summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--meta/recipes-support/sqlite/files/CVE-2025-6965.patch115
-rw-r--r--meta/recipes-support/sqlite/sqlite3_3.38.5.bb1
2 files changed, 116 insertions, 0 deletions
diff --git a/meta/recipes-support/sqlite/files/CVE-2025-6965.patch b/meta/recipes-support/sqlite/files/CVE-2025-6965.patch
new file mode 100644
index 0000000000..e3e087ed32
--- /dev/null
+++ b/meta/recipes-support/sqlite/files/CVE-2025-6965.patch
@@ -0,0 +1,115 @@
1From c52e9d97d485a3eb168e3f8f3674a7bc4b419703 Mon Sep 17 00:00:00 2001
2From: drh <>
3Date: Fri, 27 Jun 2025 19:02:21 +0000
4Subject: [PATCH] Raise an error right away if the number of aggregate terms in
5 a query exceeds the maximum number of columns.
6
7FossilOrigin-Name: 5508b56fd24016c13981ec280ecdd833007c9d8dd595edb295b984c2b487b5c8
8
9Upstream-Status: Backport [https://github.com/sqlite/sqlite/commit/c52e9d97d485a3eb168e3f8f3674a7bc4b419703]
10CVE: CVE-2025-6965
11Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
12---
13 sqlite3.c | 31 +++++++++++++++++++++++++++----
14 1 file changed, 27 insertions(+), 4 deletions(-)
15
16diff --git a/sqlite3.c b/sqlite3.c
17index 27bea6f..19d0438 100644
18--- a/sqlite3.c
19+++ b/sqlite3.c
20@@ -14354,6 +14354,14 @@ typedef INT16_TYPE LogEst;
21 #define LARGEST_UINT64 (0xffffffff|(((u64)0xffffffff)<<32))
22 #define SMALLEST_INT64 (((i64)-1) - LARGEST_INT64)
23
24+/*
25+** Macro SMXV(n) return the maximum value that can be held in variable n,
26+** assuming n is a signed integer type. UMXV(n) is similar for unsigned
27+** integer types.
28+*/
29+#define SMXV(n) ((((i64)1)<<(sizeof(n)*8-1))-1)
30+#define UMXV(n) ((((i64)1)<<(sizeof(n)*8))-1)
31+
32 /*
33 ** Round up a number to the next larger multiple of 8. This is used
34 ** to force 8-byte alignment on 64-bit architectures.
35@@ -17939,7 +17947,7 @@ struct AggInfo {
36 ** than the source table */
37 int sortingIdx; /* Cursor number of the sorting index */
38 int sortingIdxPTab; /* Cursor number of pseudo-table */
39- int nSortingColumn; /* Number of columns in the sorting index */
40+ u32 nSortingColumn; /* Number of columns in the sorting index */
41 int mnReg, mxReg; /* Range of registers allocated for aCol and aFunc */
42 ExprList *pGroupBy; /* The group by clause */
43 struct AggInfo_col { /* For each column used in source tables */
44@@ -17947,8 +17955,8 @@ struct AggInfo {
45 Expr *pCExpr; /* The original expression */
46 int iTable; /* Cursor number of the source table */
47 int iMem; /* Memory location that acts as accumulator */
48- i16 iColumn; /* Column number within the source table */
49- i16 iSorterColumn; /* Column number in the sorting index */
50+ int iColumn; /* Column number within the source table */
51+ int iSorterColumn; /* Column number in the sorting index */
52 } *aCol;
53 int nColumn; /* Number of used entries in aCol[] */
54 int nAccumulator; /* Number of columns that show through to the output.
55@@ -108641,6 +108649,9 @@ static int analyzeAggregate(Walker *pWalker, Expr *pExpr){
56 ** is not an entry there already.
