mirror of
git://git.yoctoproject.org/poky.git
synced 2025-07-19 21:09:03 +02:00
sqlite3: update to 3.28.0
(From OE-Core rev: 9be07e8c8eea8565df73405775ec2ffb60659118) Signed-off-by: Oleksandr Kravchuk <open.source@oleksandr-kravchuk.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Oleksandr Kravchuk
Richard Purdie
parent
ad200dfca8
commit
fe5b1ceb41
|
|
@ -1,28 +0,0 @@
|
||||||
Running fts5 prefix queries inside a transaction could trigger a heap-based
|
|
||||||
buffer over-read in fts5HashEntrySort in sqlite3.c, which may lead to an
|
|
||||||
information leak.
|
|
||||||
|
|
||||||
CVE: CVE-2019-9936
|
|
||||||
Upstream-Status: Backport [https://sqlite.org/src/vpatch?from=45c73deb440496e8&to=b3fa58dd7403dbd4]
|
|
||||||
Signed-off-by: Ross Burton <ross.burton@intel.com>
|
|
||||||
---
|
|
||||||
sqlite3.c | 4 +++-
|
|
||||||
1 file changed, 3 insertions(+), 1 deletion(-)
|
|
||||||
|
|
||||||
diff --git a/sqlite3.c b/sqlite3.c
|
|
||||||
index 4729f45..65527d8 100644
|
|
||||||
--- a/sqlite3.c
|
|
||||||
+++ b/sqlite3.c
|
|
||||||
@@ -207759,7 +207759,9 @@ static int fts5HashEntrySort(
|
|
||||||
for(iSlot=0; iSlot<pHash->nSlot; iSlot++){
|
|
||||||
Fts5HashEntry *pIter;
|
|
||||||
for(pIter=pHash->aSlot[iSlot]; pIter; pIter=pIter->pHashNext){
|
|
||||||
- if( pTerm==0 || 0==memcmp(fts5EntryKey(pIter), pTerm, nTerm) ){
|
|
||||||
+ if( pTerm==0
|
|
||||||
+ || (pIter->nKey+1>=nTerm && 0==memcmp(fts5EntryKey(pIter), pTerm, nTerm))
|
|
||||||
+ ){
|
|
||||||
Fts5HashEntry *pEntry = pIter;
|
|
||||||
pEntry->pScanNext = 0;
|
|
||||||
for(i=0; ap[i]; i++){
|
|
||||||
--
|
|
||||||
2.20.1
|
|
||||||
|
|
@ -1,187 +0,0 @@
|
||||||
Interleaving reads and writes in a single transaction with an fts5 virtual table
|
|
||||||
will lead to a NULL Pointer Dereference in fts5ChunkIterate in sqlite3.c.
|
|
||||||
|
|
||||||
CVE: CVE-2019-9937
|
|
||||||
Upstream-Status: Backport [https://sqlite.org/src/vpatch?from=c2f50aa4e7bad882&to=45c73deb440496e8]
|
|
||||||
Signed-off-by: Ross Burton <ross.burton@intel.com>
|
|
||||||
|
|
||||||
---
|
|
||||||
sqlite3.c | 83 ++++++++++++++++++++++++++++++++++++++-----------------
|
|
||||||
1 file changed, 57 insertions(+), 26 deletions(-)
|
|
||||||
|
|
||||||
diff --git a/sqlite3.c b/sqlite3.c
|
|
||||||
index 65527d8..b1a8799 100644
|
|
||||||
--- a/sqlite3.c
|
|
||||||
+++ b/sqlite3.c
|
|
||||||
@@ -200668,8 +200668,9 @@ static void sqlite3Fts5HashClear(Fts5Hash*);
|
|
||||||
|
|
||||||
static int sqlite3Fts5HashQuery(
|
|
||||||
Fts5Hash*, /* Hash table to query */
|
|
||||||
+ int nPre,
|
|
||||||
