Merge pull request #665 from jamescater2/fix/pztail-aoor-followups

Follow-ups to pzTail bounds-check: funcptrs_win v3-span backfill + string-overload AOOR guard

Author: ericsink

src/SQLitePCLRaw.core/raw.cs

@@ -830,7 +830,8 @@ static public int sqlite3_prepare_v2(sqlite3 db, string sql, out sqlite3_stmt st
             var ba = sql.to_utf8_with_z();
             var sp = new ReadOnlySpan<byte>(ba);
             int rc = sqlite3_prepare_v2(db, sp, out stmt, out var sp_tail);
-            tail = utf8_span_to_string(sp_tail.Slice(0, sp_tail.Length - 1));
+            // Audit #1: provider now returns an empty span on error; guard Slice(0, -1).
+            tail = sp_tail.Length > 0 ? utf8_span_to_string(sp_tail.Slice(0, sp_tail.Length - 1)) : "";
             return rc;
         }
 
@@ -874,7 +875,8 @@ static public int sqlite3_prepare_v3(sqlite3 db, string sql, uint flags, out sql
             var ba = sql.to_utf8_with_z();
             var sp = new ReadOnlySpan<byte>(ba);
             int rc = sqlite3_prepare_v3(db, sp, flags, out stmt, out var sp_tail);
-            tail = utf8_span_to_string(sp_tail.Slice(0, sp_tail.Length - 1));
+            // Audit #1: provider now returns an empty span on error; guard Slice(0, -1).
+            tail = sp_tail.Length > 0 ? utf8_span_to_string(sp_tail.Slice(0, sp_tail.Length - 1)) : "";
             return rc;
         }
 

src/SQLitePCLRaw.provider.e_sqlite3/Generated/provider_e_sqlite3_funcptrs_win.cs

@@ -304,11 +304,12 @@ unsafe int ISQLite3Provider.sqlite3_prepare_v3(sqlite3 db, ReadOnlySpan<byte> sq
             fixed (byte* p_sql = sql)
             {
                 var rc = NativeMethods.sqlite3_prepare_v3(db, p_sql, sql.Length, flags, out stm, out var p_tail);
-                var len_consumed = (int) (p_tail - p_sql);
-                int len_remain = sql.Length - len_consumed;
-                if (len_remain > 0)
+                // Follow-up to 854eeb0: funcptrs_win's v3 span variant was missed in that commit — same p_tail bounds guard as the other three provider variants.
+                if (p_tail != null && p_tail >= p_sql && p_tail <= p_sql + sql.Length)
                 {
-                    tail = sql.Slice(len_consumed, len_remain);
+                    var len_consumed = (int) (p_tail - p_sql);
+                    int len_remain = sql.Length - len_consumed;
+                    tail = len_remain > 0 ? sql.Slice(len_consumed, len_remain) : ReadOnlySpan<byte>.Empty;
                 }
                 else
                 {

src/common/tests_xunit.cs

@@ -433,6 +433,64 @@ public void test_prepare_v3_span_tolerates_uninitialised_pzTail()
             GC.KeepAlive(rolling);
         }
 
+        // Audit #1: the string overloads of prepare_v2/v3 used to throw
+        // ArgumentOutOfRangeException on the same MISUSE path because they
+        // unconditionally sliced the (now empty) tail span.  These tests
+        // assert they return rc cleanly with an empty tail string instead.
+        [Fact]
+        public void test_prepare_v2_string_tolerates_uninitialised_pzTail()
+        {
+            var rolling = new byte[256][];
+            var rnd = new Random(42);
+            for (var i = 0; i < 512; i++)
+            {
+                rolling[i % rolling.Length] = new byte[rnd.Next(1024, 128 * 1024)];
+
+                var db = ugly.open(":memory:");
+                db.manual_close_v2();
+                try
+                {
+                    int rc = raw.sqlite3_prepare_v2(db, "SELECT 1;", out var stmt, out string tail);
+
+                    Assert.Equal(raw.SQLITE_MISUSE, rc);
+                    Assert.Equal("", tail);
+                    stmt?.Dispose();
+                }
+                finally
+                {
+                    db.Dispose();
+                }
+            }
+            GC.KeepAlive(rolling);
+        }
+
+        [Fact]
+        public void test_prepare_v3_string_tolerates_uninitialised_pzTail()
+        {
+            var rolling = new byte[256][];
+            var rnd = new Random(42);
+            for (var i = 0; i < 512; i++)
+            {
+                rolling[i % rolling.Length] = new byte[rnd.Next(1024, 128 * 1024)];
+
+                var db = ugly.open(":memory:");
+                db.manual_close_v2();
+                try
+                {
+                    int rc = raw.sqlite3_prepare_v3(db, "SELECT 1;", 0, out var stmt, out string tail);
+
+                    Assert.Equal(raw.SQLITE_MISUSE, rc);
+                    Assert.Equal("", tail);
+                    stmt?.Dispose();
+                }
+                finally
+                {
+                    db.Dispose();
+                }
+            }
+            GC.KeepAlive(rolling);
+        }
+
         [Fact]
         public void test_bind_parameter_index()
         {