Hacker News Reader

> The bug is only accessible when using some of the C-language APIs provided by SQLite.

I assume the SQLite CLI (sqlite3) uses these APIs. Could the bug be triggered indirectly by input to sqlite3? The article doesn't appear to address this question.

View on HN

The CLI does use the relevant APIs, however I don't know of a way to reach this bug using a script input to the CLI. If there is such a path that I don't know about, it seems like it would require at least a 2GB input script.

This, and also there is the saying: "Never trust the frontend"

So in any case a string length check in the Backend should help here. Also if you get strings from a Browser Frontend, it seems unlikely you could create a payload of 2GB due to several reasons, one being string length limitations on the Browser side: https://stackoverflow.com/questions/34957890/javascript-stri...

[EDIT: https://sqlite.org/forum/forumpost/3607259d3c appears to be only one way this bug can rear its head, not the core of the bug itself]

That's a different bug.

You're right, my mistake

Reply on news.ycombinator.com