Ensure that the sqlite3_value_text() interface returns a buffer that is long

enough to hold the complete string plus the zero terminator even when the
input is a zeroblob.  Fix for a problem detected by OSS-Fuzz.

FossilOrigin-Name: 2dc7eeb5b4d2eaf1d843eda56f339fd4cc80d78e
This commit is contained in:
drh
2017-01-05 07:58:29 +00:00
parent 87e1e56b5b
commit 34d04d64f0
3 changed files with 8 additions and 7 deletions
+1
View File
@@ -1010,6 +1010,7 @@ static SQLITE_NOINLINE const void *valueToText(sqlite3_value* pVal, u8 enc){
assert( (pVal->flags & MEM_RowSet)==0 );
assert( (pVal->flags & (MEM_Null))==0 );
if( pVal->flags & (MEM_Blob|MEM_Str) ){
if( ExpandBlob(pVal) ) return 0;
pVal->flags |= MEM_Str;
if( pVal->enc != (enc & ~SQLITE_UTF16_ALIGNED) ){
sqlite3VdbeChangeEncoding(pVal, enc & ~SQLITE_UTF16_ALIGNED);