From dd27112b36400a99862bea72ef65b154254a5980 Mon Sep 17 00:00:00 2001 From: Chris Novakovic Date: Wed, 4 Feb 2026 14:20:40 +0000 Subject: [PATCH] [3.20] main/sqlite: patch CVE-2025-6965 --- main/sqlite/APKBUILD | 6 +- main/sqlite/CVE-2025-6965.patch | 97 +++++++++++++++++++++++++++++++++ 2 files changed, 102 insertions(+), 1 deletion(-) create mode 100644 main/sqlite/CVE-2025-6965.patch diff --git a/main/sqlite/APKBUILD b/main/sqlite/APKBUILD index c22bd7b724f..8459c2a455d 100644 --- a/main/sqlite/APKBUILD +++ b/main/sqlite/APKBUILD @@ -4,7 +4,7 @@ pkgname=sqlite # NOTE: pkgver needs to correspond with sqlite-tcl pkgver=3.45.3 -pkgrel=2 +pkgrel=3 pkgdesc="C library that implements an SQL database engine" url="https://www.sqlite.org/" arch="all" @@ -33,9 +33,12 @@ builddir="$srcdir/$pkgname-autoconf-$_ver" source="https://www.sqlite.org/2024/sqlite-autoconf-$_ver.tar.gz $pkgname-$_ver-LICENSE.md::https://www.sqlite.org/src/raw?name=LICENSE.md&ci=version-$pkgver CVE-2025-29087.patch + CVE-2025-6965.patch " # secfixes: +# 3.45.3-r3: +# - CVE-2025-6965 # 3.45.3-r2: # - CVE-2025-29087 # 3.34.1-r0: @@ -118,4 +121,5 @@ sha512sums=" ab4bb99186ccf81d288bc5150dacd5f8a32561303fbc0c607c24b5bb5ad44e0974655cea57d05122c62e957329f5260d170d2a71cbcf818501af29903c99a391 sqlite-autoconf-3450300.tar.gz 8a347c292363e55a8c0fa0321e3f399bfe9c9aedcb6c838123f0eb3e2a4e078d096b7c152a4981e18ee9fa50c4ef913a33ed840aeed33aee0a46e95cd17f0814 sqlite-3450300-LICENSE.md bcaba44c539658de959784be130ec4e6f471fab9c7465242b96474243499f07350d22084f2b8903607d523bc6804774985f09dc36af94a736355692e63ee85de CVE-2025-29087.patch +f576fb56cae0376efbf9e86fdd1869ae3a4f4320ca2f1d51a9ba45d64c0a5c0dd93b26fd6589ede172051f39d021e59a0c9aed26d8c002bded590817a56b4d90 CVE-2025-6965.patch " diff --git a/main/sqlite/CVE-2025-6965.patch b/main/sqlite/CVE-2025-6965.patch new file mode 100644 index 00000000000..b1a80135baa --- /dev/null +++ b/main/sqlite/CVE-2025-6965.patch @@ -0,0 +1,97 @@ +Patch-Source: https://sqlite.org/src/info/5508b56fd24016c1 + +--- a/sqlite3.c ++++ b/sqlite3.c +@@ -15355,6 +15355,14 @@ typedef INT16_TYPE LogEst; + #define LARGEST_UINT64 (0xffffffff|(((u64)0xffffffff)<<32)) + #define SMALLEST_INT64 (((i64)-1) - LARGEST_INT64) + ++/* ++** Macro SMXV(n) return the maximum value that can be held in variable n, ++** assuming n is a signed integer type. UMXV(n) is similar for unsigned ++** integer types. ++*/ ++#define SMXV(n) ((((i64)1)<<(sizeof(n)*8-1))-1) ++#define UMXV(n) ((((i64)1)<<(sizeof(n)*8))-1) ++ + /* + ** Round up a number to the next larger multiple of 8. This is used + ** to force 8-byte alignment on 64-bit architectures. +@@ -19152,7 +19160,7 @@ struct AggInfo { + ** from source tables rather than from accumulators */ + u8 useSortingIdx; /* In direct