From patchwork Thu Nov 5 05:30:23 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arpit Patel X-Patchwork-Id: 102967 Received: from rcdn-iport-2.cisco.com (rcdn-iport-2.cisco.com [173.37.86.73]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.27951.1793856625938429352 for ; Wed, 04 Nov 2026 21:30:26 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=IMsqxsKg; spf=pass (domain: cisco.com, ip: 173.37.86.73, mailfrom: arpitpa@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=4679; q=dns/txt; s=iport01; t=1793856625; x=1795066225; h=from:to:cc:subject:date:message-id:mime-version: content-transfer-encoding; bh=hesU5emkxWs5YHZwkeC91XLovar+RS46GcHLi6vnsfk=; b=IMsqxsKgiUinfCVnooj5ILld2V6Ws5ZPrpX/je3D0D0bSyaX+OnW75N+ /fGcORGmJ2GWvYo3Ujb1RpGkF/jX2ziqwjJ5SQdK2/3eYQP12hv/tFJL5 CZIfEe+nXvTIxyOpuS8OtEOLSMzOpwGqndYK7kG6WSV9wc0wP9PKfMpnP 1+OT6lqizcY0RKG3pbZ7bS6KvxKmLamVnJUb8qF+Sn5sk1LGjqJa9Jxcd 3DR+YYcqsAVU/y3pWEIrYermPhhz2NJ73bcOAl8ZWxRqNNz0jfjo3TTG6 q7A6mgQDVWRj3kMt3Nx596Aolgr7xVeAIHe6qrVuKydZ3XJmrYq9mNeMg Q==; X-CSE-ConnectionGUID: iLmg3OzyRLS4FXLCkxzSjQ== X-CSE-MsgGUID: bWEBBlR9RSiKpLJyBimFfw== X-IPAS-Result: A0BFAgCDE+xq/4v/Ja1aHgEBCxIMggULgld1YENJlkueJIF+DwEBAQ9EDQQBAYQ/Ro4fAiY0CQ4BAgQDAgMBAQEBAQEBAQEBAQEKAQEFAQEBAgEHBYEOE4ZPDZASAQIBKgsBGAEtLAMBAlojIYMCAYJ0AxG8P4F5M4EBgmZDAT8CQ1DZS4FoAQsUAQWBM4VAModxXRgBhH0nG4FJRIJQgi6BBYFcAQGBOIZuBIMugVqNGAKBUoZwSIEeA1ksAVUTDQoLBwWBaAM1EioVbjIdgSM+F4EHGwYFgR2BHoESgQddgSsoXQEhgQiBdgKCUYIAAgFJQQ4HRVMJJUMSRyQiCBIJARMaLAqBGjU8CSY/FQxkCxoFYQgCDQxyORAwHiQvBRwmQBsKGBgNSBEsNxUZBD5uB5Ivgn4TAYENASuCPaNEgiGhEYQqgWiKPJU6GjOFW6UWC5h9jgqWUYRpgWg8gUcLBzMaCBsVgyIJShkPji4LC4NggX+DFMlIJjICCTIBAQcCBw4DC4FokAGBfQEB IronPort-Data: A9a23:+0YS96+UH1Qr8V2fLZAoDrUD1n+TJUtcMsCJ2f8bNWPcYEJGY0x3x 2QdX2qFbv/bYWGgftp3PISzo08FvpGAm98yGQpsqn1EQiMRo6IpJzg2wmQcns+2BpeeJK6yx 5xGMrEsFOhtEDmB4E/rbei5xZVF/fngbqLmD+LZMTxGSwZhSSMw4TpugOdRbrRA2bBVOCvT/ 4mtyyHjEAX9gWAtazpIs/jrRC5H5ZwehhtJ5jTSWtgT1LPuvyF9JI4SI6i3M0z5TuF8dsamR /zOxa2O5WjQ+REgELuNyt4XpWVTH9Y+lSDX4pZnc/DKbipq/0Te4Y5nXBYoUnq7vh3S9zxHJ HqhgrTrIeshFvWkdO3wyHC0GQkmVUFN0OevzXRSLaV/wmWeG0YAzcmCA2k3GYgXocFlEFtqz qA2GBQmbQCRvOCPlefTpulE3qzPLeHxN48Z/3UlxjbDALN+G9bIQr7B4plT2zJYasJmRKmFI ZFGL2AyMVKZOEwn1lQ/UPrSmM+hnGH+byVRgFmUvqEwpWPUyWSd1ZCwa4KPII3WGpo9ckCwr F3r1U79OEAgD9280R6n41itg8HBgnauMG4VPPjinhJwu3WU3mEVBRgcWFe3rPX8gUmkVvpbK lcI4WwptaU0+UmhQ9XxUhH+p2SL1iPwQPJKGOE8rQXIwa3O7kPBXC4PTyVKb5ots8peqSEW6 2JlVujBXVRH2IB5g1rGnltIhVte4RQoEFI= IronPort-HdrOrdr: A9a23:cc4JJqG4CW3+L/kApLqExMeALOsnbusQ8zAXPo5KJiC9Ffbo8v xG88576faZslsssRIb6LK90de7IU80nKQdieJ6AV7IZmfbUQWTQL2KxLGSpwEIYxeOldJ15O NHb7V0DsH2ABxRiMb35xT9LvMbqeP3l5xBQYzlvg5QpcYAUdAH0ztE X-Talos-CUID: 9a23:JMJNnmCyteRcWD/6EyhD8UFPPdI0SFnmkFngB2S7GXRSSoTAHA== X-Talos-MUID: 9a23:h4a3aQxS6qNNHNBnujYbdxPI80eaqK6RJWonla9XgfKFFjRUGSa3jTGZTJByfw== X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,196,1787011200"; d="scan'208";a="530229477" Received: from rcdn-l-core-02.cisco.com ([173.37.255.139]) by rcdn-iport-2.