1 files changed, 126 insertions, 0 deletions
diff --git a/meta/recipes-support/sqlite/files/CVE-2019-8457.patch b/meta/recipes-support/sqlite/files/CVE-2019-8457.patch
new file mode 100644
index 0000000000..5883774e4a
--- /dev/null
+++ b/meta/recipes-support/sqlite/files/CVE-2019-8457.patch
@@ -0,0 +1,126 @@
+From fbf2392644f0ae4282fa4583c9bb67260995d983 Mon Sep 17 00:00:00 2001
+From: Shubham Agrawal <shuagr@microsoft.com>
+Date: Mon, 23 Sep 2019 20:58:47 +0000
+Subject: [PATCH] sqlite: fix for CVE-2019-8457
+Upstream-Status: Backport
+CVE: CVE-2019-8457
+Signed-off-by: Shubham Agrawal <shuagr@microsoft.com>
+---
+ sqlite3.c | 50 +++++++++++++++++++++++++++++++-------------------
+ 1 file changed, 31 insertions(+), 19 deletions(-)
+diff --git a/sqlite3.c b/sqlite3.c
+index 00513d4..5c8c7f4 100644
+--- a/sqlite3.c
+++ b/sqlite3.c
+@@ -172325,6 +172325,33 @@
+ }
+ 
+ 
+/* Allocate and initialize a new dynamic string object */
+StrAccum *sqlite3_str_new(sqlite3 *db){
+  StrAccum *p = sqlite3DbMallocRaw(db, sizeof(*p));
+  if( p ){
+    sqlite3StrAccumInit(p, db, 0, 0, SQLITE_MAX_LENGTH);
+  }
+  return p;
+}
+
+/* Finalize a string created using sqlite3_str_new().
+*/
+
+char *sqlite3_str_finish(StrAccum *p){
+  char *z;
+  if( p ){
+    z = sqlite3StrAccumFinish(p);
+    sqlite3DbFree(p->db, p);
+  }else{
+    z = 0;
+  }
+  return z;
+}
+/* Return any error code associated with p */
+int sqlite3_str_errcode(StrAccum *p){
+  return p ? p->accError : SQLITE_NOMEM;
+}
+
+ /*
+ ** Implementation of a scalar function that decodes r-tree nodes to
+ ** human readable strings. This can be used for debugging and analysis.
+@@ -172342,49 +172369,53 @@
+ ** <num-dimension>*2 coordinates.
+ */
+ static void rtreenode(sqlite3_context *ctx, int nArg, sqlite3_value **apArg){
+-  char *zText = 0;
+
+   RtreeNode node;
+   Rtree tree;
+   int ii;
+  int nData;
+  int errCode;
+  StrAccum *pOut;
+ 
+   UNUSED_PARAMETER(nArg);
+   memset(&node, 0, sizeof(RtreeNode));
+   memset(&tree, 0, sizeof(Rtree));
+   tree.nDim = (u8)sqlite3_value_int(apArg[0]);
+  if( tree.nDim<1 || tree.nDim>5 ) return;
+   tree.nDim2 = tree.nDim*2;
+   tree.nBytesPerCell = 8 + 8 * tree.nDim;
+   node.zData = (u8 *)sqlite3_value_blob(apArg[1]);
+  nData = sqlite3_value_bytes(apArg[1]);
+  if( nData<4 ) return;
+  if( nData<NCELL(&node)*tree.nBytesPerCell ) return;
+ 
+  pOut = sqlite3_str_new(0);
+   for(ii=0; ii<NCELL(&node); ii++){
+-    char zCell[512];
+-    int nCell = 0;
+
+
+     RtreeCell cell;
+     int jj;
+ 
+     nodeGetCell(&tree, &node, ii, &cell);
+-    sqlite3_snprintf(512-nCell,&zCell[nCell],"%lld", cell.iRowid);
+-    nCell = (int)strlen(zCell);
+    if( ii>0 ) sqlite3StrAccumAppend(pOut, " ", 1);
+    sqlite3XPrintf(pOut, "{%lld", cell.iRowid);
+
