FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

sqlite: check null returns from sqlite value functions by ndossche · Pull Request #63288 · nodejs/node · GitHub

/ node Public

sqlite: check null returns from sqlite value functions - #63288

Merged
nodejs-github-bot merged 1 commit into
nodejs:mainfrom
ndossche:clesss-6
Aug 9, 2026
ConversationCommits (1)ChecksFiles changed
Merged

sqlite: check null returns from sqlite value functions#63288
nodejs-github-bot merged 1 commit into
nodejs:mainfrom
ndossche:clesss-6

Conversation

ndossche commented May 13, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

sqlite3_column_text() can return nullptr on failure which was not handled. sqlite3_column_blob() can return nullptr for zero-length BLOBs, which is then passed to memcpy() which is UB. Avoid this by checking for a nullptr.

Note: this was found by a static-dynamic analyser I'm developing.

nodejs-github-bot commented May 13, 2026

Copy link
Copy Markdown
Collaborator

Review requested:

  • @nodejs/sqlite

nodejs-github-bot added c++ Issues and PRs that require attention from people who are familiar with C++. needs-ci PRs that need a full CI run. sqlite Issues and PRs related to the SQLite subsystem. labels May 13, 2026

codecov Bot commented May 13, 2026 •
edited
Loading

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90.29%. Comparing base (85d4755) to head (02db86a).
⚠️ Report is 34 commits behind head on main.

Additional details and impacted files 
@@            Coverage Diff             @@
##             main   #63288      +/-   ##
==========================================
- Coverage   90.30%   90.29%   -0.01%     
==========================================
  Files         759      759              
  Lines      247754   247754              
  Branches    46716    46720       +4     
==========================================
- Hits       223724   223719       -5     
- Misses      15483    15512      +29     
+ Partials     8547     8523      -24
Files with missing lines Coverage Δ
src/node_sqlite.cc 80.84% <ø> (ø)

... and 38 files with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

trivikr commented Aug 6, 2026

Copy link
Copy Markdown
Member

@ndossche Can you please rebase and force push?

sqlite: check null returns from sqlite value functions
02db86a 
sqlite3_column_text() can return nullptr on failure which
was not handled.
sqlite3_column_blob() can return nullptr for zero-length BLOBs,
which is then passed to memcpy() which is UB.
Avoid this by checking for a nullptr.

Signed-off-by: ndossche <nora.dossche@ugent.be>

ndossche commented Aug 6, 2026

Copy link
Copy Markdown
Contributor Author

Done, CI (so far) is looking okay

trivikr commented Aug 6, 2026

Copy link
Copy Markdown
Member

Can you add some regression tests? Ones which fail in main, but succeed with the fix?

ndossche commented Aug 6, 2026

Copy link
Copy Markdown
Contributor Author

Can you add some regression tests? Ones which fail in main, but succeed with the fix?

Apparently the current test suite can already trigger the "UB blob" problem, but the test runner ignores UBSAN failures, so you never see this as a failure.
Compile node.js with ubsan, and then set the environment variable export UBSAN_OPTIONS='print_stacktrace=1:halt_on_error=1' and then run: ./tools/test.py test/parallel/test-sqlite-data-types.js
This will show the failed test and crash backtrace.

As for the allocation failure in SQLITE_TEXT, I don't think I can make a reliable reproducer.

trivikr added the request-ci Add this label to start a Jenkins CI on a PR. label Aug 7, 2026
github-actions Bot removed the request-ci Add this label to start a Jenkins CI on a PR. label Aug 7, 2026

This comment was marked as outdated.

Sign in to view

This comment was marked as outdated.

Sign in to view

nodejs-github-bot commented Aug 8, 2026

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/75632/

trivikr added author ready PRs that have at least one approval, no outstanding review comments, and a CI started. commit-queue Add this label to land a pull request using GitHub Actions. labels Aug 8, 2026
nodejs-github-bot removed the commit-queue Add this label to land a pull request using GitHub Actions. label Aug 9, 2026
nodejs-github-bot merged commit 330f7b5 into nodejs:main Aug 9, 2026
75 of 77 checks passed

nodejs-github-bot commented Aug 9, 2026

Copy link
Copy Markdown
Collaborator

Landed in 330f7b5

aduh95 pushed a commit that referenced this pull request Aug 13, 2026
sqlite: check null returns from sqlite value functions
5fa764f 
sqlite3_column_text() can return nullptr on failure which
was not handled.
sqlite3_column_blob() can return nullptr for zero-length BLOBs,
which is then passed to memcpy() which is UB.
Avoid this by checking for a nullptr.

Signed-off-by: ndossche <nora.dossche@ugent.be>
PR-URL: #63288
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
aduh95 pushed a commit that referenced this pull request Aug 25, 2026
sqlite: check null returns from sqlite value functions
5a852b2 
sqlite3_column_text() can return nullptr on failure which
was not handled.
sqlite3_column_blob() can return nullptr for zero-length BLOBs,
which is then passed to memcpy() which is UB.
Avoid this by checking for a nullptr.

Signed-off-by: ndossche <nora.dossche@ugent.be>
PR-URL: #63288
Reviewed-By: Trivikram Kamat <trivikr.dev@gmail.com>
github-actions Bot mentioned this pull request Aug 25, 2026
Open
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Show hidden characters
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

trivikr trivikr approved these changes

Assignees

No one assigned

Labels

author ready PRs that have at least one approval, no outstanding review comments, and a CI started. c++ Issues and PRs that require attention from people who are familiar with C++. needs-ci PRs that need a full CI run. sqlite Issues and PRs related to the SQLite subsystem.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

Back | FazBrowse Home | New Git URL