mirrors/aports
1
0
Fork 0
mirror of https://gitlab.alpinelinux.org/alpine/aports.git synced 2026-02-12 19:32:31 +01:00
Code Issues Packages Projects Releases Wiki Activity

[3.20] main/sqlite: patch CVE-2025-6965

Browse Source
This commit is contained in:
Chris Novakovic 2026-02-04 14:20:40 +00:00
parent 8906e8e14e
commit dd27112b36
2 changed files with 102 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
main/sqlite/APKBUILD
View File

@ -4,7 +4,7 @@
pkgname=sqlite
# NOTE: pkgver needs to correspond with sqlite-tcl
pkgver=3.45.3
pkgrel=2
pkgrel=3
pkgdesc="C library that implements an SQL database engine"
url="https://www.sqlite.org/"
arch="all"
@ -33,9 +33,12 @@ builddir="$srcdir/$pkgname-autoconf-$_ver"
source="https://www.sqlite.org/2024/sqlite-autoconf-$_ver.tar.gz
$pkgname-$_ver-LICENSE.md::https://www.sqlite.org/src/raw?name=LICENSE.md&ci=version-$pkgver
CVE-2025-29087.patch
CVE-2025-6965.patch
"
# secfixes:
# 3.45.3-r3:
# - CVE-2025-6965
# 3.45.3-r2:
# - CVE-2025-29087
# 3.34.1-r0:
@ -118,4 +121,5 @@ sha512sums="
ab4bb99186ccf81d288bc5150dacd5f8a32561303fbc0c607c24b5bb5ad44e0974655cea57d05122c62e957329f5260d170d2a71cbcf818501af29903c99a391 sqlite-autoconf-3450300.tar.gz
8a347c292363e55a8c0fa0321e3f399bfe9c9aedcb6c838123f0eb3e2a4e078d096b7c152a4981e18ee9fa50c4ef913a33ed840aeed33aee0a46e95cd17f0814 sqlite-3450300-LICENSE.md
bcaba44c539658de959784be130ec4e6f471fab9c7465242b96474243499f07350d22084f2b8903607d523bc6804774985f09dc36af94a736355692e63ee85de CVE-2025-29087.patch
f576fb56cae0376efbf9e86fdd1869ae3a4f4320ca2f1d51a9ba45d64c0a5c0dd93b26fd6589ede172051f39d021e59a0c9aed26d8c002bded590817a56b4d90 CVE-2025-6965.patch
"

97
main/sqlite/CVE-2025-6965.patch Normal file
View File

@ -0,0 +1,97 @@
Patch-Source: https://sqlite.org/src/info/5508b56fd24016c1
--- a/sqlite3.c
+++ b/sqlite3.c
@@ -15355,6 +15355,14 @@ typedef INT16_TYPE LogEst;
#define LARGEST_UINT64 (0xffffffff|(((u64)0xffffffff)<<32))
#define SMALLEST_INT64 (((i64)-1) - LARGEST_INT64)
+/*
+** Macro SMXV(n) return the maximum value that can be held in variable n,
+** assuming n is a signed integer type. UMXV(n) is similar for unsigned
+** integer types.
+*/
+#define SMXV(n) ((((i64)1)<<(sizeof(n)*8-1))-1)
+#define UMXV(n) ((((i64)1)<<(sizeof(n)*8))-1)
+
/*
** Round up a number to the next larger multiple of 8. This is used
** to force 8-byte alignment on 64-bit architectures.
@@ -19152,7 +19160,7 @@ struct AggInfo {
** from source tables rather than from accumulators */
u8 useSortingIdx; /* In direct mode, reference the sorting index rather
** than the source table */
- u16 nSortingColumn; /* Number of columns in the sorting index */
+ u32 nSortingColumn; /* Number of columns in the sorting index */
int sortingIdx; /* Cursor number of the sorting index */
int sortingIdxPTab; /* Cursor number of pseudo-table */
int iFirstReg; /* First register in range for aCol[] and aFunc[] */
@@ -19161,8 +19169,8 @@ struct AggInfo {
Table *pTab; /* Source table */
Expr *pCExpr; /* The original expression */
int iTable; /* Cursor number of the source table */
- i16 iColumn; /* Column number within the source table */
- i16 iSorterColumn; /* Column number in the sorting index */
+ int iColumn; /* Column number within the source table */
+ int iSorterColumn; /* Column number in the sorting index */
} *aCol;
int nColumn; /* Number of used entries in aCol[] */
int nAccumulator; /* Number of columns that show through to the output.
@@ -116549,7 +116557,9 @@ static void findOrCreateAggInfoColumn(
){
struct AggInfo_col *pCol;
int k;
+ int mxTerm = pParse->db->aLimit[SQLITE_LIMIT_COLUMN];
+ assert( mxTerm <= SMXV(i16) );
assert( pAggInfo->iFirstReg==0 );
pCol = pAggInfo->aCol;
for(k=0; k<pAggInfo->nColumn; k++, pCol++){
@@ -116567,6 +116577,10 @@ static void findOrCreateAggInfoColumn(
assert( pParse->db->mallocFailed );
return;
}
+ if( k>mxTerm ){
+ sqlite3ErrorMsg(pParse, "more than %d aggregate terms", mxTerm);
+ k = mxTerm;
+ }
pCol = &pAggInfo->aCol[k];
assert( ExprUseYTab(pExpr) );
pCol->pTab = pExpr->y.pTab;
@@ -116600,6 +116614,7 @@ fix_up_expr:
if( pExpr->op==TK_COLUMN ){
pExpr->op = TK_AGG_COLUMN;
}
+ assert( k <= SMXV(pExpr->iAgg) );
pExpr->iAgg = (i16)k;
}
@@ -116684,13 +116699,19 @@ static int analyzeAggregate(Walker *pWalker, Expr *pExpr){
** function that is already in the pAggInfo structure
*/
struct AggInfo_func *pItem = pAggInfo->aFunc;
+ int mxTerm = pParse->db->aLimit[SQLITE_LIMIT_COLUMN];
+ assert( mxTerm <= SMXV(i16) );
for(i=0; i<pAggInfo->nFunc; i++, pItem++){
if( NEVER(pItem->pFExpr==pExpr) ) break;
if( sqlite3ExprCompare(0, pItem->pFExpr, pExpr, -1)==0 ){
break;
}
}
- if( i>=pAggInfo->nFunc ){
+ if( i>mxTerm ){
+ sqlite3ErrorMsg(pParse, "more than %d aggregate terms", mxTerm);
+ i = mxTerm;
+ assert( i<pAggInfo->nFunc );
+ }else if( i>=pAggInfo->nFunc ){
/* pExpr is original. Make a new entry in pAggInfo->aFunc[]
*/
u8 enc = ENC(pParse->db);
@@ -116744,6 +116765,7 @@ static int analyzeAggregate(Walker *pWalker, Expr *pExpr){
*/
assert( !ExprHasProperty(pExpr, EP_TokenOnly|EP_Reduced) );
ExprSetVVAProperty(pExpr, EP_NoReduce);
+ assert( i <= SMXV(pExpr->iAgg) );
pExpr->iAgg = (i16)i;
pExpr->pAggInfo = pAggInfo;
return WRC_Prune;