Compare commits
No commits in common. "d1f961e60cf836b8a2760444294e0ca6b2c60082" and "9f271ed2e23604eb6b3ab6cf6d4246fa37a3e414" have entirely different histories.
d1f961e60c
...
9f271ed2e2
@ -1,28 +0,0 @@
|
||||
From 72210cf3c782ff30867d5c78e13900be9904ba76 Mon Sep 17 00:00:00 2001
|
||||
From: zwtmichael <zhuwentao5@huawei.com>
|
||||
Date: Mon, 5 Sep 2022 16:49:05 +0800
|
||||
Subject: [PATCH] fix integer overflow on gigabyte string
|
||||
|
||||
Signed-off-by: zwtmichael <zhuwentao5@huawei.com>
|
||||
---
|
||||
src/printf.c | 4 ++--
|
||||
1 file changed, 2 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/src/printf.c b/src/printf.c
|
||||
index e635184..fb3689e 100644
|
||||
--- a/src/printf.c
|
||||
+++ b/src/printf.c
|
||||
@@ -803,8 +803,8 @@ void sqlite3_str_vappendf(
|
||||
case etSQLESCAPE: /* %q: Escape ' characters */
|
||||
case etSQLESCAPE2: /* %Q: Escape ' and enclose in '...' */
|
||||
case etSQLESCAPE3: { /* %w: Escape " characters */
|
||||
- int i, j, k, n, isnull;
|
||||
- int needQuote;
|
||||
+ i64 i, j, k, n;
|
||||
+ int needQuote, isnull;
|
||||
char ch;
|
||||
char q = ((xtype==etSQLESCAPE3)?'"':'\''); /* Quote character */
|
||||
char *escarg;
|
||||
--
|
||||
2.25.1
|
||||
|
||||
@ -1,53 +0,0 @@
|
||||
From 040177c01a76ccb631bbe19a445f716f0d7b9458 Mon Sep 17 00:00:00 2001
|
||||
From: zwtmichael <zhuwentao5@huawei.com>
|
||||
Date: Thu, 15 Dec 2022 09:49:15 +0800
|
||||
Subject: [PATCH] Fix safe mode authorizer callback to reject disallowed UDFs
|
||||
|
||||
Signed-off-by: zwtmichael <zhuwentao5@huawei.com>
|
||||
---
|
||||
src/shell.c.in | 4 ++--
|
||||
test/shell2.test | 11 +++++++++++
|
||||
2 files changed, 13 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/src/shell.c.in b/src/shell.c.in
|
||||
index 543141c..2c1e013 100644
|
||||
--- a/src/shell.c.in
|
||||
+++ b/src/shell.c.in
|
||||
@@ -1829,7 +1829,7 @@ static int safeModeAuth(
|
||||
"zipfile",
|
||||
"zipfile_cds",
|
||||
};
|
||||
- UNUSED_PARAMETER(zA2);
|
||||
+ UNUSED_PARAMETER(zA1);
|
||||
UNUSED_PARAMETER(zA3);
|
||||
UNUSED_PARAMETER(zA4);
|
||||
switch( op ){
|
||||
@@ -1840,7 +1840,7 @@ static int safeModeAuth(
|
||||
case SQLITE_FUNCTION: {
|
||||
int i;
|
||||
for(i=0; i<ArraySize(azProhibitedFunctions); i++){
|
||||
- if( sqlite3_stricmp(zA1, azProhibitedFunctions[i])==0 ){
|
||||
+ if( sqlite3_stricmp(zA2, azProhibitedFunctions[i])==0 ){
|
||||
failIfSafeMode(p, "cannot use the %s() function in safe mode",
|
||||
azProhibitedFunctions[i]);
|
||||
}
|
||||
diff --git a/test/shell2.test b/test/shell2.test
|
||||
index 6b4dff5..c3777eb 100644
|
||||
--- a/test/shell2.test
|
||||
+++ b/test/shell2.test
|
||||
@@ -188,4 +188,15 @@ b
|
||||
2
|
||||
}}
|
||||
|
||||
+# Verify that safe mode rejects certain UDFs
|
||||
+# Reported at https://sqlite.org/forum/forumpost/07beac8056151b2f