+     for(jj=0; jj<tree.nDim2; jj++){
+ #ifndef SQLITE_RTREE_INT_ONLY
+-      sqlite3_snprintf(512-nCell,&zCell[nCell], " %g",
+-                       (double)cell.aCoord[jj].f);
+
+      sqlite3XPrintf(pOut, " %g", (double)cell.aCoord[jj].f);
+ #else
+-      sqlite3_snprintf(512-nCell,&zCell[nCell], " %d",
+-                       cell.aCoord[jj].i);
+
+      sqlite3XPrintf(pOut, " %d", cell.aCoord[jj].i);
+ #endif
+-      nCell = (int)strlen(zCell);
+-    }
+ 
+-    if( zText ){
+-      char *zTextNew = sqlite3_mprintf("%s {%s}", zText, zCell);
+-      sqlite3_free(zText);
+-      zText = zTextNew;
+-    }else{
+-      zText = sqlite3_mprintf("{%s}", zCell);
+     }
+    sqlite3StrAccumAppend(pOut, "}", 1);
+   }
+-  
+-  sqlite3_result_text(ctx, zText, -1, sqlite3_free);
+
+  errCode = sqlite3_str_errcode(pOut);
+  sqlite3_result_text(ctx, sqlite3_str_finish(pOut), -1, sqlite3_free);
+  sqlite3_result_error_code(ctx, errCode);
+ }
+ 
+ /* This routine implements an SQL function that returns the "depth" parameter
+-- 
+2.7.4

diff --git a/meta/recipes-support/sqlite/files/CVE-2019-8457.patch b/meta/recipes-support/sqlite/files/CVE-2019-8457.patch new file mode 100644 index 0000000000..5883774e4a --- /dev/null +++ b/meta/recipes-support/sqlite/files/CVE-2019-8457.patch
@@ -0,0 +1,126 @@
	1	From fbf2392644f0ae4282fa4583c9bb67260995d983 Mon Sep 17 00:00:00 2001
	2	From: Shubham Agrawal <shuagr@microsoft.com>
	3	Date: Mon, 23 Sep 2019 20:58:47 +0000
	4	Subject: [PATCH] sqlite: fix for CVE-2019-8457
	5
	6	Upstream-Status: Backport
	7	CVE: CVE-2019-8457
	8	Signed-off-by: Shubham Agrawal <shuagr@microsoft.com>
	9	---
	10	sqlite3.c \| 50 +++++++++++++++++++++++++++++++-------------------
	11	1 file changed, 31 insertions(+), 19 deletions(-)
	12
	13	diff --git a/sqlite3.c b/sqlite3.c
	14	index 00513d4..5c8c7f4 100644
	15	--- a/sqlite3.c
	16	+++ b/sqlite3.c
	17	@@ -172325,6 +172325,33 @@
	18	}
	19
	20
	21	+/* Allocate and initialize a new dynamic string object */
	22	+StrAccum sqlite3_str_new(sqlite3 db){
	23	+ StrAccum p = sqlite3DbMallocRaw(db, sizeof(p));
	24	+ if( p ){
	25	+ sqlite3StrAccumInit(p, db, 0, 0, SQLITE_MAX_LENGTH);
	26	+ }
	27	+ return p;
	28	+}
	29	+
	30	+/* Finalize a string created using sqlite3_str_new().
	31	+*/
	32	+
	33	+char sqlite3_str_finish(StrAccum p){
	34	+ char *z;
	35	+ if( p ){
	36	+ z = sqlite3StrAccumFinish(p);
	37	+ sqlite3DbFree(p->db, p);
	38	+ }else{
	39	+ z = 0;
	40	+ }
	41	+ return z;
	42	+}
	43	+/* Return any error code associated with p */
	44	+int sqlite3_str_errcode(StrAccum *p){
	45	+ return p ? p->accError : SQLITE_NOMEM;
	46	+}
	47	+
	48	/*
	49	** Implementation of a scalar function that decodes r-tree nodes to
	50	** human readable strings. This can be used for debugging and analysis.