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 05 Nov 2026 05:30:25 +0000 Received: from sjc-ads-10129.cisco.com (sjc-ads-10129.cisco.com [10.30.210.133]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "ciscoit-managed-infra-smtp-auth.cisco.com", Issuer "Internal Private TLS SubCA" (verified OK)) by rcdn-l-core-02.cisco.com (Postfix) with ESMTPS id 0C3A21800036B; Thu, 5 Nov 2026 05:30:25 +0000 (GMT) Received: by sjc-ads-10129.cisco.com (Postfix, from userid 1877011) id AD93DCC2EF1; Wed, 4 Nov 2026 21:30:24 -0800 (PST) From: Arpit Patel To: openembedded-core@lists.openembedded.org Cc: xe-linux-external@cisco.com Subject: [OE-core][wrynose][PATCH 08/10] sqlite3: fix CVE-2026-119376 Date: Wed, 4 Nov 2026 21:30:23 -0800 Message-Id: <20261105053023.2448641-1-arpitpa@cisco.com> X-Mailer: git-send-email 2.35.6 MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-Client-TLS: VERIFIED;sjc-ads-10129.cisco.com [10.30.210.133];TLSv1.3;TLS_AES_256_GCM_SHA384;256;ciscoit-managed-infra-smtp-auth.cisco.com X-Outbound-SMTP-Client: 10.30.210.133, sjc-ads-10129.cisco.com X-Outbound-Node: rcdn-l-core-02.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 05 Nov 2026 05:30:35 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249432 This patch applies the upstream fix [1], which includes COLLATE expressions in expression tree depth calculations and prevents bypass of the expression depth limit. The GitHub mirror commit [1] corresponds to the SQLite Fossil check-in shown in [2]. [1] https://github.com/sqlite/sqlite/commit/d54522a5b832422ab893a1e9fa7a99ab314ea4e2 [2] https://sqlite.org/src/info/252c0b7bf5a727d2 Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-119376 Signed-off-by: Arpit Patel --- .../sqlite/sqlite3/CVE-2026-119376.patch | 75 +++++++++++++++++++ meta/recipes-support/sqlite/sqlite3_3.51.3.bb | 1 + 2 files changed, 76 insertions(+) create mode 100644 meta/recipes-support/sqlite/sqlite3/CVE-2026-119376.patch diff --git a/meta/recipes-support/sqlite/sqlite3/CVE-2026-119376.patch b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119376.patch new file mode 100644 index 0000000000..32060a5444 --- /dev/null +++ b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119376.patch @@ -0,0 +1,75 @@ +From 0e3ec7377ba0ef29b02e258e9fbb395d0d6dd431 Mon Sep 17 00:00:00 2001 +From: drh <> +Date: Sun, 4 Oct 2026 21:54:17 +0000 +Subject: [PATCH] Fix expression tree depth calculations for COLLATE. + [bugs:/info/2026-10-04T04:50:56Z|Bug 2026-10-04T04:50:56Z] + +FossilOrigin-Name: 252c0b7bf5a727d29605672bb58e06c758173c276671df3e388a68294998b4d3 + +CVE: CVE-2026-119376 +Upstream-Status: Backport [https://github.com/sqlite/sqlite/commit/d54522a5b832422ab893a1e9fa7a99ab314ea4e2] + +Backport Changes: +- Ported the src/expr.c and src/sqliteInt.h changes into sqlite3.c + because the recipe source uses the amalgamated