|
||||
+do_test shell2-1.4.8 {
|
||||
+ catchcmd "-safe :memory:" {
|
||||
+ SELECT edit('DoNotCare');}
|
||||
+} {1 {line 2: cannot use the edit() function in safe mode}}
|
||||
+do_test shell2-1.4.9 {
|
||||
+ catchcmd "-safe :memory:" {
|
||||
+ SELECT writefile('DoNotCare', x'');}
|
||||
+} {1 {line 2: cannot use the writefile() function in safe mode}}
|
||||
+
|
||||
finish_test
|
||||
@ -1,32 +0,0 @@
|
||||
From 1b2901722e5de3ef8d29edb4481327e48bd3363c Mon Sep 17 00:00:00 2001
|
||||
From: zwtmichael <zhuwentao5@huawei.com>
|
||||
Date: Mon, 7 Aug 2023 15:10:32 +0800
|
||||
Subject: [PATCH] fix segmentation violation
|
||||
|
||||
Signed-off-by: zwtmichael <zhuwentao5@huawei.com>
|
||||
---
|
||||
src/shell.c.in | 8 ++++++--
|
||||
1 file changed, 6 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/src/shell.c.in b/src/shell.c.in
|
||||
index 543141c..d278988 100644
|
||||
--- a/src/shell.c.in
|
||||
+++ b/src/shell.c.in
|
||||
@@ -11469,8 +11469,12 @@ int SQLITE_CDECL wmain(int argc, wchar_t **wargv){
|
||||
}else if( strcmp(z,"-bail")==0 ){
|
||||
bail_on_error = 1;
|
||||
}else if( strcmp(z,"-nonce")==0 ){
|
||||
- free(data.zNonce);
|
||||
- data.zNonce = strdup(argv[++i]);
|
||||
+ if( data.zNonce ) free(data.zNonce);
|
||||
+ if( i+1 < argc ) data.zNonce = strdup(argv[++i]);
|
||||
+ else{
|
||||
+ data.zNonce = 0;
|
||||
+ break;
|
||||
+ }
|
||||
}else if( strcmp(z,"-safe")==0 ){
|
||||
/* no-op - catch this on the second pass */
|
||||
}
|
||||
--
|
||||
2.34.1.windows.1
|
||||
|
||||
@ -1,45 +0,0 @@
|
||||
it From a756d158b3e55831975feb45b753ba499d2adeda Mon Sep 17 00:00:00 2001
|
||||
From: mazhao <mazhao12@huawei.com>
|
||||
Date: Wed, 3 Jan 2024 12:00:45 +0800
|
||||
Subject: [PATCH] Fix a buffer overread in the sessions extension that could
|
||||
occur when processing a corrupt changeset.
|
||||
|
||||
Signed-off-by: mazhao <mazhao12@huawei.com>
|
||||
---
|
||||
ext/session/sqlite3session.c | 18 +++++++++++-------
|
||||
1 file changed, 11 insertions(+), 7 deletions(-)
|
||||
|
||||
diff --git a/ext/session/sqlite3session.c b/ext/session/sqlite3session.c
|
||||
index a892804..72ad427 100644
|
||||
--- a/ext/session/sqlite3session.c
|
||||
+++ b/ext/session/sqlite3session.c
|
||||
@@ -3050,15 +3050,19 @@ static int sessionReadRecord(
|
||||
}
|
||||
}
|
||||
if( eType==SQLITE_INTEGER || eType==SQLITE_FLOAT ){
|
||||
- sqlite3_int64 v = sessionGetI64(aVal);
|
||||
- if( eType==SQLITE_INTEGER ){
|
||||
- sqlite3VdbeMemSetInt64(apOut[i], v);
|
||||
+ if( (pIn->nData-pIn->iNext)<8 ){
|
||||
+ rc = SQLITE_CORRUPT_BKPT;
|
||||
}else{
|
||||
- double d;
|
||||
- memcpy(&d, &v, 8);
|
||||
- sqlite3VdbeMemSetDouble(apOut[i], d);
|
||||
+ sqlite3_int64 v = sessionGetI64(aVal);
|
||||
+ if( eType==SQLITE_INTEGER ){
|
||||
+ sqlite3VdbeMemSetInt64(apOut[i], v);
|
||||
+ }else{
|
||||
+ double d;
|
||||
+ memcpy(&d, &v, 8);
|
||||
+ sqlite3VdbeMemSetDouble(apOut[i], d);
|
||||
+ }
|
||||
+ pIn->iNext += 8;
|
||||
}
|
||||
- pIn->iNext += 8;
|
||||
}
|
||||
}
|
||||
}
|
||||
--
|
||||
2.34.1
|
||||
|
||||
35
sqlite.spec
35
sqlite.spec
@ -6,7 +6,7 @@
|
||||
|
||||
Name: sqlite
|
||||
Version: 3.37.2
|
||||
Release: 7
|
||||
Release: 1
|
||||
Summary: Embeded SQL database
|
||||
License: Public Domain
|
||||
URL: http://www.sqlite.org/
|
||||
@ -19,10 +19,6 @@ Patch1: 0001-sqlite-no-malloc-usable-size.patch
|
||||
Patch2: 0002-remove-fail-testcase-in-no-free-fd-situation.patch
|
||||
Patch3: 0003-CVE-2022-35737.patch
|
||||
Patch4: 0004-fix-memory-problem-in-the-rtree-test-suite.patch
|
||||
Patch5: 0005-fix-integer-overflow-on-gigabyte-string.patch
|
||||
Patch6: 0006-CVE-2022-46908.patch
|
||||
Patch7: 0007-CVE-2023-36191.patch
|
||||
Patch8: 0008-CVE-2023-7104.patch
|
||||
|
||||
BuildRequires: gcc autoconf tcl tcl-devel
|
||||
BuildRequires: ncurses-devel readline-devel glibc-devel
|
||||
@ -69,16 +65,12 @@ This contains man files and HTML files for the using of sqlite.
|
||||
%patch2 -p1
|
||||
%patch3 -p1
|
||||
%patch4 -p1
|
||||
%patch5 -p1
|
||||
%patch6 -p1
|
||||
%patch7 -p1
|
||||
%patch8 -p1
|
||||
|
||||
rm -f %{name}-doc-%{extver}/sqlite.css~ || :
|
||||
|
||||
%build
|
||||
|
||||
autoconf
|
||||
|
||||
%build
|
||||
export CFLAGS="$RPM_OPT_FLAGS $RPM_LD_FLAGS -DSQLITE_ENABLE_COLUMN_METADATA=1 \
|
||||
-DSQLITE_DISABLE_DIRSYNC=1 -DSQLITE_ENABLE_FTS3=3 \
|
||||
-DSQLITE_ENABLE_RTREE=1 -DSQLITE_SECURE_DELETE=1 \
|
||||
@ -119,10 +111,6 @@ export MALLOC_CHECK_=3
|
||||
%else
|
||||
rm test/csv01.test
|
||||
%endif
|
||||
%ifarch loongarch64
|
||||
rm -rf test/thread1.test
|
||||
rm -rf test/thread2.test
|
||||
%endif
|
||||
|
||||
make test
|
||||
%endif # with check
|
||||
@ -147,23 +135,8 @@ make test
|
||||
%{_mandir}/man*/*
|
||||
|
||||
%changelog
|
||||
* Wed Jan 3 2024 mazhao <mazhao12@huawei.com> - 3.37.2-7
|
||||
- fix the CVE-2023-7104
|
||||
|
||||
* Mon Aug 7 2023 zhuwentao <zhuwentao5@huawei.com> - 3.37.2-6
|
||||
- fix the CVE-2023-36191
|
||||
|
||||
* Fri Jan 13 2023 Wenlong Zhang<zhangwenlong@loongson.cn> - 3.37.2-5
|
||||
- remove fail testcase for loongarch
|
||||
|
||||
* Wed Dec 14 2022 zhuwentao <zhuwentao5@huawei.com> - 3.37.2-4
|
||||
- fix the CVE-2022-46908
|
||||
|
||||
* Wed Sep 14 2022 zhuwentao <zhuwentao5@huawei.com> - 3.37.2-3
|
||||
- fix build problem
|
||||
|
||||
* Mon Sep 5 2022 zhuwentao <zhuwentao5@huawei.com> - 3.37.2-2
|
||||
- fix integer overflow on gigabyte string
|
||||
- fix integer overflow on multi-gigabyte string
|
||||
|
||||
* Mon Aug 29 2022 zhuwentao <zhuwentao5@huawei.com> - 3.37.2-1
|
||||
- update to 3.37.2
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user