[Webkit-unassigned] [Bug 137637] Null character causes early string termination in Web SQL

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=137637

Aaron Oneal <aaron.oneal at outlook.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |aaron.oneal at outlook.com

--- Comment #2 from Aaron Oneal <aaron.oneal at outlook.com> ---
This same issue is in the Cordova Web SQL plugin.

The problem has to do with how SQLITE_TEXT columns in statement results are converted to strings.

This will repro the bug:

columnValue = [NSString stringWithUTF8String:(char *)sqlite3_column_text(statement, i)];

Whereas this returns the correct full-length string:

columnValue = [[NSString alloc] initWithBytes:(char *)sqlite3_column_text(statement, i)
                                       length:sqlite3_column_bytes(statement, i)
                                     encoding:NSUTF8StringEncoding];

The former uses '\0' to determine string termination whereas the latter uses the specified buffer length.

I'll submit a fix for the Cordova plugin.

The WebKit issue is in WebCore/SQLiteStatement.cpp:

http://www.opensource.apple.com/source/WebCore/WebCore-332/platform/sql/SQLiteStatement.cpp

The getColumnValue() and getColumnText() functions rely on the standard String constructor:

return String(reinterpret_cast<const UChar*>(sqlite3_column_text16(m_statement, col)));

There is a String constructor that accepts a length, so a similar fix can probably be applied.

http://www.opensource.apple.com/source/WebCore/WebCore-332/platform/text/PlatformString.h

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20141230/4b956b6f/attachment-0002.html>