Re: [sqlite] DEF CON (wasL A license plate of NULL)

2019-08-13 Thread James K. Lowden
On Mon, 12 Aug 2019 14:14:08 -0600 "Keith Medcalf" wrote: > Perhaps I am just lazy but I see no point in engaging in extra work > for no advantage bool is_true (bool tf) { if (tf == true) { return true; } return false; } --jkl

Re: [sqlite] DEF CON (wasL A license plate of NULL)

2019-08-12 Thread Scott Perry
On Aug 12, 2019, at 1:14 PM, Keith Medcalf wrote: > The only interesting thing is CVE-2015-7036, but I don't know if that was so > much an SQLite3 issue, as it was an issue in the use of the tokenizer by > Apple. In either case, Apple fixed their bugs and SQLite3 was hardened > against some

Re: [sqlite] DEF CON (wasL A license plate of NULL)

2019-08-12 Thread Donald Shepherd
The difference, in Apple's case _very_ specifically, is that they sign the majority (all the rest? Unsure) of their files so that this style of exploit fails. Basically SQLite is being used to bypass an existing Apple-specific security control. Outside of the iOS world the applicability is a

[sqlite] DEF CON (wasL A license plate of NULL)

2019-08-12 Thread Keith Medcalf
On Monday, 12 August, 2019 11:09, Simon Slavin wrote: >Some interesting things are emerging from this year's DEF CON. This >one is related to an issue we've often discussed here. I hope you'll >indulge this slightly off-charter post. >