summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorOleksandr Kravchuk <open.source@oleksandr-kravchuk.com>2019-05-07 18:11:09 +0200
committerRichard Purdie <richard.purdie@linuxfoundation.org>2019-05-08 23:00:32 +0100
commitfe5b1ceb4137c6f5511b8d07be2a517818b2d15d (patch)
tree4ab129ab662a5bb4cc3f13a25c0e381764785ef6
parentad200dfca8fa37cdfb315005f0baa01e21ad00a5 (diff)
downloadpoky-fe5b1ceb4137c6f5511b8d07be2a517818b2d15d.tar.gz
sqlite3: update to 3.28.0
(From OE-Core rev: 9be07e8c8eea8565df73405775ec2ffb60659118) Signed-off-by: Oleksandr Kravchuk <open.source@oleksandr-kravchuk.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
-rw-r--r--meta/recipes-support/sqlite/sqlite3/CVE-2019-9936.patch28
-rw-r--r--meta/recipes-support/sqlite/sqlite3/CVE-2019-9937.patch187
-rw-r--r--meta/recipes-support/sqlite/sqlite3_3.27.2.bb13
-rw-r--r--meta/recipes-support/sqlite/sqlite3_3.28.0.bb8
4 files changed, 8 insertions, 228 deletions
diff --git a/meta/recipes-support/sqlite/sqlite3/CVE-2019-9936.patch b/meta/recipes-support/sqlite/sqlite3/CVE-2019-9936.patch
deleted file mode 100644
index 1b907b9d4d..0000000000
--- a/meta/recipes-support/sqlite/sqlite3/CVE-2019-9936.patch
+++ /dev/null
@@ -1,28 +0,0 @@
1Running fts5 prefix queries inside a transaction could trigger a heap-based
2buffer over-read in fts5HashEntrySort in sqlite3.c, which may lead to an
3information leak.
4
5CVE: CVE-2019-9936
6Upstream-Status: Backport [https://sqlite.org/src/vpatch?from=45c73deb440496e8&to=b3fa58dd7403dbd4]
7Signed-off-by: Ross Burton <ross.burton@intel.com>
8---
9 sqlite3.c | 4 +++-
10 1 file changed, 3 insertions(+), 1 deletion(-)
11
12diff --git a/sqlite3.c b/sqlite3.c
13index 4729f45..65527d8 100644
14--- a/sqlite3.c
15+++ b/sqlite3.c
16@@ -207759,7 +207759,9 @@ static int fts5HashEntrySort(
17 for(iSlot=0; iSlot<pHash->nSlot; iSlot++){
18 Fts5HashEntry *pIter;
19 for(pIter=pHash->aSlot[iSlot]; pIter; pIter=pIter->pHashNext){
20- if( pTerm==0 || 0==memcmp(fts5EntryKey(pIter), pTerm, nTerm) ){
21+ if( pTerm==0
22+ || (pIter->nKey+1>=nTerm && 0==memcmp(fts5EntryKey(pIter), pTerm, nTerm))
23+ ){
24 Fts5HashEntry *pEntry = pIter;
25 pEntry->pScanNext = 0;
26 for(i=0; ap[i]; i++){
27--
282.20.1
diff --git a/meta/recipes-support/sqlite/sqlite3/CVE-2019-9937.patch b/meta/recipes-support/sqlite/sqlite3/CVE-2019-9937.patch
deleted file mode 100644
index baa5666dda..0000000000
--- a/meta/recipes-support/sqlite/sqlite3/CVE-2019-9937.patch
+++ /dev/null
@@ -1,187 +0,0 @@
1Interleaving reads and writes in a single transaction with an fts5 virtual table
2will lead to a NULL Pointer Dereference in fts5ChunkIterate in sqlite3.c.
