isaac / libspatialite Goto Github PK

There are several bugs due to missing sqlite3_free_table(result) after sqlite3_get_table(db, sql, result, row, column, errmsg) call.

SQLite Documention mentions:

A result table might consist of one or more memory allocations. It is not safe to pass a result table directly to sqlite3_free(). A result table should be deallocated using sqlite3_free_table().

This bug results in memory leak. In some cases, the memory consumption might be huge, which may cause the process to corrupt.

Example source code in test/check_get_normal_row.c:255:

254     ret =
255     sqlite3_get_table (db_handle,
256                "SELECT gpkgGetNormalRow(\"test1_matrix_tiles\", 5, 0)",
257                &results, &rows, &columns, &err_msg);
258     if (ret != SQLITE_ERROR)
259       {
260       fprintf (stderr, "Expected error for overrange zoom level, got %i\n",
261            ret);
262       sqlite3_free (err_msg);
263       return -18;
264       }

There is the whole list of locations related to this problem:

test/check_get_normal_row.c:255
test/check_get_normal_row.c:277
test/check_get_normal_row.c:300
test/check_get_normal_row.c:322
test/check_get_normal_row.c:344
test/check_get_normal_row.c:367
test/check_get_normal_row.c:390
test/check_get_normal_row.c:415
test/check_get_normal_row_bad_geopackage.c:126
test/check_get_normal_row_bad_geopackage.c:149
test/check_get_normal_row_bad_geopackage2.c:94
test/check_get_normal_zoom.c:224
test/check_get_normal_zoom.c:248
test/check_get_normal_zoom.c:273
test/check_get_normal_zoom.c:296
test/check_get_normal_zoom.c:318
test/check_get_normal_zoom_bad_geopackage.c:115
test/check_get_normal_zoom_bad_geopackage2.c:135
test/check_get_normal_zoom_extension_load.c:235
test/check_get_normal_zoom_extension_load.c:259
test/check_get_normal_zoom_extension_load.c:284
test/check_get_normal_zoom_extension_load.c:307
test/check_get_normal_zoom_extension_load.c:329
test/check_stored_proc.c:1058

I found a potential memory leak when reading the source code '/test/check_recover_geom.c'.

The issue is caused because forgetting to free the second argument of libsqlite3 API 'sqlite3_get_table' when meeting an error and return, such as 1525-1548 line.

According to libsqlite3 API document, "After the application has finished with the result from sqlite3_get_table(), it must pass the result table pointer to sqlite3_free_table() in order to release the memory that was malloced. "