Chu <r...@sh3ll.me> wrote: > The code: > > ``` > CREATE VIRTUAL TABLE t1 USING fts5(content); > > BEGIN; > INSERT INTO t1 (content) VALUES('AAAA'); > SELECT * FROM > t1('BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB*'); > END; > ``` > > As you can see, it creates a virtual table with fts5, and run a transaction > on it, this will leads to a OOB READ. The ASAN report: > > ``` > ➜ sqlite-crashes ../sqlite-autoconf-3270200/sqlite3 < 2-oob-read.sql > ================================================================= > ==21007==ERROR: AddressSanitizer: heap-buffer-overflow on address > 0x60d000002898 at pc 0x7f0cad16e6a3 bp 0x7ffdc88ddc80 sp 0x7ffdc88dd430 > READ of size 81 at 0x60d000002898 thread T0 > #0 0x7f0cad16e6a2 (/lib/x86_64-linux-gnu/libasan.so.5+0xb86a2) > #1 0x563324ca4013 in fts5HashEntrySort > /root/Documents/sqlite-autoconf-3270200/sqlite3.c:207762 > #2 0x563324e685f9 in sqlite3Fts5HashScanInit > /root/Documents/sqlite-autoconf-3270200/sqlite3.c:207820 > #3 0x563324e685f9 in fts5SegIterHashInit > /root/Documents/sqlite-autoconf-3270200/sqlite3.c:210321
...snip.. Just to confirm that there is a bug when running your queries in the SQLite-3.27.2 shell with valgrind. I did not get a heap overflow, but valgrind complains about uninitialized memory in the same fts5HashEntrySort function as in your stack: $ valgrind --track-origins=yes --num-callers=50 sqlite3_shell ==10856== Memcheck, a memory error detector ==10856== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al. ==10856== Using Valgrind-3.14.0 and LibVEX; rerun with -h for copyright info ==10856== Command: ./Output/Binary/x86_64-Linux-clang/Debug/bin/sqlite3_shell ==10856== SQLite version 3.27.2 2019-02-25 16:06:06 NDSeV devkit 3.27.2.1 2019-02-26 16:04:39 990c4f90c3340db5 Enter ".help" for usage hints. Connected to a transient in-memory database. Use ".open FILENAME" to reopen on a persistent database. sqlite> CREATE VIRTUAL TABLE t1 USING fts5(content); sqlite> BEGIN; sqlite> INSERT INTO t1 (content) VALUES('AAAA'); sqlite> SELECT * FROM t1('BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB*'); ==10856== Conditional jump or move depends on uninitialised value(s) ==10856== at 0x4C362B2: __memcmp_sse4_1 (vg_replace_strmem.c:1111) ==10856== by 0x4ECC86: fts5HashEntrySort (nds_sqlite3.c:207811) ==10856== by 0x4EC55D: sqlite3Fts5HashScanInit (nds_sqlite3.c:207869) ==10856== by 0x4EBB45: fts5SegIterHashInit (nds_sqlite3.c:210370) ==10856== by 0x4EB1BE: fts5MultiIterNew (nds_sqlite3.c:211319) ==10856== by 0x4EB5A8: fts5SetupPrefixIter (nds_sqlite3.c:212995) ==10856== by 0x4EAE4A: sqlite3Fts5IndexQuery (nds_sqlite3.c:213324) ==10856== by 0x4EAA61: fts5ExprNearInitAll (nds_sqlite3.c:205310) ==10856== by 0x4EA6F3: fts5ExprNodeFirst (nds_sqlite3.c:205827) ==10856== by 0x4EA5B4: sqlite3Fts5ExprFirst (nds_sqlite3.c:205885) ==10856== by 0x4E9D1A: fts5CursorFirst (nds_sqlite3.c:215420) ==10856== by 0x4E2DD3: fts5FilterMethod (nds_sqlite3.c:215702) ==10856== by 0x4672A7: sqlite3VdbeExec (nds_sqlite3.c:90382) ==10856== by 0x42F876: sqlite3Step (nds_sqlite3.c:81765) ==10856== by 0x42F51C: sqlite3_step (nds_sqlite3.c:81830) ==10856== by 0x4236B8: exec_prepared_stmt (shell.c:10469) ==10856== by 0x4104EB: shell_exec (shell.c:10776) ==10856== by 0x42414E: runOneSqlLine (shell.c:16136) ==10856== by 0x410C5A: process_input (shell.c:16236) ==10856== by 0x40752D: main (shell.c:16995) ==10856== Uninitialised value was created by a heap allocation ==10856== at 0x4C2FE56: malloc (vg_replace_malloc.c:299) ==10856== by 0x4E0098: sqlite3MemMalloc (nds_sqlite3.c:22886) ==10856== by 0x441ED0: mallocWithAlarm (nds_sqlite3.c:26718) ==10856== by 0x425E0B: sqlite3Malloc (nds_sqlite3.c:26748) ==10856== by 0x425E7F: sqlite3_malloc64 (nds_sqlite3.c:26772) ==10856== by 0x4FE464: sqlite3Fts5HashWrite (nds_sqlite3.c:207636) ==10856== by 0x4FE1F0: sqlite3Fts5IndexWrite (nds_sqlite3.c:213247) ==10856== by 0x4FACB9: fts5StorageInsertCallback (nds_sqlite3.c:217629) ==10856== by 0x505B04: fts5UnicodeTokenize (nds_sqlite3.c:218923) ==10856== by 0x4F623D: sqlite3Fts5Tokenize (nds_sqlite3.c:204268) ==10856== by 0x4FA0DD: sqlite3Fts5StorageIndexInsert (nds_sqlite3.c:217984) ==10856== by 0x4F9E44: fts5StorageInsert (nds_sqlite3.c:215929) ==10856== by 0x4E359D: fts5UpdateMethod (nds_sqlite3.c:216036) ==10856== by 0x4677E6: sqlite3VdbeExec (nds_sqlite3.c:90593) ==10856== by 0x42F876: sqlite3Step (nds_sqlite3.c:81765) ==10856== by 0x42F51C: sqlite3_step (nds_sqlite3.c:81830) ==10856== by 0x4236B8: exec_prepared_stmt (shell.c:10469) ==10856== by 0x4104EB: shell_exec (shell.c:10776) ==10856== by 0x42414E: runOneSqlLine (shell.c:16136) ==10856== by 0x410C5A: process_input (shell.c:16236) ==10856== by 0x40752D: main (shell.c:16995) ==10856== sqlite> END; Out of curiosity: was this bug found by fuzzing? Dominique _______________________________________________ sqlite-users mailing list sqlite-users@mailinglists.sqlite.org http://mailinglists.sqlite.org/cgi-bin/mailman/listinfo/sqlite-users