#7314·mumble

DataType::fromSQLRepresentation leaks std::out_of_range for an oversized size

Author: amdadulbariCreated Sep 1, 2026Updated Sep 2, 2026
Labelsserverbug

Description

DataType::fromSQLRepresentation() parses the size out of a SQL type string with std::stoull, but only catches one of the two exceptions std::stoull can throw:

cpp
try {
    size = std::stoull(strRepr.substr(i + 1, strRepr.size() - 1));
} catch (const std::invalid_argument &e) {
    throw UnknownDataTypeException("Size of data type \"" + strRepr + "\" could not be parsed: " + e.what());
}

std::stoull throws std::invalid_argument for a non-numeric size and std::out_of_range when the value exceeds unsigned long long. Only std::invalid_argument is caught, so an out-of-range size escapes as a raw std::out_of_range.

The caller Table::importFromJSON() (src/database/Table.cpp) deliberately catches only UnknownDataTypeException and rethrows it as a FormatException; a leaked std::out_of_range bypasses that and propagates uncaught out of the import path (which otherwise promises a clean FormatException for malformed input).

How to reproduce

cpp
DataType::fromSQLRepresentation("VARCHAR(99999999999999999999)"); // 20-digit size

throws std::out_of_range instead of UnknownDataTypeException. Reachable via Database::importFromJSON with a crafted column type in the imported JSON.

Fix

Catch std::logic_error (the common base of both std::invalid_argument and std::out_of_range) so any std::stoull failure is funneled into UnknownDataTypeException.