deps: SQLite: cherry-pick b869ed6b067d623cb1383549f2a18aa35508385d

junius-sec · juanarbol · commit 693c40c836f2 · 2026-07-19T17:31:25.000-05:00
Original commit message: Fix a bug causing the session module to dereference a NULL pointer when applying a corrupt changeset. FossilOrigin-Name: e807d4e3798efd532b3d78d1dfe513ed4fbd3cb793dd0ae5c30cae6031422b10 Refs: https://sqlite.org/src/info/e807d4e3798efd53 Signed-off-by: junius-sec <sksch323@naver.com> PR-URL: #63525 Refs: https://hackerone.com/reports/3736889 Refs: sqlite/sqlite@b869ed6 Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com> Reviewed-By: Chemi Atlow <chemi@atlow.co.il>
diff --git a/deps/sqlite/sqlite3.c b/deps/sqlite/sqlite3.c
@@ -238388,7 +238388,7 @@ static int sessionApplyOneOp(
     for(i=0; rc==SQLITE_OK && i<nCol; i++){
       sqlite3_value *pOld = sessionChangesetOld(pIter, i);
       sqlite3_value *pNew = sessionChangesetNew(pIter, i);
-      if( p->abPK[i] || (bPatchset==0 && pOld) ){
+      if( pOld && (p->abPK[i] || bPatchset==0) ){
         rc = sessionBindValue(pUp, i*2+2, pOld);
       }
       if( rc==SQLITE_OK && pNew ){
diff --git a/test/parallel/test-sqlite-session.js b/test/parallel/test-sqlite-session.js
@@ -471,6 +471,27 @@ test('database.applyChangeset() - wrong arguments', (t) => {
   });
 });
 
+test('database.applyChangeset() - malformed changeset returns SQLITE_CORRUPT', {
+  skip: process.config.variables.node_shared_sqlite ?
+    'requires the bundled SQLite session fix' : false,
+}, (t) => {
+  const database = new DatabaseSync(':memory:');
+  database.exec('CREATE TABLE t1(a INTEGER PRIMARY KEY, b, c, d)');
+
+  const changeset = Buffer.from(
+    '540401000000743100177e0072286565286565',
+    'hex');
+
+  t.assert.throws(() => {
+    database.applyChangeset(changeset);
+  }, {
+    name: 'Error',
+    message: 'database disk image is malformed',
+    errcode: 11,
+    code: 'ERR_SQLITE_ERROR',
+  });
+});
+
 test('session.patchset()', (t) => {
   const database = new DatabaseSync(':memory:');
   database.exec('CREATE TABLE data(key INTEGER PRIMARY KEY, value TEXT)');

Original file line number	Diff line number	Diff line change
`@@ -238388,7 +238388,7 @@ static int sessionApplyOneOp(`
`238388`	`238388`	`for(i=0; rc==SQLITE_OK && i<nCol; i++){`
`238389`	`238389`	`sqlite3_value *pOld = sessionChangesetOld(pIter, i);`
`238390`	`238390`	`sqlite3_value *pNew = sessionChangesetNew(pIter, i);`
`238391`		`- if( p->abPK[i] \|\| (bPatchset==0 && pOld) ){`
	`238391`	`+ if( pOld && (p->abPK[i] \|\| bPatchset==0) ){`
`238392`	`238392`	`rc = sessionBindValue(pUp, i*2+2, pOld);`
`238393`	`238393`	`}`
`238394`	`238394`	`if( rc==SQLITE_OK && pNew ){`