Skip to content

sqlite: check null returns from sqlite value functions#63288

Open
ndossche wants to merge 1 commit into
nodejs:mainfrom
ndossche:clesss-6
Open

sqlite: check null returns from sqlite value functions#63288
ndossche wants to merge 1 commit into
nodejs:mainfrom
ndossche:clesss-6

Conversation

@ndossche
Copy link
Copy Markdown
Contributor

@ndossche ndossche commented May 13, 2026

sqlite3_column_text() can return nullptr on failure which was not handled. sqlite3_column_blob() can return nullptr for zero-length BLOBs, which is then passed to memcpy() which is UB. Avoid this by checking for a nullptr.

Note: this was found by a static-dynamic analyser I'm developing.

@nodejs-github-bot
Copy link
Copy Markdown
Collaborator

Review requested:

  • @nodejs/sqlite

@nodejs-github-bot nodejs-github-bot added c++ Issues and PRs that require attention from people who are familiar with C++. needs-ci PRs that need a full CI run. sqlite Issues and PRs related to the SQLite subsystem. labels May 13, 2026
sqlite3_column_text() can return nullptr on failure which
was not handled.
sqlite3_column_blob() can return nullptr for zero-length BLOBs,
which is then passed to memcpy() which is UB.
Avoid this by checking for a nullptr.
@codecov
Copy link
Copy Markdown

codecov Bot commented May 13, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90.05%. Comparing base (a159b57) to head (9c502d4).
⚠️ Report is 3 commits behind head on main.

Additional details and impacted files
@@            Coverage Diff             @@
##             main   #63288      +/-   ##
==========================================
+ Coverage   90.04%   90.05%   +0.01%     
==========================================
  Files         714      714              
  Lines      225242   225247       +5     
  Branches    42578    42577       -1     
==========================================
+ Hits       202808   202857      +49     
+ Misses      14221    14171      -50     
- Partials     8213     8219       +6     
Files with missing lines Coverage Δ
src/node_sqlite.cc 80.63% <ø> (ø)

... and 33 files with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

c++ Issues and PRs that require attention from people who are familiar with C++. needs-ci PRs that need a full CI run. sqlite Issues and PRs related to the SQLite subsystem.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants