Fix CVE-2025-6965

Use imported tests

Resolves: RHEL-103827

gating.yaml

@@ -16,11 +16,11 @@ subject_type: koji_build
 rules:
   - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build./plans/tier1-public.functional}
  
-# RHEL
+# Gating RHEL
 --- !Policy
 product_versions:
   - rhel-*
 decision_context: osci_compose_gate
 rules:
-  - !PassingTestCaseRule {test_case_name: osci.brew-build./plans/tier1-internal.functional}
-
+  - !PassingTestCaseRule {test_case_name: osci.brew-build./plans/gating-centos.functional}
+  - !PassingTestCaseRule {test_case_name: osci.brew-build./plans/gating-rhel.functional}

plans.fmf

@@ -0,0 +1,10 @@
+/gating-centos:
+  plan:
+    import:
+      url: https://gitlab.com/redhat/centos-stream/tests/sqlite.git
+      name: /plans/gating
+/gating-rhel:
+  plan:
+    import:
+      url: https://pkgs.devel.redhat.com/git/tests/sqlite
+      name: /plans/gating

plans/tier1-internal.fmf

@@ -1,12 +0,0 @@
-summary: Internal Tier1 tests plan
-discover:
-    how: fmf
-    filter: 'tier: 1'
-    url: https://pkgs.devel.redhat.com/git/tests/sqlite
-execute:
-    how: tmt
-adjust:
-    enabled: false
-    when: distro == centos-stream or distro == fedora
-    because: No access to internal git repositories
-

plans/tier1-public.fmf

@@ -1,8 +0,0 @@
-summary: Public Tier1 tests plan
-discover:
-    how: fmf
-    filter: 'tier: 1'
-    url: https://gitlab.com/redhat/centos-stream/tests/sqlite
-execute:
-    how: tmt
-

