[scarthgap,2/3] sqlite3: fix CVE-2026-119374

diff --git a/meta/recipes-support/sqlite/sqlite3/CVE-2026-119374-pre.patch b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119374-pre.patch
new file mode 100644
index 0000000000..1192cef006
--- /dev/null
+++ b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119374-pre.patch
@@ -0,0 +1,73 @@ 
+From 315df7b9dc2ac2abc55c3636439fd532e3090ef6 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Jo=C3=A3o=20Marcos=20Costa?= <joaomarcos.costa@bootlin.com>
+Date: Thu, 5 Nov 2026 11:48:59 +0100
+Subject: [PATCH] sqlite3.c: add fts5IndexCorrupt* and FTS5_CORRUPT_* helpers
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+These functions/macros come from multiple upstream commits, and are required by
+the backport for CVE-2026-119374.
+
+Upstream-Status: Backport [multiple changes from v3.54.1]
+
+Signed-off-by: João Marcos Costa <joaomarcos.costa@bootlin.com>
+---
+ sqlite3.c | 44 ++++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 44 insertions(+)
+
+diff --git a/sqlite3.c b/sqlite3.c
+index 2b1e6b9..4d0513e 100644
+--- a/sqlite3.c
++++ b/sqlite3.c
+@@ -239371,6 +239371,50 @@ struct Fts5SegIter {
+   u8 bDel;                        /* True if the delete flag is set */
+ };
+ 
++void sqlite3Fts5ConfigErrmsg(Fts5Config *pConfig, const char *zFmt, ...){
++  va_list ap;                     /* ... printf arguments */
++  char *zMsg = 0;
++
++  va_start(ap, zFmt);
++  zMsg = sqlite3_vmprintf(zFmt, ap);
++  if( pConfig->pzErrmsg ){
++    *pConfig->pzErrmsg = zMsg;
++  }else{
++    sqlite3_free(zMsg);
++  }
++
++  va_end(ap);
++}
++
++static int fts5IndexCorruptRowid(Fts5Index *pIdx, i64 iRowid){
++  pIdx->rc = FTS5_CORRUPT;
++  sqlite3Fts5ConfigErrmsg(pIdx->pConfig, 
++      "fts5: corruption found reading blob %lld from table \"%s\"", 
++      iRowid, pIdx->pConfig->zName
++  );
++  return SQLITE_CORRUPT_VTAB;
++}
++#define FTS5_CORRUPT_ROWID(pIdx, iRowid) fts5IndexCorruptRowid(pIdx, iRowid)
++
++static int fts5IndexCorruptIter(Fts5Index *pIdx, Fts5SegIter *pIter){
++  pIdx->rc = FTS5_CORRUPT;
++  sqlite3Fts5ConfigErrmsg(pIdx->pConfig, 
++      "fts5: corruption on page %d, segment %d, table \"%s\"", 
++      pIter->iLeafPgno, pIter->pSeg->iSegid, pIdx->pConfig->zName
++  );
++  return SQLITE_CORRUPT_VTAB;
++}
++#define FTS5_CORRUPT_ITER(pIdx, pIter) fts5IndexCorruptIter(pIdx, pIter)
++
++static int fts5IndexCorruptIdx(Fts5Index *pIdx){
++  pIdx->rc = FTS5_CORRUPT;
++  sqlite3Fts5ConfigErrmsg(pIdx->pConfig, 
++      "fts5: corruption in table \"%s\"", pIdx->pConfig->zName
++  );
++  return SQLITE_CORRUPT_VTAB;
++}
++#define FTS5_CORRUPT_IDX(pIdx) fts5IndexCorruptIdx(pIdx)
++
+ /*
+ ** Array of tombstone pages. Reference counted.
