GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — sqlite: check null returns from sqlite value functions by ndossche · Pull Request #63288 · nodejs/node

Conversation

@ndossche

@ndossche ndossche commented May 13, 2026 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Contributor

sqlite3_column_text() can return nullptr on failure which was not handled. sqlite3_column_blob() can return nullptr for zero-length BLOBs, which is then passed to memcpy() which is UB. Avoid this by checking for a nullptr.

Note: this was found by a static-dynamic analyser I'm developing.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@nodejs-github-bot

nodejs-github-bot commented May 13, 2026

Copy link
Copy Markdown
Collaborator

Review requested:

  • @nodejs/sqlite
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@nodejs-github-bot nodejs-github-bot added c++ Issues and PRs that require attention from people who are familiar with C++. needs-ci PRs that need a full CI run. sqlite Issues and PRs related to the SQLite subsystem. labels May 13, 2026
@ndossche
ndossche force-pushed the clesss-6 branch from 7cff62b to 9c502d4 Compare May 13, 2026 15:20
@codecov

codecov Bot commented May 13, 2026 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90.29%. Comparing base (85d4755) to head (02db86a).
⚠️ Report is 34 commits behind head on main.

Additional details and impacted files 
@@            Coverage Diff             @@
##             main   #63288      +/-   ##
==========================================
- Coverage   90.30%   90.29%   -0.01%     
==========================================
  Files         759      759              
  Lines      247754   247754              
  Branches    46716    46720       +4     
==========================================
- Hits       223724   223719       -5     
- Misses      15483    15512      +29     
+ Partials     8547     8523      -24
Files with missing lines Coverage Δ
src/node_sqlite.cc 80.84% <ø> (ø)

... and 38 files with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@ndossche
ndossche force-pushed the clesss-6 branch from 9c502d4 to 91b4eb1 Compare May 29, 2026 09:23
@trivikr

trivikr commented Aug 6, 2026

Copy link
Copy Markdown
Member

@ndossche Can you please rebase and force push?
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@ndossche
sqlite: check null returns from sqlite value functions
02db86a 
sqlite3_column_text() can return nullptr on failure which
was not handled.
sqlite3_column_blob() can return nullptr for zero-length BLOBs,
which is then passed to memcpy() which is UB.
Avoid this by checking for a nullptr.

Signed-off-by: ndossche <[email protected]>
@ndossche
ndossche force-pushed the clesss-6 branch from 91b4eb1 to 02db86a Compare August 6, 2026 10:54
@ndossche

ndossche commented Aug 6, 2026

Copy link
Copy Markdown
Contributor Author

Done, CI (so far) is looking okay
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@trivikr

trivikr commented Aug 6, 2026

Copy link
Copy Markdown
Member

Can you add some regression tests? Ones which fail in main, but succeed with the fix?
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@ndossche

ndossche commented Aug 6, 2026

Copy link
Copy Markdown
Contributor Author

Can you add some regression tests? Ones which fail in main, but succeed with the fix?

Apparently the current test suite can already trigger the "UB blob" problem, but the test runner ignores UBSAN failures, so you never see this as a failure.
Compile node.js with ubsan, and then set the environment variable export UBSAN_OPTIONS='print_stacktrace=1:halt_on_error=1' and then run: ./tools/test.py test/parallel/test-sqlite-data-types.js
This will show the failed test and crash backtrace.

As for the allocation failure in SQLITE_TEXT, I don't think I can make a reliable reproducer.
trivikr reacted with thumbs up emoji
All reactions
  • 👍 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
trivikr
trivikr approved these changes Aug 7, 2026
View reviewed changes
@trivikr trivikr added the request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. label Aug 7, 2026
@github-actions github-actions Bot removed the request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. label Aug 7, 2026
@nodejs-github-bot

This comment was marked as outdated.

Sign in to view
@nodejs-github-bot

This comment was marked as outdated.

Sign in to view
@nodejs-github-bot

nodejs-github-bot commented Aug 8, 2026

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/75632/
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@trivikr trivikr added author ready PRs with CI started, the required approvals, and no outstanding review comments. commit-queue PRs queued for automated landing through the Commit Queue. labels Aug 8, 2026
@nodejs-github-bot nodejs-github-bot removed the commit-queue PRs queued for automated landing through the Commit Queue. label Aug 9, 2026
@nodejs-github-bot
nodejs-github-bot merged commit 330f7b5 into nodejs:main Aug 9, 2026
75 of 77 checks passed

Uh oh!

There was an error while loading. Please reload this page.
@nodejs-github-bot

nodejs-github-bot commented Aug 9, 2026

Copy link
Copy Markdown
Collaborator

Landed in 330f7b5
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
aduh95 pushed a commit that referenced this pull request Aug 13, 2026
@ndossche @aduh95
sqlite: check null returns from sqlite value functions
5fa764f 
sqlite3_column_text() can return nullptr on failure which
was not handled.
sqlite3_column_blob() can return nullptr for zero-length BLOBs,
which is then passed to memcpy() which is UB.
Avoid this by checking for a nullptr.

Signed-off-by: ndossche <[email protected]>
PR-URL: #63288
Reviewed-By: Trivikram Kamat <[email protected]>
aduh95 pushed a commit that referenced this pull request Aug 25, 2026
@ndossche @aduh95
sqlite: check null returns from sqlite value functions
5a852b2 
sqlite3_column_text() can return nullptr on failure which
was not handled.
sqlite3_column_blob() can return nullptr for zero-length BLOBs,
which is then passed to memcpy() which is UB.
Avoid this by checking for a nullptr.

Signed-off-by: ndossche <[email protected]>
PR-URL: #63288
Reviewed-By: Trivikram Kamat <[email protected]>
@github-actions github-actions Bot mentioned this pull request Aug 25, 2026
2026-08-26, Version 26.8.0 (Current) #65551
Merged
aduh95 pushed a commit that referenced this pull request Aug 27, 2026
@ndossche @aduh95
sqlite: check null returns from sqlite value functions
b8faee0 
sqlite3_column_text() can return nullptr on failure which
was not handled.
sqlite3_column_blob() can return nullptr for zero-length BLOBs,
which is then passed to memcpy() which is UB.
Avoid this by checking for a nullptr.

Signed-off-by: ndossche <[email protected]>
PR-URL: #63288
Reviewed-By: Trivikram Kamat <[email protected]>
@github-actions github-actions Bot mentioned this pull request Sep 7, 2026
2026-09-08, Version 24.21.0 'Krypton' (LTS) #65873
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@trivikr trivikr trivikr approved these changes

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

author ready PRs with CI started, the required approvals, and no outstanding review comments. c++ Issues and PRs that require attention from people who are familiar with C++. needs-ci PRs that need a full CI run. sqlite Issues and PRs related to the SQLite subsystem.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

3 participants

@ndossche @nodejs-github-bot @trivikr
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.