	51	@@ -172342,49 +172369,53 @@
	52	** <num-dimension>*2 coordinates.
	53	*/
	54	static void rtreenode(sqlite3_context ctx, int nArg, sqlite3_value *apArg){
	55	- char *zText = 0;
	56	+
	57	RtreeNode node;
	58	Rtree tree;
	59	int ii;
	60	+ int nData;
	61	+ int errCode;
	62	+ StrAccum *pOut;
	63
	64	UNUSED_PARAMETER(nArg);
	65	memset(&node, 0, sizeof(RtreeNode));
	66	memset(&tree, 0, sizeof(Rtree));
	67	tree.nDim = (u8)sqlite3_value_int(apArg[0]);
	68	+ if( tree.nDim<1 \|\| tree.nDim>5 ) return;
	69	tree.nDim2 = tree.nDim*2;
	70	tree.nBytesPerCell = 8 + 8 * tree.nDim;
	71	node.zData = (u8 *)sqlite3_value_blob(apArg[1]);
	72	+ nData = sqlite3_value_bytes(apArg[1]);
	73	+ if( nData<4 ) return;
	74	+ if( nData<NCELL(&node)*tree.nBytesPerCell ) return;
	75
	76	+ pOut = sqlite3_str_new(0);
	77	for(ii=0; ii<NCELL(&node); ii++){
	78	- char zCell[512];
	79	- int nCell = 0;
	80	+
	81	+
	82	RtreeCell cell;
	83	int jj;
	84
	85	nodeGetCell(&tree, &node, ii, &cell);
	86	- sqlite3_snprintf(512-nCell,&zCell[nCell],"%lld", cell.iRowid);
	87	- nCell = (int)strlen(zCell);
	88	+ if( ii>0 ) sqlite3StrAccumAppend(pOut, " ", 1);
	89	+ sqlite3XPrintf(pOut, "{%lld", cell.iRowid);
	90	+
	91	for(jj=0; jj<tree.nDim2; jj++){
	92	#ifndef SQLITE_RTREE_INT_ONLY
	93	- sqlite3_snprintf(512-nCell,&zCell[nCell], " %g",
	94	- (double)cell.aCoord[jj].f);
	95	+
	96	+ sqlite3XPrintf(pOut, " %g", (double)cell.aCoord[jj].f);
	97	#else
	98	- sqlite3_snprintf(512-nCell,&zCell[nCell], " %d",
	99	- cell.aCoord[jj].i);
	100	+
	101	+ sqlite3XPrintf(pOut, " %d", cell.aCoord[jj].i);
	102	#endif
	103	- nCell = (int)strlen(zCell);
	104	- }
	105
	106	- if( zText ){
	107	- char *zTextNew = sqlite3_mprintf("%s {%s}", zText, zCell);
	108	- sqlite3_free(zText);
	109	- zText = zTextNew;
	110	- }else{
	111	- zText = sqlite3_mprintf("{%s}", zCell);
	112	}
	113	+ sqlite3StrAccumAppend(pOut, "}", 1);
	114	}
	115	-
	116	- sqlite3_result_text(ctx, zText, -1, sqlite3_free);
	117	+
	118	+ errCode = sqlite3_str_errcode(pOut);
	119	+ sqlite3_result_text(ctx, sqlite3_str_finish(pOut), -1, sqlite3_free);
	120	+ sqlite3_result_error_code(ctx, errCode);
	121	}
	122
	123	/* This routine implements an SQL function that returns the "depth" parameter
	124	--
	125	2.7.4
	126