new file mode 100644
@@ -0,0 +1,79 @@
+From f613058ee3c084c6ec1b49e5b9874197df6e7304 Mon Sep 17 00:00:00 2001
+From: dan <Dan Kennedy>
+Date: Mon, 17 Aug 2026 11:31:59 +0000
+Subject: [PATCH] Avoid a buffer overrun when processing a strategically
+ corrupted changeset. Report [bugs:/info/2026-08-16T10:15:25Z |
+ 2026-08-16T10:15:25Z].
+
+FossilOrigin-Name: 3f57024aecea0f3b565ed823cf94b085031c481fd6323c1f2e4319a53500864f
+
+CVE: CVE-2026-119379
+Upstream-Status: Backport [https://github.com/sqlite/sqlite/commit/64459c87cc702d600704fb77ee40ca1782398a52]
+
+Backport Changes:
+- Applied the ext/session/sqlite3session.c fix to sqlite3.c because
+ the recipe source uses the amalgamated SQLite layout.
+- Omitted ext/session/sessioncorrupt.test because the extracted source
+ does not include the upstream test tree.
+- Omitted manifest and manifest.uuid because they are Fossil
+ metadata and are not required for this backport.
+
+Signed-off-by: Arpit Patel <arpitpa@cisco.com>
+---
+ sqlite3.c | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+diff --git a/sqlite3.c b/sqlite3.c
+index bcd317206b..83a018d3fc 100644
+--- a/sqlite3.c
++++ b/sqlite3.c
+@@ -236199,10 +236199,10 @@ static int sessionChangesetApply(
+ int schemaMismatch = 0;
+ int rc = SQLITE_OK; /* Return code */
+ const char *zTab = 0; /* Name of current table */
+- int nTab = 0; /* Result of sqlite3Strlen30(zTab) */
+ SessionApplyCtx sApply; /* changeset_apply() context object */
+ int bPatchset;
+ u64 savedFlag = db->flags & SQLITE_FkNoAction;
++ int bNew = 0; /* True for first entry of new table */
+
+ assert( xConflict!=0 );
+
+@@ -236223,15 +236223,16 @@ static int sessionChangesetApply(
+ if( rc==SQLITE_OK ){
+ rc = sqlite3_exec(db, "PRAGMA defer_foreign_keys = 1", 0, 0, 0);
+ }
+- while( rc==SQLITE_OK && SQLITE_ROW==sqlite3changeset_next(pIter) ){
++ while( rc==SQLITE_OK && SQLITE_ROW==sessionChangesetNext(pIter, 0, 0,&bNew) ){
+ int nCol;
+ int op;
+ const char *zNew;
+
+ sqlite3changeset_op(pIter, &zNew, &nCol, &op, 0);
+
+- if( zTab==0 || sqlite3_strnicmp(zNew, zTab, nTab+1) ){
++ if( bNew ){
+ u8 *abPK;
++ bNew = 0;
+
+ rc = sessionRetryConstraints(
+ db, pIter->bPatchset, zTab, &sApply, xConflict, pCtx
+@@ -236266,7 +236267,6 @@ static int sessionChangesetApply(
+ rc = SQLITE_NOMEM;
+ break;
+ }
+- nTab = (int)strlen(zTab);
+ sApply.azCol = (const char **)zTab;
+ }else{
+ int nMinCol = 0;
+@@ -236319,7 +236319,6 @@ static int sessionChangesetApply(
+ sApply.bStat1 = 0;
+ }
+ }
+- nTab = sqlite3Strlen30(zTab);
+ }
+ }
+
+--
+2.35.6
+
@@ -16,4 +16,5 @@ SRC_URI += "\
file://CVE-2026-119373.patch \
file://CVE-2026-119374.patch \
file://CVE-2026-119375.patch \
+ file://CVE-2026-119379.patch \
"
This patch applies the upstream fix [1], which prevents a buffer overrun when applying a strategically corrupted changeset through SQLite's session extension. The GitHub mirror commit [1] corresponds to the SQLite Fossil check-in shown in [2]. [1] https://github.com/sqlite/sqlite/commit/64459c87cc702d600704fb77ee40ca1782398a52 [2] https://sqlite.org/src/info/3f57024aecea0f3b Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-119379 Signed-off-by: Arpit Patel <arpitpa@cisco.com> --- .../sqlite/sqlite3/CVE-2026-119379.patch | 79 +++++++++++++++++++ meta/recipes-support/sqlite/sqlite3_3.51.3.bb | 1 + 2 files changed, 80 insertions(+) create mode 100644 meta/recipes-support/sqlite/sqlite3/CVE-2026-119379.patch