diff options
author | Ross Burton <ross.burton@intel.com> | 2020-03-11 11:49:19 +0200 |
---|---|---|
committer | Richard Purdie <richard.purdie@linuxfoundation.org> | 2020-03-19 09:57:50 +0000 |
commit | 61210237a7d304a0e2eeef9f9f224a9cf337cdb9 (patch) | |
tree | 81002208fae0bea7b89479207acd84aa5a9547e0 /meta/recipes-support/sqlite/sqlite3/CVE-2019-19923.patch | |
parent | 983a51fd1d8b8fe97f4486c58713a1af39cdfc56 (diff) | |
download | poky-61210237a7d304a0e2eeef9f9f224a9cf337cdb9.tar.gz |
sqlite: fix numerous CVEs
Fix the following CVEs:
- CVE-2019-19244
- CVE-2019-19923
- CVE-2019-19924
- CVE-2019-19925
- CVE-2019-19926
- CVE-2019-19959
- CVE-2019-20218
(From OE-Core rev: feb8982ac6670af3bcb1243b51054bba9b027c83)
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
[ removed the CVE-2019-19880 fix that did not apply cleanly ]
Signed-off-by: Adrian Bunk <bunk@stusta.de>
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta/recipes-support/sqlite/sqlite3/CVE-2019-19923.patch')
-rw-r--r-- | meta/recipes-support/sqlite/sqlite3/CVE-2019-19923.patch | 50 |
1 files changed, 50 insertions, 0 deletions
diff --git a/meta/recipes-support/sqlite/sqlite3/CVE-2019-19923.patch b/meta/recipes-support/sqlite/sqlite3/CVE-2019-19923.patch new file mode 100644 index 0000000000..b1b866b250 --- /dev/null +++ b/meta/recipes-support/sqlite/sqlite3/CVE-2019-19923.patch | |||
@@ -0,0 +1,50 @@ | |||
1 | CVE: CVE-2019-19923 | ||
2 | Upstream-Status: Backport | ||
3 | Signed-off-by: Ross Burton <ross.burton@intel.com> | ||
4 | |||
5 | From b64463719dc53bde98b0ce3930b10a32560c3a02 Mon Sep 17 00:00:00 2001 | ||
6 | From: "D. Richard Hipp" <drh@hwaci.com> | ||
7 | Date: Wed, 18 Dec 2019 20:51:58 +0000 | ||
8 | Subject: [PATCH] Continue to back away from the LEFT JOIN optimization of | ||
9 | check-in [41c27bc0ff1d3135] by disallowing query flattening if the outer | ||
10 | query is DISTINCT. Without this fix, if an index scan is run on the table | ||
11 | within the view on the right-hand side of the LEFT JOIN, stale result | ||
12 | registers might be accessed yielding incorrect results, and/or an | ||
13 | OP_IfNullRow opcode might be invoked on the un-opened table, resulting in a | ||
14 | NULL-pointer dereference. This problem was found by the Yongheng and Rui | ||
15 | fuzzer. | ||
16 | |||
17 | FossilOrigin-Name: 862974312edf00e9d1068115d1a39b7235b7db68b6d86b81d38a12f025a4748e | ||
18 | --- | ||
19 | sqlite3.c | 10 +++++++--- | ||
20 | 1 file changed, 7 insertions(+), 3 deletions(-) | ||
21 | |||
22 | diff --git a/sqlite3.c b/sqlite3.c | ||
23 | index d29da07..5bc06c8 100644 | ||
24 | --- a/sqlite3.c | ||
25 | +++ b/sqlite3.c | ||
26 | @@ -129216,6 +129216,7 @@ static void substSelect( | ||
27 | ** (3b) the FROM clause of the subquery may not contain a virtual | ||
28 | ** table and | ||
29 | ** (3c) the outer query may not be an aggregate. | ||
30 | +** (3d) the outer query may not be DISTINCT. | ||
31 | ** | ||
32 | ** (4) The subquery can not be DISTINCT. | ||
33 | ** | ||
34 | @@ -129412,8 +129413,11 @@ static int flattenSubquery( | ||
35 | */ | ||
36 | if( (pSubitem->fg.jointype & JT_OUTER)!=0 ){ | ||
37 | isLeftJoin = 1; | ||
38 | - if( pSubSrc->nSrc>1 || isAgg || IsVirtual(pSubSrc->a[0].pTab) ){ | ||
39 | - /* (3a) (3c) (3b) */ | ||
40 | + if( pSubSrc->nSrc>1 /* (3a) */ | ||
41 | + || isAgg /* (3b) */ | ||
42 | + || IsVirtual(pSubSrc->a[0].pTab) /* (3c) */ | ||
43 | + || (p->selFlags & SF_Distinct)!=0 /* (3d) */ | ||
44 | + ){ | ||
45 | return 0; | ||
46 | } | ||
47 | } | ||
48 | -- | ||
49 | 2.24.1 | ||
50 | |||