const char *pTerm, int nTerm, /* Query term */
|
|
||||||
- const u8 **ppDoclist, /* OUT: Pointer to doclist for pTerm */
|
|
||||||
+ void **ppObj, /* OUT: Pointer to doclist for pTerm */
|
|
||||||
int *pnDoclist /* OUT: Size of doclist in bytes */
|
|
||||||
);
|
|
||||||
|
|
||||||
@@ -207501,19 +207502,25 @@ static int fts5HashResize(Fts5Hash *pHash){
|
|
||||||
return SQLITE_OK;
|
|
||||||
}
|
|
||||||
|
|
||||||
-static void fts5HashAddPoslistSize(Fts5Hash *pHash, Fts5HashEntry *p){
|
|
||||||
+static int fts5HashAddPoslistSize(
|
|
||||||
+ Fts5Hash *pHash,
|
|
||||||
+ Fts5HashEntry *p,
|
|
||||||
+ Fts5HashEntry *p2
|
|
||||||
+){
|
|
||||||
+ int nRet = 0;
|
|
||||||
if( p->iSzPoslist ){
|
|
||||||
- u8 *pPtr = (u8*)p;
|
|
||||||
+ u8 *pPtr = p2 ? (u8*)p2 : (u8*)p;
|
|
||||||
+ int nData = p->nData;
|
|
||||||
if( pHash->eDetail==FTS5_DETAIL_NONE ){
|
|
||||||
- assert( p->nData==p->iSzPoslist );
|
|
||||||
+ assert( nData==p->iSzPosList );
|
|
||||||
if( p->bDel ){
|
|
||||||
- pPtr[p->nData++] = 0x00;
|
|
||||||
+ pPtr[nData++] = 0x00;
|
|
||||||
if( p->bContent ){
|
|
||||||
- pPtr[p->nData++] = 0x00;
|
|
||||||
+ pPtr[nData++] = 0x00;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}else{
|
|
||||||
- int nSz = (p->nData - p->iSzPoslist - 1); /* Size in bytes */
|
|
||||||
+ int nSz = (nData - p->iSzPoslist - 1); /* Size in bytes */
|
|
||||||
int nPos = nSz*2 + p->bDel; /* Value of nPos field */
|
|
||||||
|
|
||||||
assert( p->bDel==0 || p->bDel==1 );
|
|
||||||
@@ -207523,14 +207530,19 @@ static void fts5HashAddPoslistSize(Fts5Hash *pHash, Fts5HashEntry *p){
|
|
||||||
int nByte = sqlite3Fts5GetVarintLen((u32)nPos);
|
|
||||||
memmove(&pPtr[p->iSzPoslist + nByte], &pPtr[p->iSzPoslist + 1], nSz);
|
|
||||||
sqlite3Fts5PutVarint(&pPtr[p->iSzPoslist], nPos);
|
|
||||||
- p->nData += (nByte-1);
|
|
||||||
+ nData += (nByte-1);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
- p->iSzPoslist = 0;
|
|
||||||
- p->bDel = 0;
|
|
||||||
- p->bContent = 0;
|
|
||||||
+ nRet = nData - p->nData;
|
|
||||||
+ if( p2 == 0 ){
|
|
||||||
+ p->iSzPoslist = 0;
|
|
||||||
+ p->bDel = 0;
|
|
||||||
+ p->bContent = 0;
|
|
||||||
+ p->nData = nData;
|
|
||||||
+ }
|
|
||||||
}
|
|
||||||
+ return nRet;
|
|
||||||
}
|
|
||||||
|
|
||||||
/*
|
|
||||||
@@ -207642,7 +207654,7 @@ static int sqlite3Fts5HashWrite(
|
|
||||||
/* If this is a new rowid, append the 4-byte size field for the previous
|
|
||||||
** entry, and the new rowid for this entry. */
|
|
||||||
if( iRowid!=p->iRowid ){
|
|
||||||
- fts5HashAddPoslistSize(pHash, p);
|
|
||||||
+ fts5HashAddPoslistSize(pHash, p, 0);
