[PATCH] lib-sql: driver-sqlite - Use sqlite3_snprintf() to quote values

This does it the sqlite3 way.

Gbp-Pq: Name 0001-lib-sql-driver-sqlite-Use-sqlite3_snprintf-to-quote-.patch

diff --git a/src/lib-sql/driver-sqlite.c b/src/lib-sql/driver-sqlite.c
index 282a83bbf47039a35659ac9949cff923bc58d88b..06903b8d120c321b4010e603e4de655897163a46 100644 (file)
--- a/src/lib-sql/driver-sqlite.c
+++ b/src/lib-sql/driver-sqlite.c
@@ -225,30 +225,11 @@ static const char *
 driver_sqlite_escape_string(struct sql_db *_db ATTR_UNUSED,
                            const char *string)
 {
-       const char *p;
-       char *dest, *destbegin;
-
-       /* find the first ' */
-       for (p = string; *p != '\''; p++) {
-               if (*p == '\0')
-                       return t_strdup_noconst(string);
-       }
-
-       /* @UNSAFE: escape ' with '' */
-       dest = destbegin = t_buffer_get((p - string) + strlen(string) * 2 + 1);
-
-       memcpy(dest, string, p - string);
-       dest += p - string;
-
-       for (; *p != '\0'; p++) {
-               *dest++ = *p;
-               if (*p == '\'')
-                       *dest++ = *p;
-       }
-       *dest++ = '\0';
-       t_buffer_alloc(dest - destbegin);
-
-       return destbegin;
+       const size_t len = strlen(string) * 2 + 1;
+       char *escaped = t_malloc_no0(len);
+       if (sqlite3_snprintf(len, escaped, "%q", string) == NULL)
+               i_unreached();
+       return escaped;
 }
 
 static const char *