SQLite layout. +- Omitted test/sqllimits1.test because the extracted source does not + include the upstream test tree. +- Omitted manifest and manifest.uuid because they are Fossil + repository metadata and are not needed for this source patch. + +Signed-off-by: Arpit Patel +--- + sqlite3.c | 16 +++++++++++----- + 1 file changed, 11 insertions(+), 5 deletions(-) + +diff --git a/sqlite3.c b/sqlite3.c +index 45ade42b16..603ca28a27 100644 +--- a/sqlite3.c ++++ b/sqlite3.c +@@ -21992,8 +21992,8 @@ SQLITE_PRIVATE void sqlite3SetTextEncoding(sqlite3 *db, u8); + SQLITE_PRIVATE CollSeq *sqlite3ExprCollSeq(Parse *pParse, const Expr *pExpr); + SQLITE_PRIVATE CollSeq *sqlite3ExprNNCollSeq(Parse *pParse, const Expr *pExpr); + SQLITE_PRIVATE int sqlite3ExprCollSeqMatch(Parse*,const Expr*,const Expr*); +-SQLITE_PRIVATE Expr *sqlite3ExprAddCollateToken(const Parse *pParse, Expr*, const Token*, int); +-SQLITE_PRIVATE Expr *sqlite3ExprAddCollateString(const Parse*,Expr*,const char*); ++SQLITE_PRIVATE Expr *sqlite3ExprAddCollateToken(Parse *pParse, Expr*, const Token*, int); ++SQLITE_PRIVATE Expr *sqlite3ExprAddCollateString(Parse*,Expr*,const char*); + SQLITE_PRIVATE Expr *sqlite3ExprSkipCollate(Expr*); + SQLITE_PRIVATE Expr *sqlite3ExprSkipCollateAndLikely(Expr*); + SQLITE_PRIVATE int sqlite3CheckCollSeq(Parse *, CollSeq *); +@@ -111640,23 +111640,29 @@ SQLITE_PRIVATE int sqlite3ExprDataType(const Expr *pExpr){ + ** and the pExpr parameter is returned unchanged. + */ + SQLITE_PRIVATE Expr *sqlite3ExprAddCollateToken( +- const Parse *pParse, /* Parsing context */ ++ Parse *pParse, /* Parsing context */ + Expr *pExpr, /* Add the "COLLATE" clause to this expression */ + const Token *pCollName, /* Name of collating sequence */ + int dequote /* True to dequote pCollName */ + ){ +- if( pCollName->n>0 ){ ++ if( pCollName->n>0 && pParse->nErr==0 ){ + Expr *pNew = sqlite3ExprAlloc(pParse->db, TK_COLLATE, pCollName, dequote); ++ assert( pExpr!=0 ); + if( pNew ){ + pNew->pLeft = pExpr; + pNew->flags |= EP_Collate|EP_Skip; ++#if SQLITE_MAX_EXPR_DEPTH>0 ++ pNew->nHeight = pExpr->nHeight+1; ++ sqlite3ExprCheckHeight(pParse, pNew->nHeight); ++ testcase( pParse->nErr>0 ); ++#endif + pExpr = pNew; + } + } + return pExpr; + } + SQLITE_PRIVATE Expr *sqlite3ExprAddCollateString( +- const Parse *pParse, /* Parsing context */ ++ Parse *pParse, /* Parsing context */ + Expr *pExpr, /* Add the "COLLATE" clause to this expression */ + const char *zC /* The collating sequence name */ + ){ +-- +2.35.6 + diff --git a/meta/recipes-support/sqlite/sqlite3_3.51.3.bb b/meta/recipes-support/sqlite/sqlite3_3.51.3.bb index 7c8658a977..c16576354a 100644 --- a/meta/recipes-support/sqlite/sqlite3_3.51.3.bb +++ b/meta/recipes-support/sqlite/sqlite3_3.51.3.bb @@ -19,4 +19,5 @@ SRC_URI += "\ file://CVE-2026-119379.patch \ file://CVE-2026-119372.patch \ file://CVE-2026-119378.patch \ + file://CVE-2026-119376.patch \ "