4 ms·

> The bug is only accessible when using some of the C-language APIs provided by SQLite. I assume the SQLite CLI (sqlite3) uses these APIs. Could the bug be tri

> The bug is only accessible when using some of the C-language APIs provided by SQLite. I assume the SQLite CLI (sqlite3) uses these APIs. Could the bug be triggered indirectly by input to sqlite3? The article doesn't appear to address this question.

torstenvl 4y ago
[EDIT: https://sqlite.org/forum/forumpost/3607259d3c https://sqlite.org/forum/forumpost/3607259d3c appears to be only one way this bug can rear its head, not the core of the bug itself]
- ferbivore 4y ago
  That's a different bug.
  - torstenvl 4y ago
    You're right, my mistake
SQLite 4y ago
The CLI does use the relevant APIs, however I don't know of a way to reach this bug using a script input to the CLI. If there is such a path that I don't know about, it seems like it would require at least a 2GB input script.
- _the_inflator 4y ago
  This, and also there is the saying: "Never trust the frontend" So in any case a string length check in the Backend should help here. Also if you get strings from a Browser Frontend, it seems unlikely you could create a payload of 2GB due to several reasons, one being string length limitations on the Browser side: https://stackoverflow.com/questions/34957890/javascript-string-size-limit-256-mb-for-me-is-it-the-same-for-all-browsers?noredirect=1&lq=1 https://stackoverflow.com/questions/34957890/javascript-stri...
deleted 4y ago
[deleted]