rpms/sqlite
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Fix CVE-2026-11822 in sqlite fts5 index

Browse Source 
Backport two upstream commits (79db323ce149, eb83e32cef6a)
fixing CVE-2026-11822 in the fts5 full-text search extension.

The first fix corrects a buffer overwrite in fts5LeafRead by
checking pRet->szLeaf instead of pRet->nn in the corruption
guard. The second fix adds a bounds check in fts5LeafSeek to
prevent out-of-bounds access when processing corrupt term data.

Both patches were adapted for sqlite 3.46.1 by replacing newer
upstream macros with the equivalent error-handling pattern used
in this version.

CVE: CVE-2026-11822
Upstream patches:
 - https://github.com/sqlite/sqlite/commit/79db323ce149.patch
 - https://github.com/sqlite/sqlite/commit/eb83e32cef6a.patch
Resolves: RHEL-218240

This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.

Assisted-by: Ymir
This commit is contained in:
RHEL Packaging Agent 2026-07-29 11:42:30 +00:00 committed by Petr Khartskhaev
parent a6aa59f487
commit 606ce330da
2 changed files with 32 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
sqlite-cve-2026-11822.patch Normal file
View File

@ -0,0 +1,25 @@
From 11db730d5c75df27722064c7a62c46ab2b16501d Mon Sep 17 00:00:00 2001
From: dan <Dan Kennedy>
Date: Mon, 11 May 2026 11:53:07 +0000
Subject: [PATCH] Improve detection of corrupt database records in fts5.
FossilOrigin-Name: 87b653731171a26396f9796b0a5c436593571d39e991d8d040ef4473cf459b67
---
ext/fts5/fts5_index.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/ext/fts5/fts5_index.c b/ext/fts5/fts5_index.c
index c6ca83afb..7d193d529 100644
--- a/ext/fts5/fts5_index.c
+++ b/ext/fts5/fts5_index.c
@@ -2520,6 +2520,10 @@ static void fts5LeafSeek(
if( nKeep<nMatch ){
goto search_failed;
}
+ if( (iOff+nNew)>n ){
+ p->rc = FTS5_CORRUPT;
+ return;
+ }
assert( nKeep>=nMatch );
if( nKeep==nMatch ){

8
sqlite.spec
View File

@ -12,7 +12,7 @@
Summary: Library that implements an embeddable SQL database engine
Name: sqlite
Version: %{rpmver}
Release: 5%{?dist}.1
Release: 5%{?dist}.2
License: blessing
URL: http://www.sqlite.org/
@ -24,6 +24,7 @@ Patch1: sqlite-3.6.23-lemon-system-template.patch
Patch2: sqlite-cve-2025-3277.patch
Patch3: sqlite-cve-2025-6965.patch
Patch4: sqlite-cve-2026-11824.patch
Patch5: sqlite-cve-2026-11822.patch
BuildRequires: make
BuildRequires: gcc
@ -130,6 +131,7 @@ This package contains the analysis program for %{name}.
%patch -P 2 -p1
%patch -P 3 -p1
%patch -P 4 -p1
%patch -P 5 -p1
# The atof test is failing on the i686 architecture, when binary configured with
# --enable-rtree option. Failing part is text->real conversion and
@ -266,6 +268,10 @@ make test
%endif
%changelog
* Wed Jul 29 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 3.46.1-5.2
- Fix CVE-2026-11822
- Resolves: RHEL-218240
* Wed Jul 29 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 3.46.1-5.1
- Fix CVE-2026-11824
- Resolves: RHEL-218275