Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Appearance settings

Commit 4ec1423

Browse filesBrowse files
junius-secsxa
authored andcommitted
deps: SQLite: cherry-pick b869ed6b067d623cb1383549f2a18aa35508385d
Original commit message: Fix a bug causing the session module to dereference a NULL pointer when applying a corrupt changeset. FossilOrigin-Name: e807d4e3798efd532b3d78d1dfe513ed4fbd3cb793dd0ae5c30cae6031422b10 Refs: https://sqlite.org/src/info/e807d4e3798efd53 Signed-off-by: junius-sec <sksch323@naver.com> PR-URL: #63525 Refs: https://hackerone.com/reports/3736889 Refs: sqlite/sqlite@b869ed6 Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com> Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
1 parent 12c5154 commit 4ec1423
Copy full SHA for 4ec1423

2 files changed

+22-1Lines changed: 22 additions & 1 deletion

File tree

Expand file treeCollapse file tree
Open diff view settings
Filter options
Expand file treeCollapse file tree
Open diff view settings
Collapse file

‎deps/sqlite/sqlite3.c‎

Copy file name to clipboardExpand all lines: deps/sqlite/sqlite3.c
+1-1Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -238388,7 +238388,7 @@ static int sessionApplyOneOp(
238388238388
for(i=0; rc==SQLITE_OK && i<nCol; i++){
238389238389
sqlite3_value *pOld = sessionChangesetOld(pIter, i);
238390238390
sqlite3_value *pNew = sessionChangesetNew(pIter, i);
238391-
if( p->abPK[i] || (bPatchset==0 && pOld) ){
238391+
if( pOld && (p->abPK[i] || bPatchset==0) ){
238392238392
rc = sessionBindValue(pUp, i*2+2, pOld);
238393238393
}
238394238394
if( rc==SQLITE_OK && pNew ){
Collapse file

‎test/parallel/test-sqlite-session.js‎

Copy file name to clipboardExpand all lines: test/parallel/test-sqlite-session.js
+21Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -496,6 +496,27 @@ test('database.applyChangeset() - wrong arguments', (t) => {
496496
});
497497
});
498498

499+
test('database.applyChangeset() - malformed changeset returns SQLITE_CORRUPT', {
500+
skip: process.config.variables.node_shared_sqlite ?
501+
'requires the bundled SQLite session fix' : false,
502+
}, (t) => {
503+
const database = new DatabaseSync(':memory:');
504+
database.exec('CREATE TABLE t1(a INTEGER PRIMARY KEY, b, c, d)');
505+
506+
const changeset = Buffer.from(
507+
'540401000000743100177e0072286565286565',
508+
'hex');
509+
510+
t.assert.throws(() => {
511+
database.applyChangeset(changeset);
512+
}, {
513+
name: 'Error',
514+
message: 'database disk image is malformed',
515+
errcode: 11,
516+
code: 'ERR_SQLITE_ERROR',
517+
});
518+
});
519+
499520
test('session.patchset()', (t) => {
500521
const database = new DatabaseSync(':memory:');
501522
database.exec('CREATE TABLE data(key INTEGER PRIMARY KEY, value TEXT)');

0 commit comments

Comments
0 (0)
Morty Proxy This is a proxified and sanitized view of the page, visit original site.