diff options
Diffstat (limited to 'meta/recipes-support/sqlite/files/CVE-2020-11656.patch')
-rw-r--r-- | meta/recipes-support/sqlite/files/CVE-2020-11656.patch | 70 |
1 files changed, 70 insertions, 0 deletions
diff --git a/meta/recipes-support/sqlite/files/CVE-2020-11656.patch b/meta/recipes-support/sqlite/files/CVE-2020-11656.patch new file mode 100644 index 0000000000..b88a724e8c --- /dev/null +++ b/meta/recipes-support/sqlite/files/CVE-2020-11656.patch | |||
@@ -0,0 +1,70 @@ | |||
1 | From 2d69a520d027eb73eb6da9f2653d23e33b10e8bb Mon Sep 17 00:00:00 2001 | ||
2 | From: Sakib Sajal <sakib.sajal@windriver.com> | ||
3 | Date: Thu, 30 Apr 2020 10:14:36 -0700 | ||
4 | Subject: [PATCH 1/2] Fix a case when a pointer might be used after | ||
5 | being freed in the ALTER TABLE code. Fix for [4722bdab08cb1]. | ||
6 | |||
7 | FossilOrigin-Name: d09f8c3621d5f7f8c6d99d7d82bcaa8421855b3f470bea2b26c858106382b906 | ||
8 | Upstream Status: Backport [fb99e388ec7f30fe43e4878236e3695ff24ae58d] | ||
9 | |||
10 | [PATCH 2/2] Do not suppress errors when resolving references in an ORDER | ||
11 | BY clause belonging to a compound SELECT within a view or trigger within | ||
12 | ALTER TABLE. Fix for ticket [a10a14e9b4ba2]. | ||
13 | |||
14 | FossilOrigin-Name: 684293882c302600e112cf52553c19d84fdb31663d96e5dd7f8ac17dda00a026 | ||
15 | Upstream Status: Backport [4db7ab53f9c30e2e22731ace93ab6b18eef6c4ae] | ||
16 | |||
17 | The two patches were converted to amalgamation format. | ||
18 | |||
19 | CVE: CVE-2020-11656 | ||
20 | Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com> | ||
21 | --- | ||
22 | sqlite3.c | 18 +++++++++++++++++- | ||
23 | 1 file changed, 17 insertions(+), 1 deletion(-) | ||
24 | |||
25 | diff --git a/sqlite3.c b/sqlite3.c | ||
26 | index 64fae04..1df6633 100644 | ||
27 | --- a/sqlite3.c | ||
28 | +++ b/sqlite3.c | ||
29 | @@ -97945,7 +97945,7 @@ static int resolveOrderByTermToExprList( | ||
30 | nc.nErr = 0; | ||
31 | db = pParse->db; | ||
32 | savedSuppErr = db->suppressErr; | ||
33 | - db->suppressErr = 1; | ||
34 | + if( IN_RENAME_OBJECT==0 ) db->suppressErr = 1; | ||
35 | rc = sqlite3ResolveExprNames(&nc, pE); | ||
36 | db->suppressErr = savedSuppErr; | ||
37 | if( rc ) return 0; | ||
38 | @@ -105383,6 +105383,21 @@ static void renameWalkWith(Walker *pWalker, Select *pSelect){ | ||
39 | } | ||
40 | } | ||
41 | |||
42 | +/* | ||
43 | +** Unmap all tokens in the IdList object passed as the second argument. | ||
44 | +*/ | ||
45 | +static void unmapColumnIdlistNames( | ||
46 | + Parse *pParse, | ||
47 | + IdList *pIdList | ||
48 | +){ | ||
49 | + if( pIdList ){ | ||
50 | + int ii; | ||
51 | + for(ii=0; ii<pIdList->nId; ii++){ | ||
52 | + sqlite3RenameTokenRemap(pParse, 0, (void*)pIdList->a[ii].zName); | ||
53 | + } | ||
54 | + } | ||
55 | +} | ||
56 | + | ||
57 | /* | ||
58 | ** Walker callback used by sqlite3RenameExprUnmap(). | ||
59 | */ | ||
60 | @@ -105404,6 +105419,7 @@ static int renameUnmapSelectCb(Walker *pWalker, Select *p){ | ||
61 | for(i=0; i<pSrc->nSrc; i++){ | ||
62 | sqlite3RenameTokenRemap(pParse, 0, (void*)pSrc->a[i].zName); | ||
63 | if( sqlite3WalkExpr(pWalker, pSrc->a[i].pOn) ) return WRC_Abort; | ||
64 | + unmapColumnIdlistNames(pParse, pSrc->a[i].pUsing); | ||
65 | } | ||
66 | } | ||
67 | |||
68 | -- | ||
69 | 2.17.1 | ||
70 | |||