mode, reference the sorting index rather + ** than the source table */ +- u16 nSortingColumn; /* Number of columns in the sorting index */ ++ u32 nSortingColumn; /* Number of columns in the sorting index */ + int sortingIdx; /* Cursor number of the sorting index */ + int sortingIdxPTab; /* Cursor number of pseudo-table */ + int iFirstReg; /* First register in range for aCol[] and aFunc[] */ +@@ -19161,8 +19169,8 @@ struct AggInfo { + Table *pTab; /* Source table */ + Expr *pCExpr; /* The original expression */ + int iTable; /* Cursor number of the source table */ +- i16 iColumn; /* Column number within the source table */ +- i16 iSorterColumn; /* Column number in the sorting index */ ++ int iColumn; /* Column number within the source table */ ++ int iSorterColumn; /* Column number in the sorting index */ + } *aCol; + int nColumn; /* Number of used entries in aCol[] */ + int nAccumulator; /* Number of columns that show through to the output. +@@ -116549,7 +116557,9 @@ static void findOrCreateAggInfoColumn( + ){ + struct AggInfo_col *pCol; + int k; ++ int mxTerm = pParse->db->aLimit[SQLITE_LIMIT_COLUMN]; + ++ assert( mxTerm <= SMXV(i16) ); + assert( pAggInfo->iFirstReg==0 ); + pCol = pAggInfo->aCol; + for(k=0; knColumn; k++, pCol++){ +@@ -116567,6 +116577,10 @@ static void findOrCreateAggInfoColumn( + assert( pParse->db->mallocFailed ); + return; + } ++ if( k>mxTerm ){ ++ sqlite3ErrorMsg(pParse, "more than %d aggregate terms", mxTerm); ++ k = mxTerm; ++ } + pCol = &pAggInfo->aCol[k]; + assert( ExprUseYTab(pExpr) ); + pCol->pTab = pExpr->y.pTab; +@@ -116600,6 +116614,7 @@ fix_up_expr: + if( pExpr->op==TK_COLUMN ){ + pExpr->op = TK_AGG_COLUMN; + } ++ assert( k <= SMXV(pExpr->iAgg) ); + pExpr->iAgg = (i16)k; + } + +@@ -116684,13 +116699,19 @@ static int analyzeAggregate(Walker *pWalker, Expr *pExpr){ + ** function that is already in the pAggInfo structure + */ + struct AggInfo_func *pItem = pAggInfo->aFunc; ++ int mxTerm = pParse->db->aLimit[SQLITE_LIMIT_COLUMN]; ++ assert( mxTerm <= SMXV(i16) ); + for(i=0; inFunc; i++, pItem++){ + if( NEVER(pItem->pFExpr==pExpr) ) break; + if( sqlite3ExprCompare(0, pItem->pFExpr, pExpr, -1)==0 ){ + break; + } + } +- if( i>=pAggInfo->nFunc ){ ++ if( i>mxTerm ){ ++ sqlite3ErrorMsg(pParse, "more than %d aggregate terms", mxTerm); ++ i = mxTerm; ++ assert( inFunc ); ++ }else if( i>=pAggInfo->nFunc ){ + /* pExpr is original. Make a new entry in pAggInfo->aFunc[] + */ + u8 enc = ENC(pParse->db); +@@ -116744,6 +116765,7 @@ static int analyzeAggregate(Walker *pWalker, Expr *pExpr){ + */ + assert( !ExprHasProperty(pExpr, EP_TokenOnly|EP_Reduced) ); + ExprSetVVAProperty(pExpr, EP_NoReduce); ++ assert( i <= SMXV(pExpr->iAgg) ); + pExpr->iAgg = (i16)i; + pExpr->pAggInfo = pAggInfo; + return WRC_Prune;