SOURCES/sqlite-3.26.0-CVE-2020-24736.patch

@@ -0,0 +1,114 @@
+From f030b376820102ff6cda49565c8b8173b2d44606 Mon Sep 17 00:00:00 2001
+From: dan <dan@noemail.net>
+Date: Fri, 22 Feb 2019 19:24:16 +0000
+Subject: [PATCH] Internally, remove all references to a Window object that
+ belongs to an expression in an ORDER BY clause if that expression is
+ converted to an alias of a result-set expression. Fix for [4feb3159c6].
+
+FossilOrigin-Name: 579b66eaa0816561c6e47ea116b46f229188f0fc84c1173bfe0d21df2dff9a9a
+---
+ src/resolve.c     | 49 ++++++++++++++++++++++++++++++++++-------------
+ test/window1.test | 20 +++++++++++++++++++
+ 2 files changed, 56 insertions(+), 13 deletions(-)
+
+diff --git a/src/resolve.c b/src/resolve.c
+index 9410bc020..fd2cf539a 100644
+--- a/src/resolve.c
++++ b/src/resolve.c
+@@ -1243,6 +1243,38 @@ int sqlite3ResolveOrderGroupBy(
+   return 0;
+ }
+ 
++#ifndef SQLITE_OMIT_WINDOWFUNC
++/*
++** Walker callback for resolveRemoveWindows().
++*/
++static int resolveRemoveWindowsCb(Walker *pWalker, Expr *pExpr){
++  if( ExprHasProperty(pExpr, EP_WinFunc) ){
++    Window **pp;
++    for(pp=&pWalker->u.pSelect->pWin; *pp; pp=&(*pp)->pNextWin){
++      if( *pp==pExpr->y.pWin ){
++        *pp = (*pp)->pNextWin;
++        break;
++      }    
++    }
++  }
++  return WRC_Continue;
++}
++
++/*
++** Remove any Window objects owned by the expression pExpr from the
++** Select.pWin list of Select object pSelect.
++*/
++static void resolveRemoveWindows(Select *pSelect, Expr *pExpr){
++  Walker sWalker;
++  memset(&sWalker, 0, sizeof(Walker));
++  sWalker.xExprCallback = resolveRemoveWindowsCb;
++  sWalker.u.pSelect = pSelect;
++  sqlite3WalkExpr(&sWalker, pExpr);
++}
++#else
++# define resolveRemoveWindows(x,y)
++#endif
++
+ /*
+ ** pOrderBy is an ORDER BY or GROUP BY clause in SELECT statement pSelect.
+ ** The Name context of the SELECT statement is pNC.  zType is either
+@@ -1309,19 +1341,10 @@ static int resolveOrderGroupBy(
+     }
+     for(j=0; j<pSelect->pEList->nExpr; j++){
+       if( sqlite3ExprCompare(0, pE, pSelect->pEList->a[j].pExpr, -1)==0 ){
+-#ifndef SQLITE_OMIT_WINDOWFUNC
+-        if( ExprHasProperty(pE, EP_WinFunc) ){
+-          /* Since this window function is being changed into a reference
+-          ** to the same window function the result set, remove the instance
+-          ** of this window function from the Select.pWin list. */
+-          Window **pp;
+-          for(pp=&pSelect->pWin; *pp; pp=&(*pp)->pNextWin){
+-            if( *pp==pE->y.pWin ){
+-              *pp = (*pp)->pNextWin;
+-            }    
+-          }
+-        }
+-#endif
++        /* Since this expresion is being changed into a reference
++        ** to an identical expression in the result set, remove all Window
++        ** objects belonging to the expression from the Select.pWin list. */
++        resolveRemoveWindows(pSelect, pE);
+         pItem->u.x.iOrderByCol = j+1;
+       }
+     }
+diff --git a/test/window1.test b/test/window1.test
+index 2c504205e..b3073985b 100644
+--- a/test/window1.test
++++ b/test/window1.test
+@@ -594,6 +594,26 @@
+ } {
+ }
+
++#-------------------------------------------------------------------------
++do_execsql_test 17.0 {
++  CREATE TABLE t8(a);
++  INSERT INTO t8 VALUES(1), (2), (3);
++}
++
++do_execsql_test 17.1 {
++  SELECT +sum(0) OVER () ORDER BY +sum(0) OVER ();
++} {0}
++
++do_execsql_test 17.2 {
++  select +sum(a) OVER () FROM t8 ORDER BY +sum(a) OVER () DESC;
++} {6 6 6}
++
++do_execsql_test 17.3 {
++  SELECT 10+sum(a) OVER (ORDER BY a)
++  FROM t8
++  ORDER BY 10+sum(a) OVER (ORDER BY a) DESC;
++} {16 13 11}
++
+ # 2020-05-23
+ # ticket 7a5279a25c57adf1
+ #
+-- 
+2.39.2
+

