Unite CVE patches from Ymir, fix release, fix test
fts5corruptA.test uses `unhex()` which isn't in sqlite 3.34 yet, so I removed that part. Corruption error messages are also less verbose before 3.50.
This commit is contained in:
Petr Khartskhaev
parent
7af9be8d68
commit
3206af51d4
@ -1,18 +1,5 @@
|
||||
From c8264f2dfd167d20caa746daf98ec99151cf16b0 Mon Sep 17 00:00:00 2001
|
||||
From: dan <Dan Kennedy>
|
||||
Date: Mon, 11 May 2026 11:12:06 +0000
|
||||
Subject: [PATCH] Fix potential buffer overwrite that could occur in fts5 when
|
||||
processing corrupt records.
|
||||
|
||||
FossilOrigin-Name: 4a5ad516ea93926c0d5206b4d72c3675905d2bf666b27a649256b93eb95c671b
|
||||
---
|
||||
ext/fts5/fts5_index.c | 2 +-
|
||||
ext/fts5/test/fts5corruptA.test | 72 +++++++++++++++++++++++++++++++++
|
||||
2 files changed, 73 insertions(+), 1 deletion(-)
|
||||
create mode 100644 ext/fts5/test/fts5corruptA.test
|
||||
|
||||
diff --git a/ext/fts5/fts5_index.c b/ext/fts5/fts5_index.c
|
||||
index f83488e2f..f31c2250b 100644
|
||||
Index: ext/fts5/fts5_index.c
|
||||
==================================================================
|
||||
--- a/ext/fts5/fts5_index.c
|
||||
+++ b/ext/fts5/fts5_index.c
|
||||
@@ -708,7 +708,7 @@ static void fts5DataRelease(Fts5Data *pData){
|
||||
@ -24,12 +11,12 @@ index f83488e2f..f31c2250b 100644
|
||||
p->rc = FTS5_CORRUPT;
|
||||
fts5DataRelease(pRet);
|
||||
pRet = 0;
|
||||
diff --git a/ext/fts5/test/fts5corruptA.test b/ext/fts5/test/fts5corruptA.test
|
||||
new file mode 100644
|
||||
index 000000000..838cded57
|
||||
ADDED ext/fts5/test/fts5corruptA.test
|
||||
Index: ext/fts5/test/fts5corruptA.test
|
||||
==================================================================
|
||||
--- /dev/null
|
||||
+++ b/ext/fts5/test/fts5corruptA.test
|
||||
@@ -0,0 +1,72 @@
|
||||
@@ -0,0 +1,57 @@
|
||||
+# 2026 May 11
|
||||
+#
|
||||
+# The author disclaims copyright to this source code. In place of
|
||||
@ -69,21 +56,6 @@ index 000000000..838cded57
|
||||
+ } {}
|
||||
+} {}
|
||||
+
|
||||
+do_test 1.3 {
|
||||
+ for {set ii 0} {$ii < 5} {incr ii} {
|
||||
+ db eval {
|
||||
+ INSERT INTO t_data(rowid, block)
|
||||
+ VALUES( $base_rowid + $page_count + $ii, zeroblob(4) );
|
||||
+ }
|
||||
+ }
|
||||
+ db eval {
|
||||
+ INSERT INTO t_data(rowid, block)
|
||||
+ VALUES( $base_rowid + $page_count + 5,
|
||||
+ unhex('00000080' || 'CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC') );
|
||||
+ }
|
||||
+ set {} {}
|
||||
+} {}
|
||||
+
|
||||
+db close
|
||||
+
|
||||
+do_test 1.4 {
|
||||
@ -98,7 +70,7 @@ index 000000000..838cded57
|
||||
+
|
||||
+do_catchsql_test 1.5 {
|
||||
+ SELECT rowid FROM t WHERE t MATCH 'a'
|
||||
+} {1 {fts5: corruption found reading blob 137438953481 from table "t"}}
|
||||
+} {1 {database disk image is malformed}}
|
||||
+
|
||||
+sqlite3_fts5_may_be_corrupt 0
|
||||
+finish_test
|
||||
@ -1,22 +0,0 @@
|
||||
From b37ea590198d875fab40935318883470d62986eb Mon Sep 17 00:00:00 2001
|
||||
From: Dan Kennedy <danielk1977@gmail.com>
|
||||
Date: Mon, 11 May 2026 11:12:06 +0000
|
||||
Subject: [PATCH] Fix potential buffer overwrite that could occur in fts5 when
|
||||
processing corrupt records.
