diff --git a/gating.yaml b/gating.yaml index 0158a0f..34abd3c 100644 --- a/gating.yaml +++ b/gating.yaml @@ -16,11 +16,11 @@ subject_type: koji_build rules: - !PassingTestCaseRule {test_case_name: fedora-ci.koji-build./plans/tier1-public.functional} -# RHEL +# Gating RHEL --- !Policy product_versions: - rhel-* decision_context: osci_compose_gate rules: - - !PassingTestCaseRule {test_case_name: osci.brew-build./plans/tier1-internal.functional} - + - !PassingTestCaseRule {test_case_name: osci.brew-build./plans/gating-centos.functional} + - !PassingTestCaseRule {test_case_name: osci.brew-build./plans/gating-rhel.functional} diff --git a/plans.fmf b/plans.fmf new file mode 100644 index 0000000..4384c6d --- /dev/null +++ b/plans.fmf @@ -0,0 +1,10 @@ +/gating-centos: + plan: + import: + url: https://gitlab.com/redhat/centos-stream/tests/sqlite.git + name: /plans/gating +/gating-rhel: + plan: + import: + url: https://pkgs.devel.redhat.com/git/tests/sqlite + name: /plans/gating diff --git a/plans/tier1-internal.fmf b/plans/tier1-internal.fmf deleted file mode 100644 index a7869c8..0000000 --- a/plans/tier1-internal.fmf +++ /dev/null @@ -1,12 +0,0 @@ -summary: Internal Tier1 tests plan -discover: - how: fmf - filter: 'tier: 1' - url: https://pkgs.devel.redhat.com/git/tests/sqlite -execute: - how: tmt -adjust: - enabled: false - when: distro == centos-stream or distro == fedora - because: No access to internal git repositories - diff --git a/plans/tier1-public.fmf b/plans/tier1-public.fmf deleted file mode 100644 index 1c93de9..0000000 --- a/plans/tier1-public.fmf +++ /dev/null @@ -1,8 +0,0 @@ -summary: Public Tier1 tests plan -discover: - how: fmf - filter: 'tier: 1' - url: https://gitlab.com/redhat/centos-stream/tests/sqlite -execute: - how: tmt - diff --git a/sqlite-cve-2025-6965.patch b/sqlite-cve-2025-6965.patch new file mode 100644 index 0000000..d440871 --- /dev/null +++ b/sqlite-cve-2025-6965.patch @@ -0,0 +1,128 @@ +Index: src/expr.c +================================================================== +--- /src/expr.c ++++ /435726src/expr.c +@@ -7013,11 +7013,13 @@ + AggInfo *pAggInfo, /* The AggInfo object to search and/or modify */ + Expr *pExpr /* Expr describing the column to find or insert */ + ){ + struct AggInfo_col *pCol; + int k; ++ int mxTerm = pParse->db->aLimit[SQLITE_LIMIT_COLUMN]; + ++ assert( mxTerm <= SMXV(i16) ); + assert( pAggInfo->iFirstReg==0 ); + pCol = pAggInfo->aCol; + for(k=0; knColumn; k++, pCol++){ + if( pCol->pCExpr==pExpr ) return; + if( pCol->iTable==pExpr->iTable +@@ -7030,10 +7032,14 @@ + k = addAggInfoColumn(pParse->db, pAggInfo); + if( k<0 ){ + /* OOM on resize */ + assert( pParse->db->mallocFailed ); + return; ++ } ++ if( k>mxTerm ){ ++ sqlite3ErrorMsg(pParse, "more than %d aggregate terms", mxTerm); ++ k = mxTerm; + } + pCol = &pAggInfo->aCol[k]; + assert( ExprUseYTab(pExpr) ); + pCol->pTab = pExpr->y.pTab; + pCol->iTable = pExpr->iTable; +@@ -7064,10 +7070,11 @@ + assert( pExpr->pAggInfo==0 || pExpr->pAggInfo==pAggInfo ); + pExpr->pAggInfo = pAggInfo; + if( pExpr->op==TK_COLUMN ){ + pExpr->op = TK_AGG_COLUMN; + } ++ assert( k <= SMXV(pExpr->iAgg) ); + pExpr->iAgg = (i16)k; + } + + /* + ** This is the xExprCallback for a tree walker. It is used to +@@ -7148,17 +7155,23 @@ + ){ + /* Check to see if pExpr is a duplicate of another aggregate + ** function that is already in the pAggInfo structure + */ + struct AggInfo_func *pItem = pAggInfo->aFunc; ++ int mxTerm = pParse->db->aLimit[SQLITE_LIMIT_COLUMN]; ++ assert( mxTerm <= SMXV(i16) ); + for(i=0; inFunc; i++, pItem++){ + if( NEVER(pItem->pFExpr==pExpr) ) break; + if( sqlite3ExprCompare(0, pItem->pFExpr, pExpr, -1)==0 ){ + break; + } + } +- if( i>=pAggInfo->nFunc ){ ++ if( i>mxTerm ){ ++ sqlite3ErrorMsg(pParse, "more than %d aggregate terms", mxTerm); ++ i = mxTerm; ++ assert( inFunc ); ++ }else if( i>=pAggInfo->nFunc ){ + /* pExpr is original. Make a new entry in pAggInfo->aFunc[] + */ + u8 enc = ENC(pParse->db); + i = addAggInfoFunc(pParse->db, pAggInfo); + if( i>=0 ){ +@@ -7208,10 +7221,11 @@ + } + /* Make pExpr point to the appropriate pAggInfo->aFunc[] entry + */ + assert( !ExprHasProperty(pExpr, EP_TokenOnly|EP_Reduced) ); + ExprSetVVAProperty(pExpr, EP_NoReduce); ++ assert( i <= SMXV(pExpr->iAgg) ); + pExpr->iAgg = (i16)i; + pExpr->pAggInfo = pAggInfo; + return WRC_Prune; + }else{ + return WRC_Continue; + +--- + src/sqliteInt.h | 14 +++++++++++--- + 1 file changed, 11 insertions(+), 3 deletions(-) + +diff --git a/src/sqliteInt.h b/src/sqliteInt.h +index ec126b0..29e2a2d 100644 +--- a/src/sqliteInt.h ++++ b/src/sqliteInt.h +@@ -1007,6 +1007,14 @@ typedef INT16_TYPE LogEst; + #define LARGEST_UINT64 (0xffffffff|(((u64)0xffffffff)<<32)) + #define SMALLEST_INT64 (((i64)-1) - LARGEST_INT64) + ++/* ++** Macro SMXV(n) return the maximum value that can be held in variable n, ++** assuming n is a signed integer type. UMXV(n) is similar for unsigned ++** integer types. ++*/ ++#define SMXV(n) ((((i64)1)<<(sizeof(n)*8-1))-1) ++#define UMXV(n) ((((i64)1)<<(sizeof(n)*8))-1) ++ + /* + ** Round up a number to the next larger multiple of 8. This is used + ** to force 8-byte alignment on 64-bit architectures. +@@ -2871,7 +2879,7 @@ struct AggInfo { + ** from source tables rather than from accumulators */ + u8 useSortingIdx; /* In direct mode, reference the sorting index rather + ** than the source table */ +- u16 nSortingColumn; /* Number of columns in the sorting index */ ++ u32 nSortingColumn; /* Number of columns in the sorting index */ + int sortingIdx; /* Cursor number of the sorting index */ + int sortingIdxPTab; /* Cursor number of pseudo-table */ + int iFirstReg; /* First register in range for aCol[] and aFunc[] */ +@@ -2880,8 +2888,8 @@ struct AggInfo { + Table *pTab; /* Source table */ + Expr *pCExpr; /* The original expression */ + int iTable; /* Cursor number of the source table */ +- i16 iColumn; /* Column number within the source table */ +- i16 iSorterColumn; /* Column number in the sorting index */ ++ int iColumn; /* Column number within the source table */ ++ int iSorterColumn; /* Column number in the sorting index */ + } *aCol; + int nColumn; /* Number of used entries in aCol[] */ + int nAccumulator; /* Number of columns that show through to the output. +-- +2.50.0 \ No newline at end of file diff --git a/sqlite.spec b/sqlite.spec index f97f387..853d6d2 100644 --- a/sqlite.spec +++ b/sqlite.spec @@ -12,7 +12,7 @@ Summary: Library that implements an embeddable SQL database engine Name: sqlite Version: %{rpmver} -Release: 4%{?dist} +Release: 5%{?dist} License: blessing URL: http://www.sqlite.org/ @@ -22,6 +22,7 @@ Source2: http://www.sqlite.org/%{year}/sqlite-autoconf-%{realver}.tar.gz # Support a system-wide lemon template Patch1: sqlite-3.6.23-lemon-system-template.patch Patch2: sqlite-cve-2025-3277.patch +Patch3: sqlite-cve-2025-6965.patch BuildRequires: make BuildRequires: gcc @@ -126,6 +127,7 @@ This package contains the analysis program for %{name}. %setup -q -a1 -n %{name}-src-%{realver} %patch -P 1 -p1 %patch -P 2 -p1 +%patch -P 3 -p1 # The atof test is failing on the i686 architecture, when binary configured with # --enable-rtree option. Failing part is text->real conversion and @@ -262,6 +264,10 @@ make test %endif %changelog +* Wed Jul 16 2025 Ales Nezbeda - 3.46.1-5 +- Fix CVE-2025-6965 +- Resolves: RHEL-103827 + * Tue Apr 15 2025 Ales Nezbeda - 3.46.1-4 - Fix for CVE-2025-3277 - Resolves: RHEL-87295