Skip to content

sqlite3: two bugs in set_param() — boolean always binds as 0, spurious null bind masks errors #203

Description

@suyashkumar102

While reading ls_sqlite3.c I found two bugs in set_param().

Bug 1: LUA_TBOOLEAN uses lua_tointeger() instead of lua_toboolean()

lua_tointeger() on a boolean always returns 0 in the Lua C API. So passing true as a query parameter silently stores 0 instead of 1. Both true and false produce the same result.

case LUA_TBOOLEAN: {
    int val = lua_tointeger(L, arg);  /* always 0 for booleans */
    rc = sqlite3_bind_int(vm, param_nr, val);
    break;
}

Should be lua_toboolean(L, arg).

Bug 2: LUA_TSTRING calls sqlite3_bind_null() before sqlite3_bind_text()

The return code from sqlite3_bind_null() is immediately overwritten by sqlite3_bind_text(). The null bind is unnecessary and masks any error it returns.

case LUA_TSTRING: {
    const char *s = lua_tolstring(L, arg, &s_len);
    rc = sqlite3_bind_null(vm, param_nr);   /* spurious, rc gets overwritten */
    rc = sqlite3_bind_text(vm, param_nr, s, s_len, SQLITE_TRANSIENT);
    break;
}

Both bugs are in src/ls_sqlite3.c. Fix is one line changed and one line removed.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions