Re: [sqlite] clusterfuzz-found issue in GDAL, Ubuntu packages

2017-07-06 Thread Even Rouault
> Aha, I wasn't certain we were allowed to mark it public yet. I don't want > to upset anyone needlessly, but it would be easier to discuss the bug in > public. I've just turned https://bugs.launchpad.net/ubuntu/+source/sqlite3/+bug/1700937 public > (Especially since it appears to be 'just' out-o

Re: [sqlite] clusterfuzz-found issue in GDAL, Ubuntu packages

2017-07-06 Thread Seth Arnold
[Sorry for the late reply, but I enjoyed a nice long weekend except for the sunburns. I kept the wider Cc:s since it feels like this can be opened.] On Sat, Jul 01, 2017 at 12:52:54PM +0200, Even Rouault wrote: > Seth, I can turn the Launchpad bug report as public if you wish. I > marked it privat

Re: [sqlite] clusterfuzz-found issue in GDAL, Ubuntu packages

2017-07-01 Thread Richard Hipp
On 7/1/17, Even Rouault wrote: > On samedi 1 juillet 2017 06:07:30 CEST Richard Hipp wrote: >> I'm confused... >> >> Are you reporting that clusterfuzz found a bug in SQLite that was >> fixed in version 3.17.0? > > Seth, I can turn the Launchpad bug report as public if you wish. I marked it > priv

Re: [sqlite] clusterfuzz-found issue in GDAL, Ubuntu packages

2017-07-01 Thread Even Rouault
On samedi 1 juillet 2017 06:07:30 CEST Richard Hipp wrote: > I'm confused... > > Are you reporting that clusterfuzz found a bug in SQLite that was > fixed in version 3.17.0? Seth, I can turn the Launchpad bug report as public if you wish. I marked it privately if Ubuntu felt it was better. I do

Re: [sqlite] clusterfuzz-found issue in GDAL, Ubuntu packages

2017-07-01 Thread Richard Hipp
I'm confused... Are you reporting that clusterfuzz found a bug in SQLite that was fixed in version 3.17.0? On 6/30/17, Seth Arnold wrote: > Hello; Even Rouault privately reported to Ubuntu Launchpad a bug in > sqlite3 as shipped in Ubuntu 16.04 LTS (and possibly other releases, > so far I've not

[sqlite] clusterfuzz-found issue in GDAL, Ubuntu packages

2017-07-01 Thread Seth Arnold
Hello; Even Rouault privately reported to Ubuntu Launchpad a bug in sqlite3 as shipped in Ubuntu 16.04 LTS (and possibly other releases, so far I've not tested the others). Valgrind reports multiple 1 byte invalid reads. This bug was discovered by Google's clusterfuzz project when fuzzing GDAL. T