Fix CVE-2023-7104

.sqlite.metadata

@@ -0,0 +1,3 @@
+5abb2e1f4962f0c67ab40df18793e9de890db85e sqlite-doc-3340100.zip
+7bc3127488860a67b2437d46fdb8abfb46b36e7e sqlite-src-3340100.zip
+c20286e11fe5c2e3712ce74890e1692417de6890 sqlite-autoconf-3340100.tar.gz

sqlite-3.34.1-CVE-2023-7104.patch

@@ -0,0 +1,42 @@
+From 09f1652f36c5c4e8a6a640ce887f9ea0f48a7958 Mon Sep 17 00:00:00 2001
+From: dan <Dan Kennedy>
+Date: Thu, 7 Sep 2023 13:53:09 +0000
+Subject: [PATCH] Fix a buffer overread in the sessions extension that could
+ occur when processing a corrupt changeset.
+
+FossilOrigin-Name: 0e4e7a05c4204b47a324d67e18e76d2a98e26b2723d19d5c655ec9fd2e41f4b7
+
+diff --git a/ext/session/sqlite3session.c b/ext/session/sqlite3session.c
+index 9f862f2465..0491549231 100644
+--- a/ext/session/sqlite3session.c
++++ b/ext/session/sqlite3session.c
+@@ -2811,15 +2811,19 @@ static int sessionReadRecord(
+         }
+       }
+       if( eType==SQLITE_INTEGER || eType==SQLITE_FLOAT ){
+-        sqlite3_int64 v = sessionGetI64(aVal);
+-        if( eType==SQLITE_INTEGER ){
+-          sqlite3VdbeMemSetInt64(apOut[i], v);
++        if( (pIn->nData-pIn->iNext)<8 ){
++          rc = SQLITE_CORRUPT_BKPT;
+         }else{
+-          double d;
+-          memcpy(&d, &v, 8);
+-          sqlite3VdbeMemSetDouble(apOut[i], d);
++          sqlite3_int64 v = sessionGetI64(aVal);
++          if( eType==SQLITE_INTEGER ){
++            sqlite3VdbeMemSetInt64(apOut[i], v);
++          }else{
++            double d;
++            memcpy(&d, &v, 8);
++            sqlite3VdbeMemSetDouble(apOut[i], d);
++          }
++          pIn->iNext += 8;
+         }
+-        pIn->iNext += 8;
+       }
+     }
+   }
+-- 
+2.43.0
+

sqlite.spec

@@ -12,7 +12,7 @@
 Summary: Library that implements an embeddable SQL database engine
 Name: sqlite
 Version: %{rpmver}
-Release: 6%{?dist}
+Release: 7%{?dist}
 License: Public Domain
 URL: http://www.sqlite.org/
 
@@ -35,6 +35,7 @@ Patch5: sqlite-3.18.0-sync2-dirsync.patch
 Patch6: sqlite-3.34.1-covscan-rhel-9.patch
 # Fixed CVE-2022-35737
 Patch7: sqlite-3.26.0-CVE-2022-35737.patch
+Patch8: sqlite-3.34.1-CVE-2023-7104.patch
 
 BuildRequires: make
 BuildRequires:  gcc
@@ -145,6 +146,7 @@ This package contains the analysis program for %{name}.
 %patch -P 5 -p1
 %patch -P 6 -p1
 %patch -P 7 -p1
+%patch -P 8 -p1
 
 # Remove backup-file
 rm -f %{name}-doc-%{docver}/sqlite.css~ || :
@@ -262,6 +264,9 @@ make test
 %endif
 
 %changelog
+* Wed Jan 03 2024 Zuzana Miklankova <zmiklank@redhat.com> - 3.34.1-7
+- Fixes CVE-2023-7104
+
 * Fri Nov 18 2022 Zuzana Miklankova <zmiklank@redhat.com> - 3.34.1-6
 - Fixes CVE-2022-35737