sqlite-cve-2025-6965.patch

@@ -0,0 +1,128 @@
+Index: src/expr.c
+==================================================================
+--- /src/expr.c
++++ /435726src/expr.c
+@@ -7013,11 +7013,13 @@
+   AggInfo *pAggInfo,   /* The AggInfo object to search and/or modify */
+   Expr *pExpr          /* Expr describing the column to find or insert */
+ ){
+   struct AggInfo_col *pCol;
+   int k;
++  int mxTerm = pParse->db->aLimit[SQLITE_LIMIT_COLUMN];
+ 
++  assert( mxTerm <= SMXV(i16) );
+   assert( pAggInfo->iFirstReg==0 );
+   pCol = pAggInfo->aCol;
+   for(k=0; k<pAggInfo->nColumn; k++, pCol++){
+     if( pCol->pCExpr==pExpr ) return;
+     if( pCol->iTable==pExpr->iTable
+@@ -7030,10 +7032,14 @@
+   k = addAggInfoColumn(pParse->db, pAggInfo);
+   if( k<0 ){
+     /* OOM on resize */
+     assert( pParse->db->mallocFailed );
+     return;
++  }
++  if( k>mxTerm ){
++    sqlite3ErrorMsg(pParse, "more than %d aggregate terms", mxTerm);
++    k = mxTerm;
+   }
+   pCol = &pAggInfo->aCol[k];
+   assert( ExprUseYTab(pExpr) );
+   pCol->pTab = pExpr->y.pTab;
+   pCol->iTable = pExpr->iTable;
+@@ -7064,10 +7070,11 @@
+   assert( pExpr->pAggInfo==0 || pExpr->pAggInfo==pAggInfo );
+   pExpr->pAggInfo = pAggInfo;
+   if( pExpr->op==TK_COLUMN ){
+     pExpr->op = TK_AGG_COLUMN;
+   }
++  assert( k <= SMXV(pExpr->iAgg) );
+   pExpr->iAgg = (i16)k;
+ }
+ 
+ /*
+ ** This is the xExprCallback for a tree walker.  It is used to
+@@ -7148,17 +7155,23 @@
+       ){
+         /* Check to see if pExpr is a duplicate of another aggregate
+         ** function that is already in the pAggInfo structure
+         */
+         struct AggInfo_func *pItem = pAggInfo->aFunc;
++        int mxTerm = pParse->db->aLimit[SQLITE_LIMIT_COLUMN];
++        assert( mxTerm <= SMXV(i16) );
+         for(i=0; i<pAggInfo->nFunc; i++, pItem++){
+           if( NEVER(pItem->pFExpr==pExpr) ) break;
+           if( sqlite3ExprCompare(0, pItem->pFExpr, pExpr, -1)==0 ){
+             break;
+           }
+         }
+-        if( i>=pAggInfo->nFunc ){
++        if( i>mxTerm ){
++          sqlite3ErrorMsg(pParse, "more than %d aggregate terms", mxTerm);
++          i = mxTerm;
++          assert( i<pAggInfo->nFunc );
++        }else if( i>=pAggInfo->nFunc ){
+           /* pExpr is original.  Make a new entry in pAggInfo->aFunc[]
+           */
+           u8 enc = ENC(pParse->db);
+           i = addAggInfoFunc(pParse->db, pAggInfo);
+           if( i>=0 ){
+@@ -7208,10 +7221,11 @@
+         }
+         /* Make pExpr point to the appropriate pAggInfo->aFunc[] entry
+         */
+         assert( !ExprHasProperty(pExpr, EP_TokenOnly|EP_Reduced) );
+         ExprSetVVAProperty(pExpr, EP_NoReduce);
++        assert( i <= SMXV(pExpr->iAgg) );
+         pExpr->iAgg = (i16)i;
+         pExpr->pAggInfo = pAggInfo;
+         return WRC_Prune;
+       }else{
+         return WRC_Continue;
+
+---
+ src/sqliteInt.h | 14 +++++++++++---
+ 1 file changed, 11 insertions(+), 3 deletions(-)
+
+diff --git a/src/sqliteInt.h b/src/sqliteInt.h
+index ec126b0..29e2a2d 100644
+--- a/src/sqliteInt.h
++++ b/src/sqliteInt.h
+@@ -1007,6 +1007,14 @@ typedef INT16_TYPE LogEst;
+ #define LARGEST_UINT64 (0xffffffff|(((u64)0xffffffff)<<32))
+ #define SMALLEST_INT64 (((i64)-1) - LARGEST_INT64)
+ 
++/*
++** Macro SMXV(n) return the maximum value that can be held in variable n,
++** assuming n is a signed integer type.  UMXV(n) is similar for unsigned
++** integer types.
++*/
++#define SMXV(n) ((((i64)1)<<(sizeof(n)*8-1))-1)
++#define UMXV(n) ((((i64)1)<<(sizeof(n)*8))-1)
++
+ /*
+ ** Round up a number to the next larger multiple of 8.  This is used
+ ** to force 8-byte alignment on 64-bit architectures.
+@@ -2871,7 +2879,7 @@ struct AggInfo {
+                           ** from source tables rather than from accumulators */
+   u8 useSortingIdx;       /* In direct mode, reference the sorting index rather
+                           ** than the source table */
+-  u16 nSortingColumn;     /* Number of columns in the sorting index */
++  u32 nSortingColumn;     /* Number of columns in the sorting index */
+   int sortingIdx;         /* Cursor number of the sorting index */
+   int sortingIdxPTab;     /* Cursor number of pseudo-table */
+   int iFirstReg;          /* First register in range for aCol[] and aFunc[] */
+@@ -2880,8 +2888,8 @@ struct AggInfo {
+     Table *pTab;             /* Source table */
+     Expr *pCExpr;            /* The original expression */
+     int iTable;              /* Cursor number of the source table */
+-    i16 iColumn;             /* Column number within the source table */
+-    i16 iSorterColumn;       /* Column number in the sorting index */
++    int iColumn;             /* Column number within the source table */
++    int iSorterColumn;       /* Column number in the sorting index */
+   } *aCol;
+   int nColumn;            /* Number of used entries in aCol[] */
+   int nAccumulator;       /* Number of columns that show through to the output.
+-- 
+2.50.0

sqlite.spec

@@ -12,7 +12,7 @@
 Summary: Library that implements an embeddable SQL database engine
 Name: sqlite
 Version: %{rpmver}
-Release: 4%{?dist}
+Release: 5%{?dist}
 License: blessing
 URL: http://www.sqlite.org/
 
@@ -22,6 +22,7 @@ Source2: http://www.sqlite.org/%{year}/sqlite-autoconf-%{realver}.tar.gz
 # Support a system-wide lemon template
 Patch1: sqlite-3.6.23-lemon-system-template.patch
 Patch2: sqlite-cve-2025-3277.patch
+Patch3: sqlite-cve-2025-6965.patch
 
 BuildRequires: make
 BuildRequires: gcc
@@ -126,6 +127,7 @@ This package contains the analysis program for %{name}.
 %setup -q -a1 -n %{name}-src-%{realver}
 %patch -P 1 -p1
 %patch -P 2 -p1
+%patch -P 3 -p1
 
 # The atof test is failing on the i686 architecture, when binary configured with
 # --enable-rtree option. Failing part is text->real conversion and
@@ -262,6 +264,10 @@ make test
 %endif
 
 %changelog
+* Wed Jul 16 2025 Ales Nezbeda <anezbeda@redhat.com> - 3.46.1-5
+- Fix CVE-2025-6965
+- Resolves: RHEL-103827
+
 * Tue Apr 15 2025 Ales Nezbeda <anezbeda@redhat.com> - 3.46.1-4
 - Fix for CVE-2025-3277
 - Resolves: RHEL-87295