SQLite User Forum

SQLite crashes when running SQL function `shell_int32`
Login

SQLite crashes when running SQL function `shell_int32`

(1) By Yu Liang (LY1598773890) on 2023-03-24 21:17:50 [source]

The latest trunk version of SQLite (fossil commit: d8259877ea, unreleased) and released version 3.41.2 of SQLite crash when executing the following query:

SELECT 'abc' WHERE shell_int32(0, 555776303);

Here is the crash stack trace from version 3.41.2:

(gdb) bt
#0  0x0000aaaaaaaeb480 in shellInt32 (context=0xaaaaaad77b00, argc=2, argv=0xaaaaaad77b30) at shell.c:20266
#1  0x0000aaaaaab8c7cc in sqlite3VdbeExec (p=0xaaaaaad762d0) at sqlite3.c:98675
#2  0x0000aaaaaab724a0 in sqlite3Step (p=0xaaaaaad762d0) at sqlite3.c:88491
#3  0x0000aaaaaab7288c in sqlite3_step (pStmt=0xaaaaaad762d0) at sqlite3.c:88552
#4  0x0000aaaaaaae8984 in exec_prepared_stmt (pArg=0xffffffffdd08, pStmt=0xaaaaaad762d0) at shell.c:19011
#5  0x0000aaaaaaae9794 in shell_exec (pArg=0xffffffffdd08, zSql=0xaaaaaad680e0 "SELECT 'abc' WHERE shell_int32(0, 555776303); ", pzErrMsg=0xffffffffd3e0) at shell.c:19328
#6  0x0000aaaaaaafd008 in runOneSqlLine (p=0xffffffffdd08, zSql=0xaaaaaad680e0 "SELECT 'abc' WHERE shell_int32(0, 555776303); ", in=0xfffff7e3b8d0 <_IO_2_1_stdin_>,
    startline=1) at shell.c:26447
#7  0x0000aaaaaaafd71c in process_input (p=0xffffffffdd08) at shell.c:26613
#8  0x0000aaaaaaaff738 in main (argc=1, argv=0xfffffffff378) at shell.c:27507

I am not able to trace the crash to its introducing commit, and the crash can be reproduced in commits before Jun 14, 2019 (tested earliest commit with 23e49f9984, didn't test versions before).

(2) By Yu Liang (LY1598773890) on 2023-03-25 04:54:05 in reply to 1 [link] [source]

It seems that the bug has been patched by link (fossil commit: 62114711), and then further more throughly patched by commit: link (fossil commit: 74d14900). The mentioned SQL function from the PoC has been removed. Thank you for the super quick patch.