SQLite Forum

A null-pointer-dereferece bug in sqlite3_enable_load_extension()
Login

A null-pointer-dereferece bug in sqlite3_enable_load_extension()

(1) By PromptFuzz on 2023-10-10 03:16:24 [source]

Hi, when sqlite3 built with -DSQLITE_ENABLE_API_ARMOR, sqlite3_enable_load_extension() still crashed if passed with NULL db.

  sqlite3 *db = NULL;
 
  // Enable the extension loading
  sqlite3_enable_load_extension(db, 1); // crash

As sqlite3_enable_load_extension is a public API, i suggest add a null pointer check of db when the flag -DSQLITE_ENABLE_API_ARMOR is enabled.

That check can increase the robustness and avoid unexpected behaviors.

Thanks