SOURCES/sqlite-3.26.0-CVE-2020-35525.patch

@@ -0,0 +1,26 @@
+From 5f69512404cd2e5153ddf90ea277fbba6dd58ab7 Mon Sep 17 00:00:00 2001
+From: drh <drh@noemail.net>
+Date: Thu, 20 Feb 2020 14:08:51 +0000
+Subject: [PATCH] Early-out on the INTERSECT query processing following an
+ error.
+
+FossilOrigin-Name: a67cf5b7d37d5b1484be32092635faafd8f76e5881898cd9435517c4b287d663
+---
+ src/select.c  |  1 +
+ 1 files changed, 1 insertions(+), 0 deletions(-)
+
+diff --git a/src/select.c b/src/select.c
+index c60ff2700..b3ae9f415 100644
+--- a/src/select.c
++++ b/src/select.c
+@@ -2775,6 +2775,7 @@ static int multiSelect(
+         /* Generate code to take the intersection of the two temporary
+         ** tables.
+         */
++        if( rc ) break;
+         assert( p->pEList );
+         iBreak = sqlite3VdbeMakeLabel(v);
+         iCont = sqlite3VdbeMakeLabel(v);
+--
+2.37.3
+

SOURCES/sqlite-3.26.0-CVE-2020-35527.patch

@@ -0,0 +1,55 @@
+From 0990c415f65d2556a5e4122cbe5727d500411aeb Mon Sep 17 00:00:00 2001
+From: drh <drh@noemail.net>
+Date: Sun, 23 Feb 2020 17:34:45 +0000
+Subject: [PATCH] Fix a problem with ALTER TABLE for views that have a nested
+ FROM clause. Ticket [f50af3e8a565776b].
+
+FossilOrigin-Name: c431b3fd8fd0f6a6974bba3e9366b0430ec003d570e7ce70ceefbcff5fe4b6fa
+---
+ src/select.c       |  2 +-
+ test/altertab.test | 17 +++++++++++++++++
+ 4 files changed, 18 insertions(+), 1 deletions(-)
+
+diff --git a/src/select.c b/src/select.c
+index c60ff2700..fe0229ca8 100644
+--- a/src/select.c
++++ b/src/select.c
+@@ -5046,7 +5046,7 @@ static int selectExpander(Walker *pWalker, Select *p){
+             pNew = sqlite3ExprListAppend(pParse, pNew, pExpr);
+             sqlite3TokenInit(&sColname, zColname);
+             sqlite3ExprListSetName(pParse, pNew, &sColname, 0);
+-            if( pNew && (p->selFlags & SF_NestedFrom)!=0 ){
++            if( pNew && (p->selFlags & SF_NestedFrom)!=0 && !IN_RENAME_OBJECT){
+               struct ExprList_item *pX = &pNew->a[pNew->nExpr-1];
+               if( pSub ){
+                 pX->zSpan = sqlite3DbStrDup(db, pSub->pEList->a[j].zSpan);
+
+diff --git a/test/altertab.test b/test/altertab.test
+index a3642070e..520502c3d 100644
+--- a/test/altertab.test
++++ b/test/altertab.test
+@@ -578,5 +578,21 @@ ifcapable fts3 {
+     SELECT * FROM z1_segments;
+   }
+ }
++# 2020-02-23 ticket f50af3e8a565776b
++reset_db
++do_execsql_test 19.100 {
++  CREATE TABLE t1(x);
++  CREATE VIEW t2 AS SELECT 1 FROM t1, (t1 AS a0, t1);
++  ALTER TABLE t1 RENAME TO t3;
++  SELECT sql FROM sqlite_master;
++} {{CREATE TABLE "t3"(x)} {CREATE VIEW t2 AS SELECT 1 FROM "t3", ("t3" AS a0, "t3")}}
++do_execsql_test 19.110 {
++  INSERT INTO t3(x) VALUES(123);
++  SELECT * FROM t2;
++} {1}
++do_execsql_test 19.120 {
++  INSERT INTO t3(x) VALUES('xyz');
++  SELECT * FROM t2;
++} {1 1 1 1 1 1 1 1}
+
+ finish_test
+--
+2.37.3
+