57 */
58 int k;
59+ int mxTerm = pParse->db->aLimit[SQLITE_LIMIT_COLUMN];
60+
61+ assert( mxTerm <= SMXV(i16) );
62 pCol = pAggInfo->aCol;
63 for(k=0; k<pAggInfo->nColumn; k++, pCol++){
64 if( pCol->iTable==pExpr->iTable &&
65@@ -108648,6 +108659,10 @@ static int analyzeAggregate(Walker *pWalker, Expr *pExpr){
66 break;
67 }
68 }
69+ if( k>mxTerm ){
70+ sqlite3ErrorMsg(pParse, "more than %d aggregate terms", mxTerm);
71+ k = mxTerm;
72+ }
73 if( (k>=pAggInfo->nColumn)
74 && (k = addAggInfoColumn(pParse->db, pAggInfo))>=0
75 ){
76@@ -108685,6 +108700,7 @@ static int analyzeAggregate(Walker *pWalker, Expr *pExpr){
77 ExprSetVVAProperty(pExpr, EP_NoReduce);
78 pExpr->pAggInfo = pAggInfo;
79 pExpr->op = TK_AGG_COLUMN;
80+ assert( k <= SMXV(pExpr->iAgg) );
81 pExpr->iAgg = (i16)k;
82 break;
83 } /* endif pExpr->iTable==pItem->iCursor */
84@@ -108700,13 +108716,19 @@ static int analyzeAggregate(Walker *pWalker, Expr *pExpr){
85 ** function that is already in the pAggInfo structure
86 */
87 struct AggInfo_func *pItem = pAggInfo->aFunc;
88+ int mxTerm = pParse->db->aLimit[SQLITE_LIMIT_COLUMN];
89+ assert( mxTerm <= SMXV(i16) );
90 for(i=0; i<pAggInfo->nFunc; i++, pItem++){
91 if( pItem->pFExpr==pExpr ) break;
92 if( sqlite3ExprCompare(0, pItem->pFExpr, pExpr, -1)==0 ){
93 break;
94 }
95 }
96- if( i>=pAggInfo->nFunc ){
97+ if( i>mxTerm ){
98+ sqlite3ErrorMsg(pParse, "more than %d aggregate terms", mxTerm);
99+ i = mxTerm;
100+ assert( i<pAggInfo->nFunc );
101+ }else if( i>=pAggInfo->nFunc ){
102 /* pExpr is original. Make a new entry in pAggInfo->aFunc[]
103 */
104 u8 enc = ENC(pParse->db);
105@@ -108731,6 +108753,7 @@ static int analyzeAggregate(Walker *pWalker, Expr *pExpr){
106 */
107 assert( !ExprHasProperty(pExpr, EP_TokenOnly|EP_Reduced) );
108 ExprSetVVAProperty(pExpr, EP_NoReduce);
109+ assert( i <= SMXV(pExpr->iAgg) );
110 pExpr->iAgg = (i16)i;
111 pExpr->pAggInfo = pAggInfo;
112 return WRC_Prune;
113--
1142.25.1
115
diff --git a/meta/recipes-support/sqlite/sqlite3_3.38.5.bb b/meta/recipes-support/sqlite/sqlite3_3.38.5.bb
index f47a9871e2..656e2d8bd8 100644
--- a/meta/recipes-support/sqlite/sqlite3_3.38.5.bb
+++ b/meta/recipes-support/sqlite/sqlite3_3.38.5.bb
@@ -9,6 +9,7 @@ SRC_URI = "http://www.sqlite.org/2022/sqlite-autoconf-${SQLITE_PV}.tar.gz \
9 file://CVE-2023-36191.patch \ 9 file://CVE-2023-36191.patch \
10 file://CVE-2023-7104.patch \ 10 file://CVE-2023-7104.patch \
11 file://CVE-2025-29088.patch \ 11 file://CVE-2025-29088.patch \
12 file://CVE-2025-6965.patch \
12 " 13 "
13SRC_URI[sha256sum] = "5af07de982ba658fd91a03170c945f99c971f6955bc79df3266544373e39869c" 14SRC_URI[sha256sum] = "5af07de982ba658fd91a03170c945f99c971f6955bc79df3266544373e39869c"
14 15
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-10-04 16:28:36 +0000