diff options
author | Steve Sakoman <steve@sakoman.com> | 2020-11-04 06:12:31 -1000 |
---|---|---|
committer | Richard Purdie <richard.purdie@linuxfoundation.org> | 2020-11-12 13:07:52 +0000 |
commit | e70374e51dbca77176d561d4bdbaef5a464f6c07 (patch) | |
tree | 292c1bc20bd45b0d0f7ad2c5eae01d50d5f82b44 /meta | |
parent | 74d50ba1bd41e086fb5aaf56128e2ce8b4758e05 (diff) | |
download | poky-e70374e51dbca77176d561d4bdbaef5a464f6c07.tar.gz |
sqlite3: fix CVE-2020-13435
CVE: CVE-2020-13435
Reference: https://nvd.nist.gov/vuln/detail/CVE-2020-13435
(From OE-Core rev: 4780662ebaba0931ac0084d40670d9be93c0da9b)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta')
-rw-r--r-- | meta/recipes-support/sqlite/files/CVE-2020-13435.patch | 219 | ||||
-rw-r--r-- | meta/recipes-support/sqlite/sqlite3_3.31.1.bb | 1 |
2 files changed, 220 insertions, 0 deletions
diff --git a/meta/recipes-support/sqlite/files/CVE-2020-13435.patch b/meta/recipes-support/sqlite/files/CVE-2020-13435.patch new file mode 100644 index 0000000000..d726e50a27 --- /dev/null +++ b/meta/recipes-support/sqlite/files/CVE-2020-13435.patch | |||
@@ -0,0 +1,219 @@ | |||
1 | From e40cc16b472071f553700c7208394e6cf73d5688 Mon Sep 17 00:00:00 2001 | ||
2 | From: drh <drh@noemail.net> | ||
3 | Date: Sun, 24 May 2020 03:01:36 +0000 | ||
4 | Subject: [PATCH] Combination of patches to fix CVE2020-13435 | ||
5 | |||
6 | Combines: | ||
7 | |||
8 | Move some utility Walker callbacks into the walker.c source file, as they seem to belong there better. | ||
9 | When rewriting a query for window functions, if the rewrite changes the depth of TK_AGG_FUNCTION nodes, be sure to adjust the Expr.op2 field appropriately. Fix for ticket [7a5279a25c57adf1] | ||
10 | Defensive code that tries to prevent a recurrence of problems like the one described in ticket [7a5279a25c57adf1] | ||
11 | |||
12 | FossilOrigin-Name: dac438236f7c5419d4e7e094e8b3f19f83cd3b1a18bc8acb14aee90d4514fa3c | ||
13 | FossilOrigin-Name: ad7bb70af9bb68d192137188bb2528f1e9e43ad164c925174ca1dafc9e1f5339 | ||
14 | FossilOrigin-Name: 572105de1d44bca4f18c99d373458889163611384eebbc9659474874ee1701f4 | ||
15 | |||
16 | Upstream-Status: Backport | ||
17 | CVE: CVE-2020-13435 | ||
18 | |||
19 | Reference to upstream patches: | ||
20 | https://github.com/sqlite/sqlite/commit/e40cc16b472071f553700c7208394e6cf73d5688 | ||
21 | https://github.com/sqlite/sqlite/commit/c37577bb2dfb602a5cdbba8322a01b548c34c185 | ||
22 | https://github.com/sqlite/sqlite/commit/0934d640456bb168a8888ae388643c5160afe501 | ||
23 | |||
24 | Patches combined and converted to amalgamation format | ||
25 | |||
26 | Signed-off-by: Steve Sakoman <steve@sakoman.com> | ||
27 | --- | ||
28 | diff --git a/sqlite3.c b/sqlite3.c | ||
29 | index 5ff2c14..02892f8 100644 | ||
30 | --- a/sqlite3.c | ||
31 | +++ b/sqlite3.c | ||
32 | @@ -18965,6 +18965,9 @@ SQLITE_PRIVATE int sqlite3WalkSelectFrom(Walker*, Select*); | ||
33 | SQLITE_PRIVATE int sqlite3ExprWalkNoop(Walker*, Expr*); | ||
34 | SQLITE_PRIVATE int sqlite3SelectWalkNoop(Walker*, Select*); | ||