SOURCES/sqlite-3.26.0-CVE-2022-35737.patch

@@ -0,0 +1,31 @@
+From 077e17b59a98eb8839ecfef661e7305fdb3e898d Mon Sep 17 00:00:00 2001
+From: drh <>
+Date: Mon, 18 Jul 2022 15:02:00 +0000
+Subject: [PATCH] Increase the size of loop variables in the printf()
+ implementation to avoid harmless compiler warnings.
+
+FossilOrigin-Name: aab790a16e1bdff78759f9c9ae87a2559ba82dd34ef3dedfb66035a0db7067a7
+---
+ manifest      | 12 ++++++------
+ manifest.uuid |  2 +-
+ src/printf.c  |  4 ++--
+ 1 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/src/printf.c b/src/printf.c
+index f0bfa5327..3602e1fcb 100644
+--- a/src/printf.c
++++ b/src/printf.c
+@@ -803,8 +803,8 @@ void sqlite3_str_vappendf(
+       case etSQLESCAPE:           /* %q: Escape ' characters */
+       case etSQLESCAPE2:          /* %Q: Escape ' and enclose in '...' */
+       case etSQLESCAPE3: {        /* %w: Escape " characters */
+-        int i, j, k, n, isnull;
+-        int needQuote;
++        i64 i, j, k, n;
++        int needQuote, isnull;
+         char ch;
+         char q = ((xtype==etSQLESCAPE3)?'"':'\'');   /* Quote character */
+         char *escarg;
+--
+2.38.1
+

SOURCES/sqlite-3.34.1-CVE-2023-7104.patch

@@ -0,0 +1,42 @@
+From 09f1652f36c5c4e8a6a640ce887f9ea0f48a7958 Mon Sep 17 00:00:00 2001
+From: dan <Dan Kennedy>
+Date: Thu, 7 Sep 2023 13:53:09 +0000
+Subject: [PATCH] Fix a buffer overread in the sessions extension that could
+ occur when processing a corrupt changeset.
+
+FossilOrigin-Name: 0e4e7a05c4204b47a324d67e18e76d2a98e26b2723d19d5c655ec9fd2e41f4b7
+
+diff --git a/ext/session/sqlite3session.c b/ext/session/sqlite3session.c
+index 9f862f2465..0491549231 100644
+--- a/ext/session/sqlite3session.c
++++ b/ext/session/sqlite3session.c
+@@ -2811,15 +2811,19 @@ static int sessionReadRecord(
+         }
+       }
+       if( eType==SQLITE_INTEGER || eType==SQLITE_FLOAT ){
+-        sqlite3_int64 v = sessionGetI64(aVal);
+-        if( eType==SQLITE_INTEGER ){
+-          sqlite3VdbeMemSetInt64(apOut[i], v);
++        if( (pIn->nData-pIn->iNext)<8 ){
++          rc = SQLITE_CORRUPT_BKPT;
+         }else{
+-          double d;
+-          memcpy(&d, &v, 8);
+-          sqlite3VdbeMemSetDouble(apOut[i], d);
++          sqlite3_int64 v = sessionGetI64(aVal);
++          if( eType==SQLITE_INTEGER ){
++            sqlite3VdbeMemSetInt64(apOut[i], v);
++          }else{
++            double d;
++            memcpy(&d, &v, 8);
++            sqlite3VdbeMemSetDouble(apOut[i], d);
++          }
++          pIn->iNext += 8;
+         }
+-        pIn->iNext += 8;
+       }
+     }
+   }
+-- 
+2.43.0
+