3
4CVE: CVE-2019-9937
5Upstream-Status: Backport [https://sqlite.org/src/vpatch?from=c2f50aa4e7bad882&to=45c73deb440496e8]
6Signed-off-by: Ross Burton <ross.burton@intel.com>
7
8---
9 sqlite3.c | 83 ++++++++++++++++++++++++++++++++++++++-----------------
10 1 file changed, 57 insertions(+), 26 deletions(-)
11
12diff --git a/sqlite3.c b/sqlite3.c
13index 65527d8..b1a8799 100644
14--- a/sqlite3.c
15+++ b/sqlite3.c
16@@ -200668,8 +200668,9 @@ static void sqlite3Fts5HashClear(Fts5Hash*);
17
18 static int sqlite3Fts5HashQuery(
19 Fts5Hash*, /* Hash table to query */
20+ int nPre,
21 const char *pTerm, int nTerm, /* Query term */
22- const u8 **ppDoclist, /* OUT: Pointer to doclist for pTerm */
23+ void **ppObj, /* OUT: Pointer to doclist for pTerm */
24 int *pnDoclist /* OUT: Size of doclist in bytes */
25 );
26
27@@ -207501,19 +207502,25 @@ static int fts5HashResize(Fts5Hash *pHash){
28 return SQLITE_OK;
29 }
30
31-static void fts5HashAddPoslistSize(Fts5Hash *pHash, Fts5HashEntry *p){
32+static int fts5HashAddPoslistSize(
33+ Fts5Hash *pHash,
34+ Fts5HashEntry *p,
35+ Fts5HashEntry *p2
36+){
37+ int nRet = 0;
38 if( p->iSzPoslist ){
39- u8 *pPtr = (u8*)p;
40+ u8 *pPtr = p2 ? (u8*)p2 : (u8*)p;
41+ int nData = p->nData;
42 if( pHash->eDetail==FTS5_DETAIL_NONE ){
43- assert( p->nData==p->iSzPoslist );
44+ assert( nData==p->iSzPosList );
45 if( p->bDel ){
46- pPtr[p->nData++] = 0x00;
47+ pPtr[nData++] = 0x00;
48 if( p->bContent ){
49- pPtr[p->nData++] = 0x00;
50+ pPtr[nData++] = 0x00;
51 }
52 }
53 }else{
54- int nSz = (p->nData - p->iSzPoslist - 1); /* Size in bytes */
55+ int nSz = (nData - p->iSzPoslist - 1); /* Size in bytes */
56 int nPos = nSz*2 + p->bDel; /* Value of nPos field */
57
58 assert( p->bDel==0 || p->bDel==1 );
59@@ -207523,14 +207530,19 @@ static void fts5HashAddPoslistSize(Fts5Hash *pHash, Fts5HashEntry *p){
60 int nByte = sqlite3Fts5GetVarintLen((u32)nPos);
61 memmove(&pPtr[p->iSzPoslist + nByte], &pPtr[p->iSzPoslist + 1], nSz);
62 sqlite3Fts5PutVarint(&pPtr[p->iSzPoslist], nPos);
63- p->nData += (nByte-1);
64+ nData += (nByte-1);
65 }
66 }
67
68- p->iSzPoslist = 0;
69- p->bDel = 0;
70- p->bContent = 0;
71+ nRet = nData - p->nData;
72+ if( p2 == 0 ){
73+ p->iSzPoslist = 0;
74+ p->bDel = 0;
75+ p->bContent = 0;
76+ p->nData = nData;
77+ }
78 }
79+ return nRet;
80 }
81
82 /*
83@@ -207642,7 +207654,7 @@ static int sqlite3Fts5HashWrite(
84 /* If this is a new rowid, append the 4-byte size field for the previous
85 ** entry, and the new rowid for this entry. */
86 if( iRowid!=p->iRowid ){
87- fts5HashAddPoslistSize(pHash, p);
88+ fts5HashAddPoslistSize(pHash, p, 0);
89 p->nData += sqlite3Fts5PutVarint(&pPtr[p->nData], iRowid - p->iRowid);
90 p->iRowid = iRowid;
91 bNew = 1;
92@@ -207789,8 +207801,9 @@ static int fts5HashEntrySort(
93 */
94 static int sqlite3Fts5HashQuery(
95 Fts5Hash *pHash, /* Hash table to query */
96+ int nPre,
97 const char *pTerm, int nTerm, /* Query term */
98- const u8 **ppDoclist, /* OUT: Pointer to doclist for pTerm */
99+ void **ppOut, /* OUT: Pointer to new object */
100 int *pnDoclist /* OUT: Size of doclist in bytes */
101 ){
102 unsigned int iHash = fts5HashKey(pHash->nSlot, (const u8*)pTerm, nTerm);
103@@ -207804,11 +207817,20 @@ static int sqlite3Fts5HashQuery(
104 }
105
106 if( p ){
107- fts5HashAddPoslistSize(pHash, p);
108- *ppDoclist = (const u8*)&zKey[nTerm+1];
109- *pnDoclist = p->nData - (sizeof(Fts5HashEntry) + nTerm + 1);
110+ int nHashPre = sizeof(Fts5HashEntry) + nTerm + 1;
111+ int nList = p->nData - nHashPre;