|
||||
|
||||
Note: The code change and test file from the upstream fix have already been
|
||||
applied by the CVE-2026-11824 patch, which addresses the same underlying
|
||||
fts5 issue. This patch is retained for CVE-2026-11822 tracking purposes.
|
||||
---
|
||||
ext/fts5/fts5_index.c | 0
|
||||
ext/fts5/test/fts5corruptA.test | 0
|
||||
2 files changed, 0 insertions(+), 0 deletions(-)
|
||||
|
||||
diff --git a/ext/fts5/fts5_index.c b/ext/fts5/fts5_index.c
|
||||
index f31c2250b..f31c2250b 100644
|
||||
--- a/ext/fts5/fts5_index.c
|
||||
+++ b/ext/fts5/fts5_index.c
|
||||
diff --git a/ext/fts5/test/fts5corruptA.test b/ext/fts5/test/fts5corruptA.test
|
||||
index 838cded57..838cded57 100644
|
||||
--- a/ext/fts5/test/fts5corruptA.test
|
||||
+++ b/ext/fts5/test/fts5corruptA.test
|
||||
10
sqlite.spec
10
sqlite.spec
@ -12,7 +12,7 @@
|
||||
Summary: Library that implements an embeddable SQL database engine
|
||||
Name: sqlite
|
||||
Version: %{rpmver}
|
||||
Release: 10%{?dist}.2
|
||||
Release: 11%{?dist}
|
||||
License: Public Domain
|
||||
URL: http://www.sqlite.org/
|
||||
|
||||
@ -37,9 +37,8 @@ Patch6: sqlite-3.34.1-covscan-rhel-9.patch
|
||||
Patch7: sqlite-3.26.0-CVE-2022-35737.patch
|
||||
Patch8: sqlite-3.34.1-CVE-2023-7104.patch
|
||||
Patch9: sqlite-3.34.1-CVE-2025-6965.patch
|
||||
Patch10: sqlite-3.34.1-CVE-2026-11824.patch
|
||||
# http://repo.or.cz/w/sqlite.git/patch/767efcbabd8419f38f1d7354644a0d8624ba7f26
|
||||
Patch11: sqlite-3.34.1-CVE-2026-11822.patch
|
||||
# https://sqlite.org/src/info/4a5ad516ea93
|
||||
Patch10: sqlite-3.34.1-CVE-2026-11822-CVE-2026-11824.patch
|
||||
|
||||
BuildRequires: make
|
||||
BuildRequires: gcc
|
||||
@ -153,7 +152,6 @@ This package contains the analysis program for %{name}.
|
||||
%patch -P 8 -p1
|
||||
%patch -P 9 -p1
|
||||
%patch -P 10 -p1
|
||||
%patch -P 11 -p1
|
||||
|
||||
# Remove backup-file
|
||||
rm -f %{name}-doc-%{docver}/sqlite.css~ || :
|
||||
@ -273,7 +271,7 @@ make test
|
||||
%endif
|
||||
|
||||
%changelog
|
||||
* Wed Jul 29 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 3.34.1-10.2
|
||||
* Wed Jul 29 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 3.34.1-11
|
||||
- Fixes CVE-2026-11822
|
||||
- Resolves: RHEL-218273
|
||||
|
||||
|
||||
Loading…
Reference in New Issue
Block a user