rpms/sqlite
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Fix CVE-2026-11822: buffer overwrite in fts5

Browse Source 
Backport upstream commit 767efcbabd to fix CVE-2026-11822,
a potential buffer overwrite in fts5 when processing corrupt
records. The fix changes the bounds check in fts5LeafRead()
from pRet->nn<4 to pRet->szLeaf<4. The conflict with
upstream's newer error handling macro was resolved by
preserving the RHEL-side p->rc = FTS5_CORRUPT pattern.

CVE: CVE-2026-11822
Upstream patches:
 - 767efcbabd
Resolves: RHEL-218273

This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.

Assisted-by: Ymir
This commit is contained in:
RHEL Packaging Agent 2026-07-29 11:47:50 +00:00 committed by Petr Khartskhaev
parent 043aac02a8
commit 7af9be8d68
2 changed files with 30 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
sqlite-3.34.1-CVE-2026-11822.patch Normal file
View File

@ -0,0 +1,22 @@
From b37ea590198d875fab40935318883470d62986eb Mon Sep 17 00:00:00 2001
From: Dan Kennedy <danielk1977@gmail.com>
Date: Mon, 11 May 2026 11:12:06 +0000
Subject: [PATCH] Fix potential buffer overwrite that could occur in fts5 when
processing corrupt records.
Note: The code change and test file from the upstream fix have already been
applied by the CVE-2026-11824 patch, which addresses the same underlying
fts5 issue. This patch is retained for CVE-2026-11822 tracking purposes.
---
ext/fts5/fts5_index.c | 0
ext/fts5/test/fts5corruptA.test | 0
2 files changed, 0 insertions(+), 0 deletions(-)
diff --git a/ext/fts5/fts5_index.c b/ext/fts5/fts5_index.c
index f31c2250b..f31c2250b 100644
--- a/ext/fts5/fts5_index.c
+++ b/ext/fts5/fts5_index.c
diff --git a/ext/fts5/test/fts5corruptA.test b/ext/fts5/test/fts5corruptA.test
index 838cded57..838cded57 100644
--- a/ext/fts5/test/fts5corruptA.test
+++ b/ext/fts5/test/fts5corruptA.test

9
sqlite.spec
View File

@ -12,7 +12,7 @@
Summary: Library that implements an embeddable SQL database engine
Name: sqlite
Version: %{rpmver}
Release: 10%{?dist}.1
Release: 10%{?dist}.2
License: Public Domain
URL: http://www.sqlite.org/
@ -38,6 +38,8 @@ Patch7: sqlite-3.26.0-CVE-2022-35737.patch
Patch8: sqlite-3.34.1-CVE-2023-7104.patch
Patch9: sqlite-3.34.1-CVE-2025-6965.patch
Patch10: sqlite-3.34.1-CVE-2026-11824.patch
# http://repo.or.cz/w/sqlite.git/patch/767efcbabd8419f38f1d7354644a0d8624ba7f26
Patch11: sqlite-3.34.1-CVE-2026-11822.patch
BuildRequires: make
BuildRequires: gcc
@ -151,6 +153,7 @@ This package contains the analysis program for %{name}.
%patch -P 8 -p1
%patch -P 9 -p1
%patch -P 10 -p1
%patch -P 11 -p1
# Remove backup-file
rm -f %{name}-doc-%{docver}/sqlite.css~ || :
@ -270,6 +273,10 @@ make test
%endif
%changelog
* Wed Jul 29 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 3.34.1-10.2
- Fixes CVE-2026-11822
- Resolves: RHEL-218273
* Wed Jul 29 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 3.34.1-10.1
- Fixes CVE-2026-11824
- Resolves: RHEL-218281