Re: [sqlite] Heap Out of Bound Read in Sqlite

2019-12-24 Thread Dominique Pellé
Yongheng Chen wrote: > This seems a problem of gcc(Ubuntu 5.5.0-12ubuntu5~16.04). When > I use this specific version to compile sqlite, the problem can be repro. Unlikely to be a compiler issue. I can reproduce the bug with valgrind with SQLite shell built with: * gcc (Ubuntu

Re: [sqlite] Heap Out of Bound Read in Sqlite

2019-12-24 Thread Dominique Pellé
On Tue, Dec 24, 2019 at 5:48 PM Richard Hipp wrote: > > On 12/24/19, Yongheng Chen wrote: > > > > When we run it with sqlite compiled with asan, we got a heap overflow crash. > > > > The bug exists in the latest development code. > > Unable to repro. Tried tip of trunk and release, using gcc

Re: [sqlite] Heap Out of Bound Read in Sqlite

2019-12-24 Thread Yongheng Chen
This seems a problem of gcc(Ubuntu 5.5.0-12ubuntu5~16.04). When I use this specific version to compile sqlite, the problem can be repro. Just in case you need it, here’s the log I got: — SQLite version 3.31.0 2019-12-24 15:35:53 Enter ".help" for usage hints. Connected to a transient in-memory

Re: [sqlite] Heap Out of Bound Read in Sqlite

2019-12-24 Thread Richard Hipp
On 12/24/19, Yongheng Chen wrote: > > When we run it with sqlite compiled with asan, we got a heap overflow crash. > > The bug exists in the latest development code. Unable to repro. Tried tip of trunk and release, using gcc and clang, all with various combinations of -fsanitize=memory,

[sqlite] Heap Out of Bound Read in Sqlite

2019-12-24 Thread Yongheng Chen
Hi, We found a oob read in sqlite. Here’s the PoC: — CREATE TABLE v0 ( v2 NOT NULL PRIMARY KEY , v1 ) ; CREATE TEMP TRIGGER y AFTER INSERT ON v0 BEGIN DELETE FROM v0 ; END ; CREATE TRIGGER x DELETE ON v0 BEGIN INSERT INTO v0 ( v2 ) VALUES ( 10.1 ) ,( '' ) ,('') ,( 1) ,( 1) ,( 1) ,( 1 ) ON