Segmentation Fault in SQLite Shell’s output_quoted_string Function During Invalid PRAGMA Execution

---

Root Cause: Null Pointer Dereference in output_quoted_string Due to Invalid PRAGMA Syntax

---

Issue Overview: Invalid PRAGMA Command Triggers Unhandled Null Pointer in String Quoting Logic

The segmentation fault occurs when the SQLite shell attempts to execute a malformed PRAGMA statement (PRAGMA j) in combination with specific shell configuration commands (.mode, .eqp, .limit). The output_quoted_string function, responsible for formatting quoted strings in output, dereferences a null pointer (0x000000000000), leading to a fatal crash.

The crash manifests under the following conditions:

1. Shell Modes: The shell is configured with .mode quote (forcing quoted string output) and .eqp 3 (enabling EXPLAIN QUERY PLAN with automatic execution).
2. Invalid PRAGMA Syntax: The PRAGMA j statement lacks a valid pragma name or value.
3. Limit Configuration: The .limit LE 0 command sets the "maximum length of an expression tree" to zero, which interacts unexpectedly with error handling.

The AddressSanitizer (ASAN) report indicates that the crash originates at shell.c:17049, where output_quoted_string attempts to read memory from address 0x0 (the zero page). This implies that the function is being called with a NULL or invalid string pointer.

---

Possible Causes: Chain of Configuration Commands and Missing Error Checks

The segmentation fault arises from a combination of shell configuration settings and a malformed SQL statement. Here are the critical factors contributing to the crash:

1. Invalid PRAGMA Statement:
   The command PRAGMA j is syntactically invalid. Valid PRAGMA statements require a recognized pragma name followed by an optional value (e.g., PRAGMA journal_mode=WAL). The malformed PRAGMA j triggers an error path in the SQLite shell that does not properly initialize or validate the error message string before passing it to output_quoted_string.

2. Shell Output Modes and Error Handling:
   The .mode quote setting forces all output to be formatted as quoted strings. When an error occurs (e.g., due to the invalid PRAGMA), the shell attempts to format the error message using output_quoted_string. However, if the error message buffer is uninitialized or null, the function dereferences a null pointer.

3. Interaction with .limit LE 0:
   The .limit LE 0 command sets the maximum expression tree length to zero. This may disable certain internal query optimizations or error message formatting logic, leaving the error message string unintialized.

4. Missing Null Checks in output_quoted_string:
   The output_quoted_string function (at shell.c:17049) assumes that the input string pointer is valid. When passed a NULL pointer (due to an unhandled error), it attempts to read the string length or content, causing the crash.

5. Debug Build Configuration:
   The SQLite shell was compiled with debug flags (-DSQLITE_DEBUG, -DSQLITE_ENABLE_WHERETRACE, etc.), which enable additional diagnostics and may expose latent bugs in error-handling paths.

---

Troubleshooting Steps: Validate PRAGMA Syntax, Patch Shell Code, and Strengthen Error Handling

To resolve the segmentation fault, follow these steps:

Step 1: Verify and Correct PRAGMA Syntax
Replace the invalid PRAGMA j with a valid pragma statement. For example:

PRAGMA journal_mode;  -- Valid pragma to query journal mode  

If the crash persists, proceed to deeper analysis.

Step 2: Apply the SQLite Patch from Check-in 2881978d7b
The fix in check-in 2881978d7b addresses this specific crash by improving error handling in the shell. Rebuild SQLite with this patch:

# Update SQLite source to include the check-in  
cd sqlite_bisect  
fossil update 2881978d7b701473  
# Rebuild with the same debug flags  
export CFLAGS="-g -DSQLITE_DEBUG -DSQLITE_ENABLE_TREETRACE -DSQLITE_ENABLE_WHERETRACE -DSQLITE_ENABLE_CURSOR_HINTS -DSQLITE_COUNTOFVIEW_OPTIMIZATION -DSQLITE_ENABLE_STAT4"  
./configure --enable-all --enable-debug --disable-shared && make  

Step 3: Add Null Checks in output_quoted_string
If patching is not feasible, modify output_quoted_string in shell.c to handle null pointers:

// Original code (vulnerable):  
void output_quoted_string(FILE *out, const char *z){  
  int i;  
  for(i=0; z[i]; i++){  // CRASH: z is NULL  
    // ...  
  }  
}  

// Fixed code:  
void output_quoted_string(FILE *out, const char *z){  
  if(z == NULL){  
    fprintf(out, "NULL");  
    return;  
  }  
  int i;  
  for(i=0; z[i]; i++){  
    // ...  
  }  
}  

Step 4: Debug with GDB or LLDB
Attach a debugger to pinpoint the null pointer origin:

gdb ./sqlite3-asan  
(gdb) break shell.c:17049  # Set breakpoint at output_quoted_string  
(gdb) run  
# Execute the crashing commands:  
.mode quote  
.eqp 3  
.limit LE 0  
PRAGMA j;  
(gdb) backtrace  
(gdb) print z  # Inspect the input string pointer in output_quoted_string  

If z is 0x0, trace back to the caller (shell_callback at shell.c:17946) to identify why a null pointer was passed.

Step 5: Strengthen Error Handling in shell_callback
The shell_callback function (invoked for each result row) must validate strings before passing them to output functions. Modify shell.c:17946:

// Before:  
output_quoted_string(p->out, z);  

// After:  
if(z != NULL){  
  output_quoted_string(p->out, z);  
} else {  
  fprintf(p->out, "NULL");  
}  

Step 6: Test with Valgrind or ASAN
Re-run the test case with memory-checking tools to ensure no other latent issues exist:

ASAN_OPTIONS=detect_leaks=1 ./sqlite3-asan < test_commands.sql  

Step 7: Review SQLite Shell Configuration Interactions
The .limit LE 0 command may interfere with error message generation. Test with default limits:

.limit  
-- Reset to defaults or omit .limit LE 0  

Step 8: Report the Issue to SQLite Team (If Unpatched)
If the crash occurs in unpatched versions, file a bug report with the SQLite team, including the ASAN trace and reproduction steps.

By systematically validating inputs, applying patches, and hardening error-handling logic, the segmentation fault in output_quoted_string can be reliably resolved.

---

This guide provides a comprehensive pathway to diagnose and fix the null pointer dereference in the SQLite shell, ensuring robustness against invalid PRAGMA statements and misconfigurations.