Ticket Hash: | 33aa4c0de8a62e3397bd58ce4182942939e78aea | ||
Title: | Heap buffer overflow on SQL input | ||
Status: | Fixed | Type: | Code_Defect |
Severity: | Severe | Priority: | High |
Subsystem: | Utilities | Resolution: | Fixed |
Last Modified: |
2023-03-20 01:33:28 2.12 years ago |
Created: |
2023-03-16 20:23:50 2.13 years ago |
Version Found In: | 3.41.1 |
User Comments: | ||||
drh added on 2023-03-16 20:23:50:
This is test3.sql from forum post d24ec63447:
drh added on 2023-03-17 00:44:22: Unable to recreate the problem using ASAN or Valgrind. Possible an instrumentation error on the part of the original reporter. The reported instrumentation puts the problem in the CLI, not the core SQLite library, on the main input buffer. A few extra bytes of space are now added on the end of that buffer as a safety margin. drh added on 2023-03-19 23:38:49: Reopened The problem is that the sqlite3_error_offset() routine is returning a valid that is out-of-range for its input. Two errors: First, the sqlite3_error_offset() is returning an out-of-range value. Second, the CLI code that uses sqlite3_error_offset() is failing to properly deal with the out-of-range return value. Reproducible test case (run under valgrind):
|