[DBD-SQLite] Re: [sqlite] ANN - DBD::SQLite version

[Stefan Evert]

On 30 Mar 2009, at 01:25, Darren Duncan wrote:

> Stefan, thanks for your report, and Michael for your confirmation.
>
> If you think you might be able to root out the problem and fix it,  
> then please do; patches are welcome.  You may also want to file an  
> RT item on this.  Or maybe check and see if any existing RT items  
> refer to the same problem and if so then you could annotate the  
> problem still exists in 1.19_02.

I'm about to go on a trip and will be away for a next week, so I don't  
have time to set up a RT item (I need to get an account there first,  
and all that ...).

However, I played around a little with the source code and came a  
little closer to tracking down the source of the segfaults.  Perhaps  
the SQLite gurus can help us out from here?

Apparently, the segfault is triggered when Perl calls

	sqlite3_result_error( context, s, len );

to signal an exception in the Perl callback function.   As soon as the  
string s[] is longer than 22 characters (excluding the NUL  
terminator), I get a segfault (in Mac OS X 10.5.6 Intel; can't check  
Linux at the moment as our server is down).  This doesn't seem to have  
anything to do with Perl, because I get exactly the same behaviour  
when I change the function call (dbimb.c, line 780) to a constant  
string:

	sqlite3_result_error( context, "........1.........2....", 23 );

If I change 23 to 22, the program runs through.

Sounds a bit like a buffer overflow in the SQLite code to me, but I  
know far too little about SQLite internals to chase this down easily.

Best,
Stefan