+ */
diff --git a/meta/recipes-support/sqlite/sqlite3/CVE-2026-119374.patch b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119374.patch
new file mode 100644
index 0000000000..1ea9f2d1ee
--- /dev/null
+++ b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119374.patch
@@ -0,0 +1,67 @@ 
+From 68bb719b1c9aba46b0de9464c5c1ef5f76aab9d8 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Jo=C3=A3o=20Marcos=20Costa?= <joaomarcos.costa@bootlin.com>
+Date: Wed, 4 Nov 2026 17:07:06 +0100
+Subject: [PATCH] Fix a problem in fts5 secure-delete code that could lead to a
+ buffer overrun when dealing with a strategically corrupted database. Problem
+ reported by YEONBA.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+FossilOrigin-Name: 9cd4f9e9205c5a5096388397a39349db9ff5377d19095c6b20388ff799969c31
+
+CVE: CVE-2026-119374
+Upstream-Status: Backport [https://github.com/sqlite/sqlite/commit/d9de6eedbe918c074c7556400fa21df5960704d9]
+
+Signed-off-by: João Marcos Costa <joaomarcos.costa@bootlin.com>
+---
+ sqlite3.c | 17 +++++++++++------
+ 1 file changed, 11 insertions(+), 6 deletions(-)
+
+diff --git a/sqlite3.c b/sqlite3.c
+index 4d0513e..3ba2e27 100644
+--- a/sqlite3.c
++++ b/sqlite3.c
+@@ -244287,31 +244287,36 @@ static void fts5DoSecureDelete(
+     const int nMove = nPg - iNextOff;     /* Number of bytes to move */
+     int nShift = iNextOff - iOff;         /* Distance to move them */
+ 
++    int nNewPg = 0;
+     int iPrevKeyOut = 0;
+-    int iKeyIn = 0;
++    i64 iKeyIn = 0;
+ 
+     memmove(&aPg[iOff], &aPg[iNextOff], nMove);
+     iPgIdx -= nShift;
+-    nPg = iPgIdx;
++    nNewPg = iPgIdx;
+     fts5PutU16(&aPg[2], iPgIdx);
+ 
+     for(iIdx=0; iIdx<nIdx; /* no-op */){
+       u32 iVal = 0;
+       iIdx += fts5GetVarint32(&aIdx[iIdx], iVal);
+       iKeyIn += iVal;
++      if( iKeyIn>nPg ){
++        FTS5_CORRUPT_IDX(p);
++        break;
++      }
+       if( iKeyIn!=iDelKeyOff ){
+         int iKeyOut = (iKeyIn - (iKeyIn>iOff ? nShift : 0));
+-        nPg += sqlite3Fts5PutVarint(&aPg[nPg], iKeyOut - iPrevKeyOut);
++        nNewPg += sqlite3Fts5PutVarint(&aPg[nNewPg], iKeyOut - iPrevKeyOut);
+         iPrevKeyOut = iKeyOut;
+       }
+     }
+ 
+-    if( iPgIdx==nPg && nIdx>0 && pSeg->iLeafPgno!=1 ){
++    if( p->rc==SQLITE_OK && iPgIdx==nNewPg && nIdx>0 && pSeg->iLeafPgno!=1 ){
+       fts5SecureDeleteIdxEntry(p, iSegid, pSeg->iLeafPgno);
+     }
+ 
+-    assert_nc( nPg>4 || fts5GetU16(aPg)==0 );
+-    fts5DataWrite(p, FTS5_SEGMENT_ROWID(iSegid,pSeg->iLeafPgno), aPg, nPg);
++    assert_nc( nNewPg>4 || fts5GetU16(aPg)==0 );
++    fts5DataWrite(p, FTS5_SEGMENT_ROWID(iSegid,pSeg->iLeafPgno), aPg, nNewPg);
+   }
+   sqlite3_free(aIdx);
+ }
diff --git a/meta/recipes-support/sqlite/sqlite3_3.45.3.bb b/meta/recipes-support/sqlite/sqlite3_3.45.3.bb
index e7c5bcdac4..5d70e765e5 100644
--- a/meta/recipes-support/sqlite/sqlite3_3.45.3.bb
+++ b/meta/recipes-support/sqlite/sqlite3_3.45.3.bb
@@ -11,6 +11,8 @@  SRC_URI = "http://www.sqlite.org/2024/sqlite-autoconf-${SQLITE_PV}.tar.gz \
            file://CVE-2025-70873.patch \
            file://CVE-2026-11822_CVE-2026-11824.patch \
            file://CVE-2026-119373.patch \
+           file://CVE-2026-119374-pre.patch \
+           file://CVE-2026-119374.patch \
 "
 SRC_URI[sha256sum] = "b2809ca53124c19c60f42bf627736eae011afdcc205bb48270a5ee9a38191531"