Fix infinite loop

c_src/sqlite3_drv.c

@@ -365,20 +365,24 @@ static inline int decode_and_bind_param(
   case ERL_BINARY_EXT:
     char_buf_val = driver_alloc(*p_size * sizeof(char));
     ei_decode_binary(buffer, p_index, char_buf_val, &bin_size);
-    // assert(bin_size == *p_size)
     result = sqlite3_bind_text(statement, param_index, char_buf_val, *p_size, &driver_free_fun);
     break;
   case ERL_SMALL_TUPLE_EXT:
     // assume this is {blob, Blob}
     ei_get_type(buffer, p_index, p_type, p_size);
     ei_decode_tuple_header(buffer, p_index, p_size);
-    assert (*p_size == 2);
+    if (*p_size != 2) {
+      output_error(drv, SQLITE_MISUSE, "bad parameter type");
+      return 1;
+    }
     ei_skip_term(buffer, p_index); // skipped the atom 'blob'
     ei_get_type(buffer, p_index, p_type, p_size);
-    assert (*p_type == ERL_BINARY_EXT);
+    if (*p_type != ERL_BINARY_EXT) {
+      output_error(drv, SQLITE_MISUSE, "bad parameter type");
+      return 1;
+    }
     char_buf_val = driver_alloc(*p_size * sizeof(char));
     ei_decode_binary(buffer, p_index, char_buf_val, &bin_size);
-    // assert(bin_size == *p_size)
     result = sqlite3_bind_blob(statement, param_index, char_buf_val, *p_size, &driver_free_fun);
     break;
   default:
@@ -399,9 +403,16 @@ static int bind_parameters(
   int i, cur_list_size = -1, param_index = 1, param_indices_are_explicit = 0, result = 0;
   long param_index_long;
   char param_name[MAXATOMLEN + 1]; // parameter names shouldn't be longer than 256!
-  while (*p_index < buffer_size) {
-    ei_decode_list_header(buffer, p_index, &cur_list_size);
+  result = ei_decode_list_header(buffer, p_index, &cur_list_size);
+  if (result) {
+    return output_error(drv, SQLITE_ERROR,
+                        "error while binding parameters");
+  }
   for (i = 0; i < cur_list_size; i++) {
+    if (*p_index >= buffer_size) {
+      return output_error(drv, SQLITE_ERROR,
+                          "error while binding parameters");
+    }
     ei_get_type(buffer, p_index, p_type, p_size);
     if (*p_type == ERL_SMALL_TUPLE_EXT) {
       int old_index = *p_index;
@@ -470,7 +481,6 @@ static int bind_parameters(
       ++param_index;
     }
   }
-  }
   return result;
 }
 
@@ -516,7 +526,7 @@ static int sql_bind_and_exec(sqlite3_drv_t *drv, char *buffer, int buffer_size)
 
   ei_decode_version(buffer, &index, NULL);
   result = ei_decode_tuple_header(buffer, &index, &size);
-  if (size != 2) {
+  if (result || (size != 2)) {
     return output_error(drv, SQLITE_MISUSE,
                         "Expected a tuple of SQL command and params");
   }