new file mode 100644
@@ -0,0 +1,76 @@
+From 260a971baff8140195c181b94ce2264efbb042b9 Mon Sep 17 00:00:00 2001
+From: dan <Dan Kennedy>
+Date: Tue, 11 Aug 2026 14:16:12 +0000
+Subject: [PATCH] Fix a problem in fts5 secure-delete code that could lead to a
+ buffer overrun when dealing with a strategically corrupted database. Problem
+ reported by YEONBA.
+
+FossilOrigin-Name: 9cd4f9e9205c5a5096388397a39349db9ff5377d19095c6b20388ff799969c31
+
+CVE: CVE-2026-119374
+Upstream-Status: Backport [https://github.com/sqlite/sqlite/commit/d9de6eedbe918c074c7556400fa21df5960704d9]
+
+Backport Changes:
+- Applied the fix from ext/fts5/fts5_index.c to sqlite3.c because the
+ recipe uses SQLite's amalgamated source.
+- Omitted ext/fts5/test/fts5corruptB.test because the extracted source
+ does not include the upstream Tcl test tree.
+- Omitted manifest and manifest.uuid because they are Fossil metadata
+ and are not needed for this source patch.
+
+Signed-off-by: Arpit Patel <arpitpa@cisco.com>
+---
+ sqlite3.c | 18 +++++++++++-------
+ 1 file changed, 11 insertions(+), 7 deletions(-)
+
+diff --git a/sqlite3.c b/sqlite3.c
+index bfd285777d..1889632086 100644
+--- a/sqlite3.c
++++ b/sqlite3.c
+@@ -252752,32 +252752,36 @@ static void fts5DoSecureDelete(
+ if( p->rc==SQLITE_OK ){
+ const int nMove = nPg - iNextOff; /* Number of bytes to move */
+ int nShift = iNextOff - iOff; /* Distance to move them */
+-
++ int nNewPg = 0;
+ int iPrevKeyOut = 0;
+- int iKeyIn = 0;
++ i64 iKeyIn = 0;
+
+ memmove(&aPg[iOff], &aPg[iNextOff], nMove);
+ iPgIdx -= nShift;
+- nPg = iPgIdx;
++ nNewPg = iPgIdx;
+ fts5PutU16(&aPg[2], iPgIdx);
+
+ for(iIdx=0; iIdx<nIdx; /* no-op */){
+ u32 iVal = 0;
+ iIdx += fts5GetVarint32(&aIdx[iIdx], iVal);
+ iKeyIn += iVal;
++ if( iKeyIn>nPg ){
++ FTS5_CORRUPT_IDX(p);
++ break;
++ }
+ if( iKeyIn!=iDelKeyOff ){
+ int iKeyOut = (iKeyIn - (iKeyIn>iOff ? nShift : 0));
+- nPg += sqlite3Fts5PutVarint(&aPg[nPg], iKeyOut - iPrevKeyOut);
++ nNewPg += sqlite3Fts5PutVarint(&aPg[nNewPg], iKeyOut - iPrevKeyOut);
+ iPrevKeyOut = iKeyOut;
+ }
+ }
+
+- if( iPgIdx==nPg && nIdx>0 && pSeg->iLeafPgno!=1 ){
++ if( p->rc==SQLITE_OK && iPgIdx==nNewPg && nIdx>0 && pSeg->iLeafPgno!=1 ){
+ fts5SecureDeleteIdxEntry(p, iSegid, pSeg->iLeafPgno);
+ }
+
+- assert_nc( nPg>4 || fts5GetU16(aPg)==0 );
+- fts5DataWrite(p, FTS5_SEGMENT_ROWID(iSegid,pSeg->iLeafPgno), aPg, nPg);
++ assert_nc( nNewPg>4 || fts5GetU16(aPg)==0 );
++ fts5DataWrite(p, FTS5_SEGMENT_ROWID(iSegid,pSeg->iLeafPgno), aPg, nNewPg);
+ }
+ sqlite3_free(aIdx);
+ }
+--
+2.35.6
+
@@ -14,4 +14,5 @@ SRC_URI += "\
file://CVE-2026-119377_p1.patch \
file://CVE-2026-119377_p2.patch \
file://CVE-2026-119373.patch \
+ file://CVE-2026-119374.patch \
"
This patch applies the upstream fix [1], which addresses an FTS5 secure-delete buffer overrun when handling a corrupted database. The GitHub mirror commit [1] corresponds to the SQLite Fossil check-in shown in [2]. [1] https://github.com/sqlite/sqlite/commit/d9de6eedbe918c074c7556400fa21df5960704d9 [2] https://sqlite.org/src/info/9cd4f9e920 Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-119374 Signed-off-by: Arpit Patel <arpitpa@cisco.com> --- .../sqlite/sqlite3/CVE-2026-119374.patch | 76 +++++++++++++++++++ meta/recipes-support/sqlite/sqlite3_3.51.3.bb | 1 + 2 files changed, 77 insertions(+) create mode 100644 meta/recipes-support/sqlite/sqlite3/CVE-2026-119374.patch