diff --git a/main/sqlite/APKBUILD b/main/sqlite/APKBUILD index 8f4fcb7e021..29a9c37d1b9 100644 --- a/main/sqlite/APKBUILD +++ b/main/sqlite/APKBUILD @@ -119,5 +119,5 @@ sha512sums=" 59ad55df15eb84430f5286db2e5ceddd6ca1fc207a6343546a365c0c1baf20258e96c53d2ad48b50385608d03de09a692ae834cb78a39d1a48cb36a05722e402 sqlite-autoconf-3440200.tar.gz 8a347c292363e55a8c0fa0321e3f399bfe9c9aedcb6c838123f0eb3e2a4e078d096b7c152a4981e18ee9fa50c4ef913a33ed840aeed33aee0a46e95cd17f0814 sqlite-3440200-LICENSE.md bcaba44c539658de959784be130ec4e6f471fab9c7465242b96474243499f07350d22084f2b8903607d523bc6804774985f09dc36af94a736355692e63ee85de CVE-2025-29087.patch -f576fb56cae0376efbf9e86fdd1869ae3a4f4320ca2f1d51a9ba45d64c0a5c0dd93b26fd6589ede172051f39d021e59a0c9aed26d8c002bded590817a56b4d90 CVE-2025-6965.patch +1d107efd240f18437069e38ced628232323a676051707efe3312cbcfad60e8a573ca1cae156836c48e42ed89f7ef43ac978a652f1e9bc5cc80033a17607ab051 CVE-2025-6965.patch " diff --git a/main/sqlite/CVE-2025-6965.patch b/main/sqlite/CVE-2025-6965.patch index b1a80135baa..f2df82d7a56 100644 --- a/main/sqlite/CVE-2025-6965.patch +++ b/main/sqlite/CVE-2025-6965.patch @@ -1,12 +1,12 @@ -Patch-Source: https://sqlite.org/src/info/5508b56fd24016c1 +Adapted from https://sqlite.org/src/info/5508b56fd24016c1 by Chris Novakovic ---- a/sqlite3.c -+++ b/sqlite3.c -@@ -15355,6 +15355,14 @@ typedef INT16_TYPE LogEst; - #define LARGEST_UINT64 (0xffffffff|(((u64)0xffffffff)<<32)) +diff -Naur a/sqlite3.c b/sqlite3.c +--- a/sqlite3.c 2023-11-24 13:34:02.000000000 +0000 ++++ b/sqlite3.c 2026-02-04 15:07:10.413293372 +0000 +@@ -14912,6 +14912,14 @@ #define SMALLEST_INT64 (((i64)-1) - LARGEST_INT64) -+/* + /* +** Macro SMXV(n) return the maximum value that can be held in variable n, +** assuming n is a signed integer type. UMXV(n) is similar for unsigned +** integer types. @@ -14,10 +14,11 @@ Patch-Source: https://sqlite.org/src/info/5508b56fd24016c1 +#define SMXV(n) ((((i64)1)<<(sizeof(n)*8-1))-1) +#define UMXV(n) ((((i64)1)<<(sizeof(n)*8))-1) + - /* ++/* ** Round up a number to the next larger multiple of 8. This is used ** to force 8-byte alignment on 64-bit architectures. -@@ -19152,7 +19160,7 @@ struct AggInfo { + ** +@@ -18682,7 +18690,7 @@ ** from source tables rather than from accumulators */ u8 useSortingIdx; /* In direct mode, reference the sorting index rather ** than the source table */ @@ -26,7 +27,7 @@ Patch-Source: https://sqlite.org/src/info/5508b56fd24016c1 int sortingIdx; /* Cursor number of the sorting index */ int sortingIdxPTab; /* Cursor number of pseudo-table */ int iFirstReg; /* First register in range for aCol[] and aFunc[] */ -@@ -19161,8 +19169,8 @@ struct AggInfo { +@@ -18691,8 +18699,8 @@ Table *pTab; /* Source table */ Expr *pCExpr; /* The original expression */ int iTable; /* Cursor number of the source table */ @@ -37,7 +38,7 @@ Patch-Source: https://sqlite.org/src/info/5508b56fd24016c1 } *aCol; int nColumn; /* Number of used entries in aCol[] */ int nAccumulator; /* Number of columns that show through to the output. -@@ -116549,7 +116557,9 @@ static void findOrCreateAggInfoColumn( +@@ -114576,7 +114584,9 @@ ){ struct AggInfo_col *pCol; int k; @@ -47,7 +48,7 @@ Patch-Source: https://sqlite.org/src/info/5508b56fd24016c1 assert( pAggInfo->iFirstReg==0 ); pCol = pAggInfo->aCol; for(k=0; knColumn; k++, pCol++){ -@@ -116567,6 +116577,10 @@ static void findOrCreateAggInfoColumn( +@@ -114594,6 +114604,10 @@ assert( pParse->db->mallocFailed ); return; } @@ -58,7 +59,7 @@ Patch-Source: https://sqlite.org/src/info/5508b56fd24016c1 pCol = &pAggInfo->aCol[k]; assert( ExprUseYTab(pExpr) ); pCol->pTab = pExpr->y.pTab; -@@ -116600,6 +116614,7 @@ fix_up_expr: +@@ -114627,6 +114641,7 @@ if( pExpr->op==TK_COLUMN ){ pExpr->op = TK_AGG_COLUMN; } @@ -66,14 +67,14 @@ Patch-Source: https://sqlite.org/src/info/5508b56fd24016c1 pExpr->iAgg = (i16)k; } -@@ -116684,13 +116699,19 @@ static int analyzeAggregate(Walker *pWalker, Expr *pExpr){ +@@ -114710,13 +114725,19 @@ ** function that is already in the pAggInfo structure */ struct AggInfo_func *pItem = pAggInfo->aFunc; + int mxTerm = pParse->db->aLimit[SQLITE_LIMIT_COLUMN]; + assert( mxTerm <= SMXV(i16) ); for(i=0; inFunc; i++, pItem++){ - if( NEVER(pItem->pFExpr==pExpr) ) break; + if( pItem->pFExpr==pExpr ) break; if( sqlite3ExprCompare(0, pItem->pFExpr, pExpr, -1)==0 ){ break; } @@ -87,7 +88,7 @@ Patch-Source: https://sqlite.org/src/info/5508b56fd24016c1 /* pExpr is original. Make a new entry in pAggInfo->aFunc[] */ u8 enc = ENC(pParse->db); -@@ -116744,6 +116765,7 @@ static int analyzeAggregate(Walker *pWalker, Expr *pExpr){ +@@ -114768,6 +114789,7 @@ */ assert( !ExprHasProperty(pExpr, EP_TokenOnly|EP_Reduced) ); ExprSetVVAProperty(pExpr, EP_NoReduce);