new file mode 100644
@@ -0,0 +1,56 @@
+From ddb597d563f2b17e9f42911f78ef0573cae047ed Mon Sep 17 00:00:00 2001
+From: dan <Dan Kennedy>
+Date: Tue, 4 Aug 2026 11:04:17 +0000
+Subject: [PATCH] In fts5, account for the possibility of negative docids when
+ allocating a buffer to store the results of merging detail=none prefix lists.
+ Fix for report [bugs:/info/2026-08-04T08:49:27Z | 2026-08-04T08:49:27Z].
+
+FossilOrigin-Name: a7f8c92f623e9cbe8a61266d949916acc9e5110c94dff4aa6fd1ad2ea8a60d4e
+
+CVE: CVE-2026-119373
+Upstream-Status: Backport [https://github.com/sqlite/sqlite/commit/e1c9934f9f11a499029abb020ea715a08970da80]
+
+Backport Changes:
+- Applied the FTS5 fix from ext/fts5/fts5_index.c to sqlite3.c because
+ the recipe source uses the amalgamated SQLite layout.
+- Omitted ext/fts5/test/fts5prefix2.test because the extracted source
+ does not include SQLite's Tcl test tree.
+- Omitted manifest and manifest.uuid because they are Fossil
+ repository metadata and are not needed for this source patch.
+
+Signed-off-by: Arpit Patel <arpitpa@cisco.com>
+---
+ sqlite3.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/sqlite3.c b/sqlite3.c
+index bb908566d4..bfd285777d 100644
+--- a/sqlite3.c
++++ b/sqlite3.c
+@@ -253340,7 +253340,7 @@ static void fts5MergeRowidLists(
+ (void)nBuf;
+ memset(&out, 0, sizeof(out));
+ assert( nBuf==1 );
+- sqlite3Fts5BufferSize(&p->rc, &out, p1->n + p2->n);
++ sqlite3Fts5BufferSize(&p->rc, &out, p1->n + p2->n + 9);
+ if( p->rc ) return;
+
+ fts5NextRowid(p1, &i1, &iRowid1);
+@@ -253348,12 +253348,12 @@ static void fts5MergeRowidLists(
+ while( i1>=0 || i2>=0 ){
+ if( i1>=0 && (i2<0 || iRowid1<iRowid2) ){
+ assert( iOut==0 || iRowid1>iOut );
+- fts5BufferSafeAppendVarint(&out, iRowid1 - iOut);
++ fts5BufferSafeAppendVarint(&out, (u64)iRowid1 - (u64)iOut);
+ iOut = iRowid1;
+ fts5NextRowid(p1, &i1, &iRowid1);
+ }else{
+ assert( iOut==0 || iRowid2>iOut );
+- fts5BufferSafeAppendVarint(&out, iRowid2 - iOut);
++ fts5BufferSafeAppendVarint(&out, (u64)iRowid2 - (u64)iOut);
+ iOut = iRowid2;
+ if( i1>=0 && iRowid1==iRowid2 ){
+ fts5NextRowid(p1, &i1, &iRowid1);
+--
+2.35.6
+
@@ -13,4 +13,5 @@ SRC_URI += "\
file://CVE-2026-119377-dependent_p2.patch \
file://CVE-2026-119377_p1.patch \
file://CVE-2026-119377_p2.patch \
+ file://CVE-2026-119373.patch \
"
This patch applies the upstream fix [1], which prevents a buffer overflow when merging FTS5 detail=none prefix lists with negative docids. The GitHub mirror commit [1] corresponds to the SQLite Fossil check-in shown in [2]. [1] https://github.com/sqlite/sqlite/commit/e1c9934f9f11a499029abb020ea715a08970da80 [2] https://sqlite.org/src/info/a7f8c92f62 Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-119373 Signed-off-by: Arpit Patel <arpitpa@cisco.com> --- .../sqlite/sqlite3/CVE-2026-119373.patch | 56 +++++++++++++++++++ meta/recipes-support/sqlite/sqlite3_3.51.3.bb | 1 + 2 files changed, 57 insertions(+) create mode 100644 meta/recipes-support/sqlite/sqlite3/CVE-2026-119373.patch