SQLite

Check-in [498e3f1cf5]
Login

Many hyperlinks are disabled.
Use anonymous login to enable hyperlinks.

Overview
Comment:Add a typecast to avoid 32-bit integer overflow in the concat_ws() function with an enormous separator values and many arguments.
Downloads: Tarball | ZIP archive | SQL archive
Timelines: family | ancestors | descendants | both | trunk
Files: files | file ages | folders
SHA3-256: 498e3f1cf57f164fbd8380e92bf91b9f26d6aa05d092fcd135d754abf1e5b1b5
User & Date: drh 2025-02-16 10:57:25.604
Context
2025-02-18
18:05
Cherry pick recent fixes into branch-3.44. (check-in: 75bbd094db user: drh tags: branch-3.44)
2025-02-16
13:13
API naming typo reported in forum post 416f2d8dec. No functional changes. (check-in: 0cfb9e234e user: stephan tags: trunk)
11:23
Add a typecast to avoid 32-bit integer overflow in the concat_ws() function with an enormous separator values and many arguments. (check-in: cf6b162de5 user: drh tags: branch-3.49)
10:57
Add a typecast to avoid 32-bit integer overflow in the concat_ws() function with an enormous separator values and many arguments. (check-in: 498e3f1cf5 user: drh tags: trunk)
2025-02-15
17:29
Remove tea version check from tool/srctree-check.tcl, as it's obsoleted by [be265559]. (check-in: 1860ea060b user: stephan tags: trunk)
Changes
Unified Diff Ignore Whitespace Patch
Changes to src/func.c.
1566
1567
1568
1569
1570
1571
1572
1573
1574
1575
1576
1577
1578
1579
1580
){
  i64 j, k, n = 0;
  int i;
  char *z;
  for(i=0; i<argc; i++){
    n += sqlite3_value_bytes(argv[i]);
  }
  n += (argc-1)*nSep;
  z = sqlite3_malloc64(n+1);
  if( z==0 ){
    sqlite3_result_error_nomem(context);
    return;
  }
  j = 0;
  for(i=0; i<argc; i++){







|







1566
1567
1568
1569
1570
1571
1572
1573
1574
1575
1576
1577
1578
1579
1580
){
  i64 j, k, n = 0;
  int i;
  char *z;
  for(i=0; i<argc; i++){
    n += sqlite3_value_bytes(argv[i]);
  }
  n += (argc-1)*(i64)nSep;
  z = sqlite3_malloc64(n+1);
  if( z==0 ){
    sqlite3_result_error_nomem(context);
    return;
  }
  j = 0;
  for(i=0; i<argc; i++){