|
|
||||||
p->nData += sqlite3Fts5PutVarint(&pPtr[p->nData], iRowid - p->iRowid);
|
|
||||||
p->iRowid = iRowid;
|
|
||||||
bNew = 1;
|
|
||||||
@@ -207789,8 +207801,9 @@ static int fts5HashEntrySort(
|
|
||||||
*/
|
|
||||||
static int sqlite3Fts5HashQuery(
|
|
||||||
Fts5Hash *pHash, /* Hash table to query */
|
|
||||||
+ int nPre,
|
|
||||||
const char *pTerm, int nTerm, /* Query term */
|
|
||||||
- const u8 **ppDoclist, /* OUT: Pointer to doclist for pTerm */
|
|
||||||
+ void **ppOut, /* OUT: Pointer to new object */
|
|
||||||
int *pnDoclist /* OUT: Size of doclist in bytes */
|
|
||||||
){
|
|
||||||
unsigned int iHash = fts5HashKey(pHash->nSlot, (const u8*)pTerm, nTerm);
|
|
||||||
@@ -207804,11 +207817,20 @@ static int sqlite3Fts5HashQuery(
|
|
||||||
}
|
|
||||||
|
|
||||||
if( p ){
|
|
||||||
- fts5HashAddPoslistSize(pHash, p);
|
|
||||||
- *ppDoclist = (const u8*)&zKey[nTerm+1];
|
|
||||||
- *pnDoclist = p->nData - (sizeof(Fts5HashEntry) + nTerm + 1);
|
|
||||||
+ int nHashPre = sizeof(Fts5HashEntry) + nTerm + 1;
|
|
||||||
+ int nList = p->nData - nHashPre;
|
|
||||||
+ u8 *pRet = (u8*)(*ppOut = sqlite3_malloc64(nPre + nList + 10));
|
|
||||||
+ if ( pRet ){
|
|
||||||
+ Fts5HashEntry *pFaux = (Fts5HashEntry*)&pRet[nPre-nHashPre];
|
|
||||||
+ memcpy(&pRet[nPre], &((u8*)p)[nHashPre], nList);
|
|
||||||
+ nList += fts5HashAddPoslistSize(pHash, p, pFaux);
|
|
||||||
+ *pnDoclist = nList;
|
|
||||||
+ }else{
|
|
||||||
+ *pnDoclist = 0;
|
|
||||||
+ return SQLITE_NOMEM;
|
|
||||||
+ }
|
|
||||||
}else{
|
|
||||||
- *ppDoclist = 0;
|
|
||||||
+ *ppOut = 0;
|
|
||||||
*pnDoclist = 0;
|
|
||||||
}
|
|
||||||
|
|
||||||
@@ -207841,7 +207863,7 @@ static void sqlite3Fts5HashScanEntry(
|
|
||||||
if( (p = pHash->pScan) ){
|
|
||||||
char *zKey = fts5EntryKey(p);
|
|
||||||
int nTerm = (int)strlen(zKey);
|
|
||||||
- fts5HashAddPoslistSize(pHash, p);
|
|
||||||
+ fts5HashAddPoslistSize(pHash, p, 0);
|
|
||||||
*pzTerm = zKey;
|
|
||||||
*ppDoclist = (const u8*)&zKey[nTerm+1];
|
|
||||||
*pnDoclist = p->nData - (sizeof(Fts5HashEntry) + nTerm + 1);
|
|
||||||
@@ -210311,31 +210333,40 @@ static void fts5SegIterHashInit(
|
|
||||||
int flags, /* Mask of FTS5INDEX_XXX flags */
|
|
||||||
Fts5SegIter *pIter /* Object to populate */
|
|
||||||
){
|
|
||||||
- const u8 *pList = 0;
|
|
||||||
int nList = 0;
|
|
||||||
const u8 *z = 0;
|
|
||||||
int n = 0;
|
|
||||||
+ Fts5Data *pLeaf = 0;
|
|
||||||
|
|
||||||
assert( p->pHash );
|
|
||||||
assert( p->rc==SQLITE_OK );
|
|
||||||
|
|
||||||
if( pTerm==0 || (flags & FTS5INDEX_QUERY_SCAN) ){
|
|
