diff options
Diffstat (limited to 'meta')
-rw-r--r-- | meta/recipes-support/sqlite/files/CVE-2019-8457.patch | 126 | ||||
-rw-r--r-- | meta/recipes-support/sqlite/sqlite3_3.23.1.bb | 1 |
2 files changed, 127 insertions, 0 deletions
diff --git a/meta/recipes-support/sqlite/files/CVE-2019-8457.patch b/meta/recipes-support/sqlite/files/CVE-2019-8457.patch new file mode 100644 index 0000000000..5883774e4a --- /dev/null +++ b/meta/recipes-support/sqlite/files/CVE-2019-8457.patch | |||
@@ -0,0 +1,126 @@ | |||
1 | From fbf2392644f0ae4282fa4583c9bb67260995d983 Mon Sep 17 00:00:00 2001 | ||
2 | From: Shubham Agrawal <shuagr@microsoft.com> | ||
3 | Date: Mon, 23 Sep 2019 20:58:47 +0000 | ||
4 | Subject: [PATCH] sqlite: fix for CVE-2019-8457 | ||
5 | |||
6 | Upstream-Status: Backport | ||
7 | CVE: CVE-2019-8457 | ||
8 | Signed-off-by: Shubham Agrawal <shuagr@microsoft.com> | ||
9 | --- | ||
10 | sqlite3.c | 50 +++++++++++++++++++++++++++++++------------------- | ||
11 | 1 file changed, 31 insertions(+), 19 deletions(-) | ||
12 | |||
13 | diff --git a/sqlite3.c b/sqlite3.c | ||
14 | index 00513d4..5c8c7f4 100644 | ||
15 | --- a/sqlite3.c | ||
16 | +++ b/sqlite3.c | ||
17 | @@ -172325,6 +172325,33 @@ | ||
18 | } | ||
19 | |||
20 | |||
21 | +/* Allocate and initialize a new dynamic string object */ | ||
22 | +StrAccum *sqlite3_str_new(sqlite3 *db){ | ||
23 | + StrAccum *p = sqlite3DbMallocRaw(db, sizeof(*p)); | ||
24 | + if( p ){ | ||
25 | + sqlite3StrAccumInit(p, db, 0, 0, SQLITE_MAX_LENGTH); | ||
26 | + } | ||
27 | + return p; | ||
28 | +} | ||
29 | + | ||
30 | +/* Finalize a string created using sqlite3_str_new(). | ||
31 | +*/ | ||
32 | + | ||
33 | +char *sqlite3_str_finish(StrAccum *p){ | ||
34 | + char *z; | ||
35 | + if( p ){ | ||
36 | + z = sqlite3StrAccumFinish(p); | ||
37 | + sqlite3DbFree(p->db, p); | ||
38 | + }else{ | ||
39 | + z = 0; | ||
40 | + } | ||
41 | + return z; | ||
42 | +} | ||
43 | +/* Return any error code associated with p */ | ||
44 | +int sqlite3_str_errcode(StrAccum *p){ | ||
45 | + return p ? p->accError : SQLITE_NOMEM; | ||
46 | +} | ||
47 | + | ||
48 | /* | ||
49 | ** Implementation of a scalar function that decodes r-tree nodes to | ||
50 | ** human readable strings. This can be used for debugging and analysis. | ||
51 | @@ -172342,49 +172369,53 @@ | ||
52 | ** <num-dimension>*2 coordinates. | ||
53 | */ | ||
54 | static void rtreenode(sqlite3_context *ctx, int nArg, sqlite3_value **apArg){ | ||
55 | - char *zText = 0; | ||
56 | + | ||
57 | RtreeNode node; | ||
58 | Rtree tree; | ||
59 | int ii; | ||
60 | + int nData; | ||
61 | + int errCode; | ||
62 | + StrAccum *pOut; | ||
63 | |||
64 | UNUSED_PARAMETER(nArg); | ||
65 | memset(&node, 0, sizeof(RtreeNode)); | ||
66 | memset(&tree, 0, sizeof(Rtree)); | ||
67 | tree.nDim = (u8)sqlite3_value_int(apArg[0]); | ||
68 | + if( tree.nDim<1 || tree.nDim>5 ) return; | ||
69 | tree.nDim2 = tree.nDim*2; | ||
70 | tree.nBytesPerCell = 8 + 8 * tree.nDim; | ||
