Remote code execution vulnerability in SQLite

Re:Remote code execution vulnerability in SQLite by Drdrdrq on Saturday December 15, 2018 @08:18AM (#18688281)

Nicely written, and thank you for providing such a great peice of engineering!

A thought: would it help to have a modified C compiler that would crash the app whenever UB was encountered? It might help find some bugs where non-default C compiler was used (which I assume happens, given the large amount of platforms sqlite supports). Or am I missing something?

[ Parent | on HN ]

Re:Remote code execution vulnerability in SQLite by cyan_pencil on Saturday December 15, 2018 @11:02AM (#18688879)

There is ASAN, the address sanitizer. You can enable it by passing some flags to gcc. It will make your program crash as soon as there is an out of bounds read / undefined behaviour. If debug symbols are enabled, it will also tell you which line of code was responsible. It can save you countless hours of debugging

[ Parent | on HN ]

Re:Remote code execution vulnerability in SQLite by Leszek on Saturday December 15, 2018 @10:16AM (#18688641)

I believe there's some things your have to do such aren't C compatible, e.g. store fat pointers of base+length+offset instead of raw pointers, to catch OOB accesses.

[ Parent | on HN ]

Re:Remote code execution vulnerability in SQLite by drorh on Thursday December 20, 2018 @05:02AM (#18723679)

I would not help because modern compiler treat UB as an optimization opportunity, including a license to do whatever they want (even elimination of code).

[ Parent | on HN ]