Bugs found #9
Description
In seekAndRead, osRead call ocall_read, and get got from host, but without proper check, and then it used in memset of unixRead, cause &pBuf[got] stack overflow
SQLITE_PRIVATE int sqlite3BtreeOpen(...) {
unsigned char zDbHeader[100];
rc = sqlite3PagerReadFileheader(...,zDbHeader); // sqlite3PagerReadFileheader call unixRead, and zDbHeader is passed to pBuf
}
static int unixRead(..., void *pBuf, ...) {
got = seekAndRead(...);
// if got is not equal to amt or smaller than 0
memset(&((char*)pBuf)[got], 0, amt-got); // &pBuf[got] stack overflow
}
static int seekAndRead(...) {
got = osRead(id->h, pBuf, cnt); // osRead call ocall_read, and get got from host
return got;
}