35 | SQLITE_PRIVATE int sqlite3SelectWalkFail(Walker*, Select*); | ||
36 | +SQLITE_PRIVATE int sqlite3WalkerDepthIncrease(Walker*,Select*); | ||
37 | +SQLITE_PRIVATE void sqlite3WalkerDepthDecrease(Walker*,Select*); | ||
38 | + | ||
39 | #ifdef SQLITE_DEBUG | ||
40 | SQLITE_PRIVATE void sqlite3SelectWalkAssert2(Walker*, Select*); | ||
41 | #endif | ||
42 | @@ -96773,6 +96776,43 @@ SQLITE_PRIVATE int sqlite3WalkSelect(Walker *pWalker, Select *p){ | ||
43 | return WRC_Continue; | ||
44 | } | ||
45 | |||
46 | +/* Increase the walkerDepth when entering a subquery, and | ||
47 | +** descrease when leaving the subquery. | ||
48 | +*/ | ||
49 | +SQLITE_PRIVATE int sqlite3WalkerDepthIncrease(Walker *pWalker, Select *pSelect){ | ||
50 | + UNUSED_PARAMETER(pSelect); | ||
51 | + pWalker->walkerDepth++; | ||
52 | + return WRC_Continue; | ||
53 | +} | ||
54 | +SQLITE_PRIVATE void sqlite3WalkerDepthDecrease(Walker *pWalker, Select *pSelect){ | ||
55 | + UNUSED_PARAMETER(pSelect); | ||
56 | + pWalker->walkerDepth--; | ||
57 | +} | ||
58 | + | ||
59 | + | ||
60 | +/* | ||
61 | +** No-op routine for the parse-tree walker. | ||
62 | +** | ||
63 | +** When this routine is the Walker.xExprCallback then expression trees | ||
64 | +** are walked without any actions being taken at each node. Presumably, | ||
65 | +** when this routine is used for Walker.xExprCallback then | ||
66 | +** Walker.xSelectCallback is set to do something useful for every | ||
67 | +** subquery in the parser tree. | ||
68 | +*/ | ||
69 | +SQLITE_PRIVATE int sqlite3ExprWalkNoop(Walker *NotUsed, Expr *NotUsed2){ | ||
70 | + UNUSED_PARAMETER2(NotUsed, NotUsed2); | ||
71 | + return WRC_Continue; | ||
72 | +} | ||
73 | + | ||
74 | +/* | ||
75 | +** No-op routine for the parse-tree walker for SELECT statements. | ||
76 | +** subquery in the parser tree. | ||
77 | +*/ | ||
78 | +SQLITE_PRIVATE int sqlite3SelectWalkNoop(Walker *NotUsed, Select *NotUsed2){ | ||
79 | + UNUSED_PARAMETER2(NotUsed, NotUsed2); | ||
80 | + return WRC_Continue; | ||
81 | +} | ||
82 | + | ||
83 | /************** End of walker.c **********************************************/ | ||
84 | /************** Begin file resolve.c *****************************************/ | ||
85 | /* | ||
86 | @@ -96801,6 +96841,8 @@ SQLITE_PRIVATE int sqlite3WalkSelect(Walker *pWalker, Select *p){ | ||
87 | ** | ||
88 | ** incrAggFunctionDepth(pExpr,n) is the main routine. incrAggDepth(..) | ||
89 | ** is a helper function - a callback for the tree walker. | ||
90 | +** | ||
91 | +** See also the sqlite3WindowExtraAggFuncDepth() routine in window.c | ||
92 | */ | ||
93 | static int incrAggDepth(Walker *pWalker, Expr *pExpr){ | ||
94 | if( pExpr->op==TK_AGG_FUNCTION ) pExpr->op2 += pWalker->u.n; | ||
95 | @@ -102459,7 +102501,10 @@ expr_code_doover: | ||
96 | switch( op ){ | ||
97 | case TK_AGG_COLUMN: { | ||
98 | AggInfo *pAggInfo = pExpr->pAggInfo; | ||
99 | - struct AggInfo_col *pCol = &pAggInfo->aCol[pExpr->iAgg]; | ||
100 | + struct AggInfo_col *pCol; | ||
101 | + assert( pAggInfo!=0 ); | ||
