Backport two upstream commits (79db323ce149, eb83e32cef6a)
fixing CVE-2026-11822 in the fts5 full-text search extension.
The first fix corrects a buffer overwrite in fts5LeafRead by
checking pRet->szLeaf instead of pRet->nn in the corruption
guard. The second fix adds a bounds check in fts5LeafSeek to
prevent out-of-bounds access when processing corrupt term data.
Both patches were adapted for sqlite 3.46.1 by replacing newer
upstream macros with the equivalent error-handling pattern used
in this version.
CVE: CVE-2026-11822
Upstream patches:
- https://github.com/sqlite/sqlite/commit/79db323ce149.patch
- https://github.com/sqlite/sqlite/commit/eb83e32cef6a.patch
Resolves: RHEL-218240
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Backport upstream fix for CVE-2026-11824 to sqlite 3.46.1.
The fix corrects a bounds check in fts5LeafRead() (changing
pRet->nn<4 to pRet->szLeaf<4) to prevent a potential buffer
overwrite when processing corrupt fts5 records.
CVE: CVE-2026-11824
Upstream patches:
- https://github.com/sqlite/sqlite/commit/79db323ce149.patch
Resolves: RHEL-218275
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
Related: #801981
Removing as the bug is no longer reproducible in rawhide even without
this patch. Also disabling malloc_usable_size() is not optimal[1]:
"If the HAVE_MALLOC_USABLE_SIZE option is omitted or is false, then
SQLite uses a wrapper around system malloc() and realloc() that enlarges
each allocation by 8 bytes and writes the size of the allocation in the
initial 8 bytes, and then SQLite also implements its own home-grown
version of malloc_usable_size() that consults that 8-byte prefix to find
the allocation size. This approach works but it is suboptimal.
Applications are encouraged to use HAVE_MALLOC_USABLE_SIZE whenever
possible. "
Reproducing steps:
\# export MALLOC_CHECK_=3
\# createrepo -d .
Directory walk started
Directory walk done - 15 packages
Temporary output repo path: ./.repodata/
Preparing sqlite DBs
Pool started (with 5 workers)
Pool finished
[1] https://www.sqlite.org/compile.html
This is not really necessary, because the change would not affect the
resulting package, which is shipped to Fedora, but this way I see as
more transparent.
Its usage causes warnings, as the flag is not available anymore.
Upstream docs: https://www.sqlite.org/compile.html#enable_json1
Moreover --disable-dependency-tracking and --enable-threads-override-locks
flags are not supported by the sqlite, but used as configure options and
are causing WARNING.
This is because they are a part of %configure macro and can not be
removed easily from there.
