e078187
  4 GOOD    2021-10-05 18:33:38 a7835bead85b1b18
  3 GOOD    2020-06-15 14:38:57 d31fd57ea5386682
  2 GOOD    2018-05-14 00:41:12 d0f35739af3b226c

Please let us know if you need more debug information. Thank you. :-)

In case the developers didn't notice the report, here is a gentle reminder.

Is there any updates on the reported problem? Please let us know if you need further information.

Hi developers.

I just tested the PoC on the latest version of SQLite3 (7660db2a2e), the problem is still reproducible. In case the developers didn't notice this bug report, here is a gentle reminder.

Thank you for the hard work!