fix(native): bound strfilter output to the searched string bytes

src/main/ext/extension-functions.c

@@ -976,13 +976,13 @@ static void strfilterFunc(sqlite3_context *context, int argc, sqlite3_value **ar
       while( (c2=sqliteCharVal((unsigned char *)z21))!=0 && c2!=c1 ){
         sqliteNextChar(z21);
       }
+      z22=z1;
+      sqliteNextChar(z22);
       if( c2!=0){
-        z22=z21;
-        sqliteNextChar(z22);
-        strncpy(zot, z21, z22-z21);
-        zot+=z22-z21;
+        strncpy(zot, z1, z22-z1);
+        zot+=z22-z1;
       }
-      sqliteNextChar(z1);
+      z1=z22;
     }
     *zot = '\0';
 

src/test/java/org/sqlite/ExtensionTest.java

@@ -114,6 +114,32 @@ public void extFunctionsTruncatedUtf8() throws Exception {
         rs.close();
     }
 
+    @Test
+    @DisabledInNativeImage // assertj Assumptions do not work in native-image tests
+    public void strfilterMatchingWiderCharacter() throws Exception {
+        Utils.assumeJdbcExtensions(conn);
+
+        // strfilter sizes its output buffer by the byte length of the searched
+        // string, but when a character is kept it used to copy the matching
+        // character's bytes from the filter string. A single-byte searched
+        // character (here the invalid byte 0xff, which decodes to U+FFFD) that
+        // matches a wider filter character (U+FFFD, three bytes) made the copy
+        // write more bytes than were allocated, a heap overflow. The overflow is
+        // small enough to land in allocator slack, so check the bytes instead:
+        // the kept character must be the searched string's own 0xff, not the
+        // filter's EF BF BD. getString cannot tell them apart, hence hex().
+        ResultSet rs = stat.executeQuery("select hex(strfilter(cast(x'ff' as text), char(65533)))");
+        assertThat(rs.next()).isTrue();
+        assertThat(rs.getString(1)).isEqualTo("FF");
+        rs.close();
+
+        // well-formed input where a kept character is multibyte still filters
+        rs = stat.executeQuery("select strfilter('a£b€c', '£€')");
+        assertThat(rs.next()).isTrue();
+        assertThat(rs.getString(1)).isEqualTo("£€");
+        rs.close();
+    }
+
     private void assertReturnsRow(String sql) throws Exception {
         try (ResultSet rs = stat.executeQuery(sql)) {
             assertThat(rs.next()).isTrue();