||||||
+ const u8 *pList = 0;
|
|
||||||
+
|
|
||||||
p->rc = sqlite3Fts5HashScanInit(p->pHash, (const char*)pTerm, nTerm);
|
|
||||||
sqlite3Fts5HashScanEntry(p->pHash, (const char**)&z, &pList, &nList);
|
|
||||||
n = (z ? (int)strlen((const char*)z) : 0);
|
|
||||||
+ if ( pList ){
|
|
||||||
+ pLeaf = fts5IdxMalloc(p, sizeof(Fts5Data));
|
|
||||||
+ if ( pLeaf ){
|
|
||||||
+ pLeaf->p = pList;
|
|
||||||
+ }
|
|
||||||
+ }
|
|
||||||
}else{
|
|
||||||
- pIter->flags |= FTS5_SEGITER_ONETERM;
|
|
||||||
- sqlite3Fts5HashQuery(p->pHash, (const char*)pTerm, nTerm, &pList, &nList);
|
|
||||||
+ p->rc = sqlite3Fts5HashQuery(p->pHash, sizeof(Fts5Data),
|
|
||||||
+ (const char*)pTerm, nTerm, (void**)&pLeaf, &nList
|
|
||||||
+ );
|
|
||||||
+ if( pLeaf ){
|
|
||||||
+ pLeaf->p = (u8*)&pLeaf[1];
|
|
||||||
+ }
|
|
||||||
z = pTerm;
|
|
||||||
n = nTerm;
|
|
||||||
+ pIter->flags |= FTS5_SEGITER_ONETERM;
|
|
||||||
}
|
|
||||||
|
|
||||||
- if( pList ){
|
|
||||||
- Fts5Data *pLeaf;
|
|
||||||
+ if( pLeaf ){
|
|
||||||
sqlite3Fts5BufferSet(&p->rc, &pIter->term, n, z);
|
|
||||||
- pLeaf = fts5IdxMalloc(p, sizeof(Fts5Data));
|
|
||||||
- if( pLeaf==0 ) return;
|
|
||||||
- pLeaf->p = (u8*)pList;
|
|
||||||
pLeaf->nn = pLeaf->szLeaf = nList;
|
|
||||||
pIter->pLeaf = pLeaf;
|
|
||||||
pIter->iLeafOffset = fts5GetVarint(pLeaf->p, (u64*)&pIter->iRowid);
|
|
||||||
--
|
|
||||||
2.20.1
|
|
||||||
|
|
@ -1,13 +0,0 @@
|
||||||
require sqlite3.inc
|
|
||||||
|
|
||||||
LICENSE = "PD"
|
|
||||||
LIC_FILES_CHKSUM = "file://sqlite3.h;endline=11;md5=786d3dc581eff03f4fd9e4a77ed00c66"
|
|
||||||
|
|
||||||
SRC_URI = "\
|
|
||||||
http://www.sqlite.org/2019/sqlite-autoconf-${SQLITE_PV}.tar.gz \
|
|
||||||
file://CVE-2019-9936.patch \
|
|
||||||
file://CVE-2019-9937.patch \
|
|
||||||
"
|
|
||||||
|
|
||||||
SRC_URI[md5sum] = "1f72631ce6e8efa5b4a6e55a43b3bdc0"
|
|
||||||
SRC_URI[sha256sum] = "50c39e85ea28b5ecfdb3f9e860afe9ba606381e21836b2849efca6a0bfe6ef6e"
|
|
||||||
8
meta/recipes-support/sqlite/sqlite3_3.28.0.bb
Normal file
8
meta/recipes-support/sqlite/sqlite3_3.28.0.bb
Normal file
|
|
@ -0,0 +1,8 @@
|
||||||
|
require sqlite3.inc
|
||||||
|
|
||||||
|
LICENSE = "PD"
|
||||||
|
LIC_FILES_CHKSUM = "file://sqlite3.h;endline=11;md5=786d3dc581eff03f4fd9e4a77ed00c66"
|
||||||
|
|
||||||
|
SRC_URI = "http://www.sqlite.org/2019/sqlite-autoconf-${SQLITE_PV}.tar.gz"
|
||||||
|
SRC_URI[md5sum] = "3c68eb400f8354605736cd55400e1572"
|
||||||
|
SRC_URI[sha256sum] = "d61b5286f062adfce5125eaf544d495300656908e61fca143517afcc0a89b7c3"
|
||||||
Loading…
Reference in New Issue
Block a user