sqlite3-ruby cast Ruby string lengths (long) to int before passing them to SQLite. On 64-bit platforms, a string of 4 GiB (2^32 bytes) or larger had its length wrap, so SQLite saw only the first length mod 2^32 bytes. An attacker who controls the length of a SQL string could truncate the query, for example dropping a trailing WHERE clause. The affected paths are:

• the SQL passed to Database#prepare, #execute, and related methods
• String and Blob values passed to Statement#bind_param and related methods
• String and Blob values returned from SQL functions and aggregates defined in Ruby (Database#create_function, #create_aggregate, and related methods)

AFTER PATCH

sqlite3 v2.10.2 raises RangeError when any of these strings is longer than INT_MAX bytes.

Credit

This issue was responsibly reported by Luke Jahnke from elttam.