full-disclosure - Re: [FD] several issues in SQLite (+ catching up on several other bugs)

Open Source and information security mailing list archives

Message-ID: <20150416131616.70a4f01d@pc1.fritz.box>
Date: Thu, 16 Apr 2015 13:16:16 +0200
From: Hanno Böck <hanno@...eck.de>
To: fulldisclosure@...lists.org
Subject: Re: [FD] several issues in SQLite (+ catching up on several other
 bugs)

Hi,

Nice work.

I took the latest release and ran the fuzzer again (without all the
dictionary and special testcase stuff, may re-do that later).

Uncovered two more issues, one in the statement parser causing an
off-by-one read with the 2 byte input ".\":
https://www.sqlite.org/cgi/src/info/e018f4bf1f27f783

And one in the parser of the database binary format itself:
https://www.sqlite.org/cgi/src/info/f71053cf658b3260
(not sure if there is any plausible attack scenario)

Both "only" invalid memory reads, so likely nothing to worry. Just
a motivation for others to fuzz again, there may be more to find.

Thanks also to Richard for fixing both issues very quickly.

cu,
-- 
Hanno Böck
http://hboeck.de/

mail/jabber: hanno@...eck.de
GPG: BBB51E42

Content of type "application/pgp-signature" skipped

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives