From 043aac02a88cb011198597814fb68fb3e82dac55 Mon Sep 17 00:00:00 2001 From: RHEL Packaging Agent Date: Wed, 29 Jul 2026 10:39:57 +0000 Subject: [PATCH] Fix CVE-2026-11824: buffer overwrite in fts5 corrupt records Backport upstream fix (commit 79db323ce14) for CVE-2026-11824 to sqlite 3.34.1. The patch fixes a potential buffer overwrite in fts5 when processing corrupt records by changing the check in fts5LeafRead() from pRet->nn<4 to pRet->szLeaf<4. The test file fts5corruptA.test is included to verify the fix. CVE: CVE-2026-11824 Upstream patches: - https://github.com/sqlite/sqlite/commit/79db323ce14923a1bcc7b3b72679003c14c1cd7f.patch Resolves: RHEL-218281 This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent. Assisted-by: Ymir --- sqlite-3.34.1-CVE-2026-11824.patch | 104 +++++++++++++++++++++++++++++ sqlite.spec | 8 ++- 2 files changed, 111 insertions(+), 1 deletion(-) create mode 100644 sqlite-3.34.1-CVE-2026-11824.patch diff --git a/sqlite-3.34.1-CVE-2026-11824.patch b/sqlite-3.34.1-CVE-2026-11824.patch new file mode 100644 index 0000000..07e245c --- /dev/null +++ b/sqlite-3.34.1-CVE-2026-11824.patch @@ -0,0 +1,104 @@ +From c8264f2dfd167d20caa746daf98ec99151cf16b0 Mon Sep 17 00:00:00 2001 +From: dan +Date: Mon, 11 May 2026 11:12:06 +0000 +Subject: [PATCH] Fix potential buffer overwrite that could occur in fts5 when + processing corrupt records. + +FossilOrigin-Name: 4a5ad516ea93926c0d5206b4d72c3675905d2bf666b27a649256b93eb95c671b +--- + ext/fts5/fts5_index.c | 2 +- + ext/fts5/test/fts5corruptA.test | 72 +++++++++++++++++++++++++++++++++ + 2 files changed, 73 insertions(+), 1 deletion(-) + create mode 100644 ext/fts5/test/fts5corruptA.test + +diff --git a/ext/fts5/fts5_index.c b/ext/fts5/fts5_index.c +index f83488e2f..f31c2250b 100644 +--- a/ext/fts5/fts5_index.c ++++ b/ext/fts5/fts5_index.c +@@ -708,7 +708,7 @@ static void fts5DataRelease(Fts5Data *pData){ + static Fts5Data *fts5LeafRead(Fts5Index *p, i64 iRowid){ + Fts5Data *pRet = fts5DataRead(p, iRowid); + if( pRet ){ +- if( pRet->nn<4 || pRet->szLeaf>pRet->nn ){ ++ if( pRet->szLeaf<4 || pRet->szLeaf>pRet->nn ){ + p->rc = FTS5_CORRUPT; + fts5DataRelease(pRet); + pRet = 0; +diff --git a/ext/fts5/test/fts5corruptA.test b/ext/fts5/test/fts5corruptA.test +new file mode 100644 +index 000000000..838cded57 +--- /dev/null ++++ b/ext/fts5/test/fts5corruptA.test +@@ -0,0 +1,72 @@ ++# 2026 May 11 ++# ++# The author disclaims copyright to this source code. In place of ++# a legal notice, here is a blessing: ++# ++# May you do good and not evil. ++# May you find forgiveness for yourself and forgive others. ++# May you share freely, never taking more than you give. ++# ++#*********************************************************************** ++# ++ ++source [file join [file dirname [info script]] fts5_common.tcl] ++set testprefix fts5corruptA ++ ++# If SQLITE_ENABLE_FTS5 is not defined, omit this file. ++ifcapable !fts5 { ++ finish_test ++ return ++} ++sqlite3_fts5_may_be_corrupt 1 ++ ++do_execsql_test 1.0 { ++ CREATE VIRTUAL TABLE t USING fts5(x, detail='full'); ++ INSERT INTO t(t, rank) VALUES('pgsz', 32); ++} ++ ++set big [string repeat "a " 200] ++do_execsql_test 1.1 { ++ INSERT INTO t(rowid, x) VALUES(1, $big) ++} ++ ++do_test 1.2 { ++ db eval { ++ SELECT min(rowid) AS base_rowid, count(*) AS page_count FROM t_data ++ WHERE rowid>1000 ++ } {} ++} {} ++ ++do_test 1.3 { ++ for {set ii 0} {$ii < 5} {incr ii} { ++ db eval { ++ INSERT INTO t_data(rowid, block) ++ VALUES( $base_rowid + $page_count + $ii, zeroblob(4) ); ++ } ++ } ++ db eval { ++ INSERT INTO t_data(rowid, block) ++ VALUES( $base_rowid + $page_count + 5, ++ unhex('00000080' || 'CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC') ); ++ } ++ set {} {} ++} {} ++ ++db close ++ ++do_test 1.4 { ++ set hex [hexio_read test.db 0 [file size test.db]] ++ ++ set off [string first "023061018310" $hex] ++ set hex [string replace $hex $off [expr $off+11] 023061018370] ++ hexio_write test.db 0 $hex ++} {6144} ++ ++sqlite3 db test.db ++ ++do_catchsql_test 1.5 { ++ SELECT rowid FROM t WHERE t MATCH 'a' ++} {1 {fts5: corruption found reading blob 137438953481 from table "t"}} ++ ++sqlite3_fts5_may_be_corrupt 0 ++finish_test diff --git a/sqlite.spec b/sqlite.spec index ec29ad7..11b5f89 100644 --- a/sqlite.spec +++ b/sqlite.spec @@ -12,7 +12,7 @@ Summary: Library that implements an embeddable SQL database engine Name: sqlite Version: %{rpmver} -Release: 10%{?dist} +Release: 10%{?dist}.1 License: Public Domain URL: http://www.sqlite.org/ @@ -37,6 +37,7 @@ Patch6: sqlite-3.34.1-covscan-rhel-9.patch Patch7: sqlite-3.26.0-CVE-2022-35737.patch Patch8: sqlite-3.34.1-CVE-2023-7104.patch Patch9: sqlite-3.34.1-CVE-2025-6965.patch +Patch10: sqlite-3.34.1-CVE-2026-11824.patch BuildRequires: make BuildRequires: gcc @@ -149,6 +150,7 @@ This package contains the analysis program for %{name}. %patch -P 7 -p1 %patch -P 8 -p1 %patch -P 9 -p1 +%patch -P 10 -p1 # Remove backup-file rm -f %{name}-doc-%{docver}/sqlite.css~ || : @@ -268,6 +270,10 @@ make test %endif %changelog +* Wed Jul 29 2026 RHEL Packaging Agent - 3.34.1-10.1 +- Fixes CVE-2026-11824 +- Resolves: RHEL-218281 + * Tue Mar 17 2026 Petr Khartskhaev - 3.34.1-10 - Enable sqlite3_deserialize and sqlite3_serialize interfaces - Resolves: RHEL-155950