102 | + assert( pExpr->iAgg>=0 && pExpr->iAgg<pAggInfo->nColumn ); | ||
103 | + pCol = &pAggInfo->aCol[pExpr->iAgg]; | ||
104 | if( !pAggInfo->directMode ){ | ||
105 | assert( pCol->iMem>0 ); | ||
106 | return pCol->iMem; | ||
107 | @@ -102753,7 +102798,10 @@ expr_code_doover: | ||
108 | } | ||
109 | case TK_AGG_FUNCTION: { | ||
110 | AggInfo *pInfo = pExpr->pAggInfo; | ||
111 | - if( pInfo==0 ){ | ||
112 | + if( pInfo==0 | ||
113 | + || NEVER(pExpr->iAgg<0) | ||
114 | + || NEVER(pExpr->iAgg>=pInfo->nFunc) | ||
115 | + ){ | ||
116 | assert( !ExprHasProperty(pExpr, EP_IntValue) ); | ||
117 | sqlite3ErrorMsg(pParse, "misuse of aggregate: %s()", pExpr->u.zToken); | ||
118 | }else{ | ||
119 | @@ -104492,15 +104540,6 @@ static int analyzeAggregate(Walker *pWalker, Expr *pExpr){ | ||
120 | } | ||
121 | return WRC_Continue; | ||
122 | } | ||
123 | -static int analyzeAggregatesInSelect(Walker *pWalker, Select *pSelect){ | ||
124 | - UNUSED_PARAMETER(pSelect); | ||
125 | - pWalker->walkerDepth++; | ||
126 | - return WRC_Continue; | ||
127 | -} | ||
128 | -static void analyzeAggregatesInSelectEnd(Walker *pWalker, Select *pSelect){ | ||
129 | - UNUSED_PARAMETER(pSelect); | ||
130 | - pWalker->walkerDepth--; | ||
131 | -} | ||
132 | |||
133 | /* | ||
134 | ** Analyze the pExpr expression looking for aggregate functions and | ||
135 | @@ -104514,8 +104553,8 @@ static void analyzeAggregatesInSelectEnd(Walker *pWalker, Select *pSelect){ | ||
136 | SQLITE_PRIVATE void sqlite3ExprAnalyzeAggregates(NameContext *pNC, Expr *pExpr){ | ||
137 | Walker w; | ||
138 | w.xExprCallback = analyzeAggregate; | ||
139 | - w.xSelectCallback = analyzeAggregatesInSelect; | ||
140 | - w.xSelectCallback2 = analyzeAggregatesInSelectEnd; | ||
141 | + w.xSelectCallback = sqlite3WalkerDepthIncrease; | ||
142 | + w.xSelectCallback2 = sqlite3WalkerDepthDecrease; | ||
143 | w.walkerDepth = 0; | ||
144 | w.u.pNC = pNC; | ||
145 | w.pParse = 0; | ||
146 | @@ -133065,29 +133104,6 @@ static int selectExpander(Walker *pWalker, Select *p){ | ||
147 | return WRC_Continue; | ||
148 | } | ||
149 | |||
150 | -/* | ||
151 | -** No-op routine for the parse-tree walker. | ||
152 | -** | ||
153 | -** When this routine is the Walker.xExprCallback then expression trees | ||
154 | -** are walked without any actions being taken at each node. Presumably, | ||
155 | -** when this routine is used for Walker.xExprCallback then | ||
156 | -** Walker.xSelectCallback is set to do something useful for every | ||
157 | -** subquery in the parser tree. | ||
158 | -*/ | ||
159 | -SQLITE_PRIVATE int sqlite3ExprWalkNoop(Walker *NotUsed, Expr *NotUsed2){ | ||
160 | - UNUSED_PARAMETER2(NotUsed, NotUsed2); | ||
161 | - return WRC_Continue; | ||
162 | -} | ||
163 | - | ||
164 | -/* | ||
165 | -** No-op routine for the parse-tree walker for SELECT statements. | ||
166 | -** subquery in the parser tree. | ||
167 | -*/ | ||
168 | -SQLITE_PRIVATE int sqlite3SelectWalkNoop(Walker *NotUsed, Select *NotUsed2){ | ||
169 | - UNUSED_PARAMETER2(NotUsed, NotUsed2); | ||
