deps: SQLite: cherry-pick b869ed6b067d623cb1383549f2a18aa35508385d · nodejs/node@4ec1423 · GitHub

nodejs / node Public

• Notifications You must be signed in to change notification settings
• Fork 36.6k
• Star 120k

• Code
• Issues 635
• Pull requests 755
• Actions
• Projects
• Security and quality
• Insights

Additional navigation options

Commit 4ec1423

Browse filesBrowse the repository at this point in the historyBrowse files

junius-sec

authored and

sxa

committed

deps: SQLite: cherry-pick b869ed6b067d623cb1383549f2a18aa35508385d

Original commit message: Fix a bug causing the session module to dereference a NULL pointer when applying a corrupt changeset. FossilOrigin-Name: e807d4e3798efd532b3d78d1dfe513ed4fbd3cb793dd0ae5c30cae6031422b10 Refs: https://sqlite.org/src/info/e807d4e3798efd53 Signed-off-by: junius-sec <sksch323@naver.com> PR-URL: #63525 Refs: https://hackerone.com/reports/3736889 Refs: sqlite/sqlite@b869ed6 Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com> Reviewed-By: Chemi Atlow <chemi@atlow.co.il>

1 parent 12c5154 commit 4ec1423
Copy full SHA for 4ec1423

2 files changed

+22-1Lines changed: 22 additions & 1 deletion

File tree

Expand file treeCollapse file tree

Open diff view settings

Filter options

• deps/sqlite
  • sqlite3.c
• test/parallel
  • test-sqlite-session.js

Expand file treeCollapse file tree

Open diff view settings

Collapse file

‎deps/sqlite/sqlite3.c‎

Copy file name to clipboardExpand all lines: deps/sqlite/sqlite3.c

+1-1Lines changed: 1 addition & 1 deletion

Original file line number	Diff line number	Diff line change
@@ -238388,7 +238388,7 @@ static int sessionApplyOneOp(
238388	238388	for(i=0; rc==SQLITE_OK && i<nCol; i++){
238389	238389	sqlite3_value *pOld = sessionChangesetOld(pIter, i);
238390	238390	sqlite3_value *pNew = sessionChangesetNew(pIter, i);
238391		- if( p->abPK[i] || (bPatchset==0 && pOld) ){
	238391	+ if( pOld && (p->abPK[i] || bPatchset==0) ){
238392	238392	rc = sessionBindValue(pUp, i*2+2, pOld);
238393	238393	}
238394	238394	if( rc==SQLITE_OK && pNew ){

Collapse file

‎test/parallel/test-sqlite-session.js‎

Copy file name to clipboardExpand all lines: test/parallel/test-sqlite-session.js

+21Lines changed: 21 additions & 0 deletions

Original file line number	Diff line number	Diff line change
@@ -496,6 +496,27 @@ test('database.applyChangeset() - wrong arguments', (t) => {
496	496	});
497	497	});
498	498
	499	+ test('database.applyChangeset() - malformed changeset returns SQLITE_CORRUPT', {
	500	+ skip: process.config.variables.node_shared_sqlite ?
	501	+ 'requires the bundled SQLite session fix' : false,
	502	+ }, (t) => {
	503	+ const database = new DatabaseSync(':memory:');
	504	+ database.exec('CREATE TABLE t1(a INTEGER PRIMARY KEY, b, c, d)');
	505	+
	506	+ const changeset = Buffer.from(
	507	+ '540401000000743100177e0072286565286565',
	508	+ 'hex');
	509	+
	510	+ t.assert.throws(() => {
	511	+ database.applyChangeset(changeset);
	512	+ }, {
	513	+ name: 'Error',
	514	+ message: 'database disk image is malformed',
	515	+ errcode: 11,
	516	+ code: 'ERR_SQLITE_ERROR',
	517	+ });
	518	+ });
	519	+
499	520	test('session.patchset()', (t) => {
500	521	const database = new DatabaseSync(':memory:');
501	522	database.exec('CREATE TABLE data(key INTEGER PRIMARY KEY, value TEXT)');

0 commit comments

Comments

0 (0)