71 | node.zData = (u8 *)sqlite3_value_blob(apArg[1]); | ||
72 | + nData = sqlite3_value_bytes(apArg[1]); | ||
73 | + if( nData<4 ) return; | ||
74 | + if( nData<NCELL(&node)*tree.nBytesPerCell ) return; | ||
75 | |||
76 | + pOut = sqlite3_str_new(0); | ||
77 | for(ii=0; ii<NCELL(&node); ii++){ | ||
78 | - char zCell[512]; | ||
79 | - int nCell = 0; | ||
80 | + | ||
81 | + | ||
82 | RtreeCell cell; | ||
83 | int jj; | ||
84 | |||
85 | nodeGetCell(&tree, &node, ii, &cell); | ||
86 | - sqlite3_snprintf(512-nCell,&zCell[nCell],"%lld", cell.iRowid); | ||
87 | - nCell = (int)strlen(zCell); | ||
88 | + if( ii>0 ) sqlite3StrAccumAppend(pOut, " ", 1); | ||
89 | + sqlite3XPrintf(pOut, "{%lld", cell.iRowid); | ||
90 | + | ||
91 | for(jj=0; jj<tree.nDim2; jj++){ | ||
92 | #ifndef SQLITE_RTREE_INT_ONLY | ||
93 | - sqlite3_snprintf(512-nCell,&zCell[nCell], " %g", | ||
94 | - (double)cell.aCoord[jj].f); | ||
95 | + | ||
96 | + sqlite3XPrintf(pOut, " %g", (double)cell.aCoord[jj].f); | ||
97 | #else | ||
98 | - sqlite3_snprintf(512-nCell,&zCell[nCell], " %d", | ||
99 | - cell.aCoord[jj].i); | ||
100 | + | ||
101 | + sqlite3XPrintf(pOut, " %d", cell.aCoord[jj].i); | ||
102 | #endif | ||
103 | - nCell = (int)strlen(zCell); | ||
104 | - } | ||
105 | |||
106 | - if( zText ){ | ||
107 | - char *zTextNew = sqlite3_mprintf("%s {%s}", zText, zCell); | ||
108 | - sqlite3_free(zText); | ||
109 | - zText = zTextNew; | ||
110 | - }else{ | ||
111 | - zText = sqlite3_mprintf("{%s}", zCell); | ||
112 | } | ||
113 | + sqlite3StrAccumAppend(pOut, "}", 1); | ||
114 | } | ||
115 | - | ||
116 | - sqlite3_result_text(ctx, zText, -1, sqlite3_free); | ||
117 | + | ||
118 | + errCode = sqlite3_str_errcode(pOut); | ||
119 | + sqlite3_result_text(ctx, sqlite3_str_finish(pOut), -1, sqlite3_free); | ||
120 | + sqlite3_result_error_code(ctx, errCode); | ||
121 | } | ||
122 | |||
123 | /* This routine implements an SQL function that returns the "depth" parameter | ||
124 | -- | ||
125 | 2.7.4 | ||
126 | |||
diff --git a/meta/recipes-support/sqlite/sqlite3_3.23.1.bb b/meta/recipes-support/sqlite/sqlite3_3.23.1.bb index d214ea1528..7df61cd1cc 100644 --- a/meta/recipes-support/sqlite/sqlite3_3.23.1.bb +++ b/meta/recipes-support/sqlite/sqlite3_3.23.1.bb | |||
@@ -7,6 +7,7 @@ SRC_URI = "\ | |||
7 | http://www.sqlite.org/2018/sqlite-autoconf-${SQLITE_PV}.tar.gz \ | 7 | http://www.sqlite.org/2018/sqlite-autoconf-${SQLITE_PV}.tar.gz \ |
8 | file://CVE-2018-20505.patch \ | 8 | file://CVE-2018-20505.patch \ |
9 | file://CVE-2018-20506.patch \ | 9 | file://CVE-2018-20506.patch \ |
10 | file://CVE-2019-8457.patch \ | ||
10 | " | 11 | " |
11 | SRC_URI[md5sum] = "99a51b40a66872872a91c92f6d0134fa" | 12 | SRC_URI[md5sum] = "99a51b40a66872872a91c92f6d0134fa" |
12 | SRC_URI[sha256sum] = "92842b283e5e744eff5da29ed3c69391de7368fccc4d0ee6bf62490ce555ef25" | 13 | SRC_URI[sha256sum] = "92842b283e5e744eff5da29ed3c69391de7368fccc4d0ee6bf62490ce555ef25" |