112+ u8 *pRet = (u8*)(*ppOut = sqlite3_malloc64(nPre + nList + 10));
113+ if ( pRet ){
114+ Fts5HashEntry *pFaux = (Fts5HashEntry*)&pRet[nPre-nHashPre];
115+ memcpy(&pRet[nPre], &((u8*)p)[nHashPre], nList);
116+ nList += fts5HashAddPoslistSize(pHash, p, pFaux);
117+ *pnDoclist = nList;
118+ }else{
119+ *pnDoclist = 0;
120+ return SQLITE_NOMEM;
121+ }
122 }else{
123- *ppDoclist = 0;
124+ *ppOut = 0;
125 *pnDoclist = 0;
126 }
127
128@@ -207841,7 +207863,7 @@ static void sqlite3Fts5HashScanEntry(
129 if( (p = pHash->pScan) ){
130 char *zKey = fts5EntryKey(p);
131 int nTerm = (int)strlen(zKey);
132- fts5HashAddPoslistSize(pHash, p);
133+ fts5HashAddPoslistSize(pHash, p, 0);
134 *pzTerm = zKey;
135 *ppDoclist = (const u8*)&zKey[nTerm+1];
136 *pnDoclist = p->nData - (sizeof(Fts5HashEntry) + nTerm + 1);
137@@ -210311,31 +210333,40 @@ static void fts5SegIterHashInit(
138 int flags, /* Mask of FTS5INDEX_XXX flags */
139 Fts5SegIter *pIter /* Object to populate */
140 ){
141- const u8 *pList = 0;
142 int nList = 0;
143 const u8 *z = 0;
144 int n = 0;
145+ Fts5Data *pLeaf = 0;
146
147 assert( p->pHash );
148 assert( p->rc==SQLITE_OK );
149
150 if( pTerm==0 || (flags & FTS5INDEX_QUERY_SCAN) ){
151+ const u8 *pList = 0;
152+
153 p->rc = sqlite3Fts5HashScanInit(p->pHash, (const char*)pTerm, nTerm);
154 sqlite3Fts5HashScanEntry(p->pHash, (const char**)&z, &pList, &nList);
155 n = (z ? (int)strlen((const char*)z) : 0);
156+ if ( pList ){
157+ pLeaf = fts5IdxMalloc(p, sizeof(Fts5Data));
158+ if ( pLeaf ){
159+ pLeaf->p = pList;
160+ }
161+ }
162 }else{
163- pIter->flags |= FTS5_SEGITER_ONETERM;
164- sqlite3Fts5HashQuery(p->pHash, (const char*)pTerm, nTerm, &pList, &nList);
165+ p->rc = sqlite3Fts5HashQuery(p->pHash, sizeof(Fts5Data),
166+ (const char*)pTerm, nTerm, (void**)&pLeaf, &nList
167+ );
168+ if( pLeaf ){
169+ pLeaf->p = (u8*)&pLeaf[1];
170+ }
171 z = pTerm;
172 n = nTerm;
173+ pIter->flags |= FTS5_SEGITER_ONETERM;
174 }
175
176- if( pList ){
177- Fts5Data *pLeaf;
178+ if( pLeaf ){
179 sqlite3Fts5BufferSet(&p->rc, &pIter->term, n, z);
180- pLeaf = fts5IdxMalloc(p, sizeof(Fts5Data));
181- if( pLeaf==0 ) return;
182- pLeaf->p = (u8*)pList;
183 pLeaf->nn = pLeaf->szLeaf = nList;
184 pIter->pLeaf = pLeaf;
185 pIter->iLeafOffset = fts5GetVarint(pLeaf->p, (u64*)&pIter->iRowid);
186--
1872.20.1
diff --git a/meta/recipes-support/sqlite/sqlite3_3.27.2.bb b/meta/recipes-support/sqlite/sqlite3_3.27.2.bb
deleted file mode 100644
index 4bdb04f4d1..0000000000
--- a/meta/recipes-support/sqlite/sqlite3_3.27.2.bb
+++ /dev/null
@@ -1,13 +0,0 @@
1require sqlite3.inc
2
3LICENSE = "PD"
4LIC_FILES_CHKSUM = "file://sqlite3.h;endline=11;md5=786d3dc581eff03f4fd9e4a77ed00c66"
5
6SRC_URI = "\
7 http://www.sqlite.org/2019/sqlite-autoconf-${SQLITE_PV}.tar.gz \
8 file://CVE-2019-9936.patch \
9 file://CVE-2019-9937.patch \
10 "
11
12SRC_URI[md5sum] = "1f72631ce6e8efa5b4a6e55a43b3bdc0"
13SRC_URI[sha256sum] = "50c39e85ea28b5ecfdb3f9e860afe9ba606381e21836b2849efca6a0bfe6ef6e"
diff --git a/meta/recipes-support/sqlite/sqlite3_3.28.0.bb b/meta/recipes-support/sqlite/sqlite3_3.28.0.bb
new file mode 100644
index 0000000000..438a4ea471
--- /dev/null
+++ b/meta/recipes-support/sqlite/sqlite3_3.28.0.bb
@@ -0,0 +1,8 @@
1require sqlite3.inc
2
3LICENSE = "PD"
4LIC_FILES_CHKSUM = "file://sqlite3.h;endline=11;md5=786d3dc581eff03f4fd9e4a77ed00c66"
5
6SRC_URI = "http://www.sqlite.org/2019/sqlite-autoconf-${SQLITE_PV}.tar.gz"
7SRC_URI[md5sum] = "3c68eb400f8354605736cd55400e1572"
8SRC_URI[sha256sum] = "d61b5286f062adfce5125eaf544d495300656908e61fca143517afcc0a89b7c3"