SPECS/sqlite.spec

@@ -10,7 +10,7 @@
 Summary: Library that implements an embeddable SQL database engine
 Name: sqlite
 Version: %{rpmver}
-Release: 15%{?dist}
+Release: 19%{?dist}
 License: Public Domain
 Group: Applications/Databases
 URL: http://www.sqlite.org/
@@ -92,6 +92,19 @@ Patch31: sqlite-3.26.0-CVE-2019-19603.patch
 # Fix for CVE-2020-13435
 # https://www.sqlite.org/src/info/ad7bb70af9bb68d1
 Patch34: sqlite-3.26.0-CVE-2020-13435.patch
+# Fix for CVE-2020-35527
+# https://www.sqlite.org/src/info/c431b3fd8fd0f6a6
+Patch35: sqlite-3.26.0-CVE-2020-35527.patch
+# Fix for CVE-2020-35525
+# https://www.sqlite.org/src/info/a67cf5b7d37d5b14
+Patch36: sqlite-3.26.0-CVE-2020-35525.patch
+# Fix for CVE-2022-35737
+# https://www.sqlite.org/src/info/26db4fc22fe66658
+Patch37: sqlite-3.26.0-CVE-2022-35737.patch
+# Fix for CVE-2020-24736
+# https://www.sqlite.org/src/info/579b66eaa0816561
+Patch38: sqlite-3.26.0-CVE-2020-24736.patch
+Patch39: sqlite-3.34.1-CVE-2023-7104.patch
 
 BuildRequires: ncurses-devel readline-devel glibc-devel
 BuildRequires: autoconf
@@ -188,39 +201,44 @@ This package contains the analysis program for %{name}.
 
 %prep
 %setup -q -a1 -n %{name}-src-%{realver}
-%patch1 -p1
-%patch2 -p1
-%patch3 -p1
-%patch4 -p1
-%patch6 -p1
+%patch -P 1 -p1
+%patch -P 2 -p1
+%patch -P 3 -p1
+%patch -P 4 -p1
+%patch -P 6 -p1
 %ifarch %{ix86}
-%patch7 -p1
+%patch -P 7 -p1
 %endif
-%patch8 -p1
-%patch9 -p1
-%patch10 -p1
-%patch11 -p1
-%patch12 -p1
-%patch13 -p1
-%patch14 -p1
-%patch15 -p1
-%patch16 -p1
-%patch17 -p1
-%patch18 -p1
-%patch19 -p1
-%patch20 -p1
-%patch21 -p1
-%patch22 -p1
-%patch23 -p1
-%patch24 -p1
-%patch25 -p1
-%patch26 -p1
-%patch27 -p1
-%patch28 -p1
-%patch29 -p1
-%patch30 -p1
-%patch31 -p1
-%patch34 -p1
+%patch -P 8 -p1
+%patch -P 9 -p1
+%patch -P 10 -p1
+%patch -P 11 -p1
+%patch -P 12 -p1
+%patch -P 13 -p1
+%patch -P 14 -p1
+%patch -P 15 -p1
+%patch -P 16 -p1
+%patch -P 17 -p1
+%patch -P 18 -p1
+%patch -P 19 -p1
+%patch -P 20 -p1
+%patch -P 21 -p1
+%patch -P 22 -p1
+%patch -P 23 -p1
+%patch -P 24 -p1
+%patch -P 25 -p1
+%patch -P 26 -p1
+%patch -P 27 -p1
+%patch -P 28 -p1
+%patch -P 29 -p1
+%patch -P 30 -p1
+%patch -P 31 -p1
+%patch -P 34 -p1
+%patch -P 35 -p1
+%patch -P 36 -p1
+%patch -P 37 -p1
+%patch -P 38 -p1
+%patch -P 39 -p1
 
 
 # Remove backup-file
@@ -322,6 +340,19 @@ make test
 %endif
 
 %changelog
+* Wed Jan 03 2024 Zuzana Miklankova <zmiklank@redhat.com> - 3.26.0-19
+- Fixed CVE-2023-7104
+
+* Fri Apr 14 2023 Zuzana Miklankova <zmiklank@redhat.com> - 3.26.0-18
+- Fixed CVE-2022-24736
+
+* Tue Nov 15 2022 Zuzana Miklankova <zmiklank@redhat.com> - 3.26.0-17
+- Fixed CVE-2022-35737
+
+* Mon Sep 05 2022 Zuzana Miklankova <zmiklank@redhat.com> - 3.26.0-16
+- Fixed CVE-2020-35527
+- Fixed CVE-2020-35525
+
 * Tue May 18 2021 Petr Kubat <pkubat@redhat.com> - 3.26.0-15
 - Removing fix for CVE-2019-19645 (unaffected)
 - Removing fix for CVE-2019-19880 (unaffected)