Merge pull request #340 from sparklemotion/339-load-extension-segfault

fix: Database#load_extension check argument type

Author: flavorjones

CHANGELOG.md

@@ -44,6 +44,11 @@ You can opt-out of the packaged version of sqlite (and use your system-installed
 * `SQLite3::SQLITE_LOADED_VERSION` contains the version string of the sqlite3 library that is dynamically loaded (compare to `SQLite3::SQLITE_VERSION` which is the version at compile-time).
 
 
+### Fixed
+
+* `SQLite3::Database#load_extensions` now raises a `TypeError` unless a String is passed as the file path. Previously it was possible to pass a non-string and cause a segfault. [#339]
+
+
 ## 1.4.4 / 2022-06-14
 
 ### Fixes

ext/sqlite3/database.c

@@ -603,7 +603,7 @@ static VALUE load_extension(VALUE self, VALUE file)
   Data_Get_Struct(self, sqlite3Ruby, ctx);
   REQUIRE_OPEN_DB(ctx);
 
-  status = sqlite3_load_extension(ctx->db, RSTRING_PTR(file), 0, &errMsg);
+  status = sqlite3_load_extension(ctx->db, StringValuePtr(file), 0, &errMsg);
   if (status != SQLITE_OK)
   {
     errexp = rb_exc_new2(rb_eRuntimeError, errMsg);

test/test_database.rb

@@ -534,5 +534,12 @@ def test_strict_mode
       end
       assert_includes error.message, "no such column: nope"
     end
+
+    def test_load_extension_with_nonstring_argument
+      db = SQLite3::Database.new(':memory:')
+      skip("extensions are not enabled") unless db.respond_to?(:load_extension)
+      assert_raises(TypeError) { db.load_extension(1) }
+      assert_raises(TypeError) { db.load_extension(Pathname.new("foo.so")) }
+    end
   end
 end