packages/sqlite
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

!99 fix issue CVE-2023-7104

Browse Source 
From: @Jeremyzz 
Reviewed-by: @zwtmichael, @dillon_chen 
Signed-off-by: @dillon_chen
This commit is contained in:
openeuler-ci-bot 2024-01-04 08:26:39 +00:00 committed by Gitee
commit 418511d548
No known key found for this signature in database
GPG Key ID: 173E9B9CA92EEF8F
2 changed files with 51 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

45
0008-CVE-2023-7104.patch Normal file
View File

@ -0,0 +1,45 @@
it From a756d158b3e55831975feb45b753ba499d2adeda Mon Sep 17 00:00:00 2001
From: mazhao <mazhao12@huawei.com>
Date: Wed, 3 Jan 2024 12:00:45 +0800
Subject: [PATCH] Fix a buffer overread in the sessions extension that could
occur when processing a corrupt changeset.
Signed-off-by: mazhao <mazhao12@huawei.com>
---
ext/session/sqlite3session.c | 18 +++++++++++-------
1 file changed, 11 insertions(+), 7 deletions(-)
diff --git a/ext/session/sqlite3session.c b/ext/session/sqlite3session.c
index a892804..72ad427 100644
--- a/ext/session/sqlite3session.c
+++ b/ext/session/sqlite3session.c
@@ -3050,15 +3050,19 @@ static int sessionReadRecord(
}
}
if( eType==SQLITE_INTEGER || eType==SQLITE_FLOAT ){
- sqlite3_int64 v = sessionGetI64(aVal);
- if( eType==SQLITE_INTEGER ){
- sqlite3VdbeMemSetInt64(apOut[i], v);
+ if( (pIn->nData-pIn->iNext)<8 ){
+ rc = SQLITE_CORRUPT_BKPT;
}else{
- double d;
- memcpy(&d, &v, 8);
- sqlite3VdbeMemSetDouble(apOut[i], d);
+ sqlite3_int64 v = sessionGetI64(aVal);
+ if( eType==SQLITE_INTEGER ){
+ sqlite3VdbeMemSetInt64(apOut[i], v);
+ }else{
+ double d;
+ memcpy(&d, &v, 8);
+ sqlite3VdbeMemSetDouble(apOut[i], d);
+ }
+ pIn->iNext += 8;
}
- pIn->iNext += 8;
}
}
}
--
2.34.1

7
sqlite.spec
View File

@ -6,7 +6,7 @@
Name: sqlite Name: sqlite
Version: 3.37.2 Version: 3.37.2
Release: 6 Release: 7
Summary: Embeded SQL database Summary: Embeded SQL database
License: Public Domain License: Public Domain
URL: http://www.sqlite.org/ URL: http://www.sqlite.org/
@ -22,6 +22,7 @@ Patch4: 0004-fix-memory-problem-in-the-rtree-test-suite.patch
Patch5: 0005-fix-integer-overflow-on-gigabyte-string.patch Patch5: 0005-fix-integer-overflow-on-gigabyte-string.patch
Patch6: 0006-CVE-2022-46908.patch Patch6: 0006-CVE-2022-46908.patch
Patch7: 0007-CVE-2023-36191.patch Patch7: 0007-CVE-2023-36191.patch
Patch8: 0008-CVE-2023-7104.patch
BuildRequires: gcc autoconf tcl tcl-devel BuildRequires: gcc autoconf tcl tcl-devel
BuildRequires: ncurses-devel readline-devel glibc-devel BuildRequires: ncurses-devel readline-devel glibc-devel
@ -71,6 +72,7 @@ This contains man files and HTML files for the using of sqlite.
%patch5 -p1 %patch5 -p1
%patch6 -p1 %patch6 -p1
%patch7 -p1 %patch7 -p1
%patch8 -p1
rm -f %{name}-doc-%{extver}/sqlite.css~ || : rm -f %{name}-doc-%{extver}/sqlite.css~ || :
@ -145,6 +147,9 @@ make test
%{_mandir}/man*/* %{_mandir}/man*/*
%changelog %changelog
* Wed Jan 3 2024 mazhao <mazhao12@huawei.com> - 3.37.2-7
- fix the CVE-2023-7104
* Mon Aug 7 2023 zhuwentao <zhuwentao5@huawei.com> - 3.37.2-6 * Mon Aug 7 2023 zhuwentao <zhuwentao5@huawei.com> - 3.37.2-6
- fix the CVE-2023-36191 - fix the CVE-2023-36191