170 | - return WRC_Continue; | ||
171 | -} | ||
172 | - | ||
173 | #if SQLITE_DEBUG | ||
174 | /* | ||
175 | ** Always assert. This xSelectCallback2 implementation proves that the | ||
176 | @@ -150225,6 +150241,23 @@ static ExprList *exprListAppendList( | ||
177 | return pList; | ||
178 | } | ||
179 | |||
180 | +/* | ||
181 | +** When rewriting a query, if the new subquery in the FROM clause | ||
182 | +** contains TK_AGG_FUNCTION nodes that refer to an outer query, | ||
183 | +** then we have to increase the Expr->op2 values of those nodes | ||
184 | +** due to the extra subquery layer that was added. | ||
185 | +** | ||
186 | +** See also the incrAggDepth() routine in resolve.c | ||
187 | +*/ | ||
188 | +static int sqlite3WindowExtraAggFuncDepth(Walker *pWalker, Expr *pExpr){ | ||
189 | + if( pExpr->op==TK_AGG_FUNCTION | ||
190 | + && pExpr->op2>=pWalker->walkerDepth | ||
191 | + ){ | ||
192 | + pExpr->op2++; | ||
193 | + } | ||
194 | + return WRC_Continue; | ||
195 | +} | ||
196 | + | ||
197 | /* | ||
198 | ** If the SELECT statement passed as the second argument does not invoke | ||
199 | ** any SQL window functions, this function is a no-op. Otherwise, it | ||
200 | @@ -150333,6 +150366,7 @@ SQLITE_PRIVATE int sqlite3WindowRewrite(Parse *pParse, Select *p){ | ||
201 | p->pSrc = sqlite3SrcListAppend(pParse, 0, 0, 0); | ||
202 | if( p->pSrc ){ | ||
203 | Table *pTab2; | ||
204 | + Walker w; | ||
205 | p->pSrc->a[0].pSelect = pSub; | ||
206 | sqlite3SrcListAssignCursors(pParse, p->pSrc); | ||
207 | pSub->selFlags |= SF_Expanded; | ||
208 | @@ -150347,6 +150381,11 @@ SQLITE_PRIVATE int sqlite3WindowRewrite(Parse *pParse, Select *p){ | ||
209 | pTab->tabFlags |= TF_Ephemeral; | ||
210 | p->pSrc->a[0].pTab = pTab; | ||
211 | pTab = pTab2; | ||
212 | + memset(&w, 0, sizeof(w)); | ||
213 | + w.xExprCallback = sqlite3WindowExtraAggFuncDepth; | ||
214 | + w.xSelectCallback = sqlite3WalkerDepthIncrease; | ||
215 | + w.xSelectCallback2 = sqlite3WalkerDepthDecrease; | ||
216 | + sqlite3WalkSelect(&w, pSub); | ||
217 | } | ||
218 | }else{ | ||
219 | sqlite3SelectDelete(db, pSub); | ||
diff --git a/meta/recipes-support/sqlite/sqlite3_3.31.1.bb b/meta/recipes-support/sqlite/sqlite3_3.31.1.bb index c8225fff15..4ef1da703b 100644 --- a/meta/recipes-support/sqlite/sqlite3_3.31.1.bb +++ b/meta/recipes-support/sqlite/sqlite3_3.31.1.bb | |||
@@ -9,6 +9,7 @@ SRC_URI = "http://www.sqlite.org/2020/sqlite-autoconf-${SQLITE_PV}.tar.gz \ | |||
9 | file://CVE-2020-11655.patch \ | 9 | file://CVE-2020-11655.patch \ |
10 | file://CVE-2020-15358.patch \ | 10 | file://CVE-2020-15358.patch \ |
11 | file://CVE-2020-13434.patch \ | 11 | file://CVE-2020-13434.patch \ |
12 | file://CVE-2020-13435.patch \ | ||
12 | " | 13 | " |
13 | SRC_URI[md5sum] = "2d0a553534c521504e3ac3ad3b90f125" | 14 | SRC_URI[md5sum] = "2d0a553534c521504e3ac3ad3b90f125" |
14 | SRC_URI[sha256sum] = "62284efebc05a76f909c580ffa5c008a7d22a1287285d68b7825a2b6b51949ae" | 15 | SRC_URI[sha256sum] = "62284efebc05a76f909c580ffa5c008a7d22a1287285d68b7825a2b6b51949ae" |