libsql-sqlite3-parser UTF-8 Validation Vulnerability Leading to Crash

A vulnerability exists in the libsql-sqlite3-parser crate for Rust, specifically in versions through 0.13.0 prior to commit 14f422a. The issue arises in the dialect/mod.rs file, where the parser can crash when it encounters input that is not valid UTF-8. This is due to insufficient checks in the UTF-8 parsing, allowing invalid byte sequences to be processed unsafely, which can lead to a panic when the parser attempts to read the data.

Impact

Exploitation of this vulnerability can cause a crash, leading to a denial of service by causing the application to panic and terminate prematurely.

Reproduction

The vulnerability can be reproduced by using the libsql-sqlite3-parser crate to parse a SQL statement that includes invalid UTF-8 byte sequences. This can be done by creating a byte slice that contains the invalid UTF-8 data, such as a sequence that is not properly encoded, and appending it to a valid SQL command. When the parser processes this input, it will crash due to the invalid UTF-8, demonstrating the vulnerability.