From patchwork Thu Nov 5 14:18:26 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Jo=C3=A3o_Marcos_Costa_=28Schneider_Electric=29?= X-Patchwork-Id: 103148 Received: from smtpout-02.galae.net (smtpout-02.galae.net [185.246.84.56]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.35396.1793888330180153991 for ; Thu, 05 Nov 2026 06:18:50 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@bootlin.com header.s=dkim header.b=j1lEcjBf; spf=pass (domain: bootlin.com, ip: 185.246.84.56, mailfrom: joaomarcos.costa@bootlin.com) Received: from smtpout-01.galae.net (smtpout-01.galae.net [212.83.139.233]) by smtpout-02.galae.net (Postfix) with ESMTPS id 843F21A09F3 for ; Thu, 5 Nov 2026 14:18:48 +0000 (UTC) Received: from mail.galae.net (mail.galae.net [212.83.136.155]) by smtpout-01.galae.net (Postfix) with ESMTPS id 5356B5FF85; Thu, 5 Nov 2026 14:18:48 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) by localhost (Mailerdaemon) with ESMTPSA id 7689A103292A7; Thu, 5 Nov 2026 15:18:47 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bootlin.com; s=dkim; t=1793888327; h=from:subject:date:message-id:to:cc:mime-version:content-type: content-transfer-encoding:in-reply-to:references; bh=QoDkQYXwu+B6safCUHGwuUs/RJTksA/BcWQ0WdXxZBo=; b=j1lEcjBfXa2b/fWpC2ViYyk81hEQhwzjs3ptBHeFsiSuS0ovI2Rbt0jeoRkiwhWp7T31Xo MMqnrDJcMbhsIiGIeyRS7h7RHBuQkKOn8A0bjs+0r/089wnOnYjSN6nZq2uzyU7rVPgcV1 s32D64+zaG6V25NOL2GT/xqHiGQ1F3eIgjo2GcgUzWI1kgP78i0iJLRmJn7PEM4SATKcAY 8KtY2kPHJ6T+j+IkEHRJ+MRffvcnsxwDmuLwAyIPiXdJHKrucAPHszBcuc36rdcjehQCMn w23mPQpEBy0K6+4IaATdKCDHDTYxc9el+y9ohgYfsbwCSE22j9ZYL1iBBjlatg== From: =?utf-8?q?Jo=C3=A3o_Marcos_Costa_=28Schneider_Electric=29?= To: openembedded-core@lists.openembedded.org Cc: thomas.petazzoni@bootlin.com, yoann.congal@smile.fr, =?utf-8?q?Jo=C3=A3o?= =?utf-8?q?_Marcos_Costa_=28Schneider_Electric=29?= Subject: [scarthgap][PATCH 2/3] sqlite3: fix CVE-2026-119374 Date: Thu, 5 Nov 2026 15:18:26 +0100 Message-ID: <20261105141827.2142719-3-joaomarcos.costa@bootlin.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20261105141827.2142719-1-joaomarcos.costa@bootlin.com> References: <20261105141827.2142719-1-joaomarcos.costa@bootlin.com> MIME-Version: 1.0 X-Last-TLS-Session-Version: TLSv1.3 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 05 Nov 2026 14:18:58 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249555 This vulnerability, marked as High [1], was fixed upstream [2] since 3.54.0. Backport the fix to sqlite v3.45.3. Some function/macro definitions are required to compile the backported code, and they are provided in the *-pre.patch. [1] https://nvd.nist.gov/vuln/detail/cve-2026-119374 [2] https://github.com/sqlite/sqlite/commit/d9de6eedbe918c074c7556400fa21df5960704d9 Signed-off-by: João Marcos Costa (Schneider Electric) --- .../sqlite/sqlite3/CVE-2026-119374-pre.patch | 73 +++++++++++++++++++ .../sqlite/sqlite3/CVE-2026-119374.patch | 67 +++++++++++++++++ meta/recipes-support/sqlite/sqlite3_3.45.3.bb | 2 + 3 files changed, 142 insertions(+) create mode 100644 meta/recipes-support/sqlite/sqlite3/CVE-2026-119374-pre.patch create mode 100644 meta/recipes-support/sqlite/sqlite3/CVE-2026-119374.patch diff --git a/meta/recipes-support/sqlite/sqlite3/CVE-2026-119374-pre.patch b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119374-pre.patch new file mode 100644 index 0000000000..1192cef006 --- /dev/null +++ b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119374-pre.patch @@ -0,0 +1,73 @@ +From 315df7b9dc2ac2abc55c3636439fd532e3090ef6 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Jo=C3=A3o=20Marcos=20Costa?= +Date: Thu, 5 Nov 2026 11:48:59 +0100 +Subject: [PATCH] sqlite3.c: add fts5IndexCorrupt* and FTS5_CORRUPT_* helpers +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +These functions/macros come from multiple upstream commits, and are required by +the backport for CVE-2026-119374. + +Upstream-Status: Backport [multiple changes from v3.54.1] + +Signed-off-by: João Marcos Costa +--- + sqlite3.c | 44 ++++++++++++++++++++++++++++++++++++++++++++ + 1 file changed, 44 insertions(+) + +diff --git a/sqlite3.c b/sqlite3.c +index 2b1e6b9..4d0513e 100644 +--- a/sqlite3.c ++++ b/sqlite3.c +@@ -239371,6 +239371,50 @@ struct Fts5SegIter { + u8 bDel; /* True if the delete flag is set */ + }; + ++void sqlite3Fts5ConfigErrmsg(Fts5Config *pConfig, const char *zFmt, ...){ ++ va_list ap; /* ... printf arguments */ ++ char *zMsg = 0; ++ ++ va_start(ap, zFmt); ++ zMsg = sqlite3_vmprintf(zFmt, ap); ++ if( pConfig->pzErrmsg ){ ++ *pConfig->pzErrmsg = zMsg; ++ }else{ ++ sqlite3_free(zMsg); ++ } ++ ++ va_end(ap); ++} ++ ++static int fts5IndexCorruptRowid(Fts5Index *pIdx, i64 iRowid){ ++ pIdx->rc = FTS5_CORRUPT; ++ sqlite3Fts5ConfigErrmsg(pIdx->pConfig, ++ "fts5: corruption found reading blob %lld from table \"%s\"", ++ iRowid, pIdx->pConfig->zName ++ ); ++ return SQLITE_CORRUPT_VTAB; ++} ++#define FTS5_CORRUPT_ROWID(pIdx, iRowid) fts5IndexCorruptRowid(pIdx, iRowid) ++ ++static int fts5IndexCorruptIter(Fts5Index *pIdx, Fts5SegIter *pIter){ ++ pIdx->rc = FTS5_CORRUPT; ++ sqlite3Fts5ConfigErrmsg(pIdx->pConfig, ++ "fts5: corruption on page %d, segment %d, table \"%s\"", ++ pIter->iLeafPgno, pIter->pSeg->iSegid, pIdx->pConfig->zName ++ ); ++ return SQLITE_CORRUPT_VTAB; ++} ++#define FTS5_CORRUPT_ITER(pIdx, pIter) fts5IndexCorruptIter(pIdx, pIter) ++ ++static int fts5IndexCorruptIdx(Fts5Index *pIdx){ ++ pIdx->rc = FTS5_CORRUPT; ++ sqlite3Fts5ConfigErrmsg(pIdx->pConfig, ++ "fts5: corruption in table \"%s\"", pIdx->pConfig->zName ++ ); ++ return SQLITE_CORRUPT_VTAB; ++} ++#define FTS5_CORRUPT_IDX(pIdx) fts5IndexCorruptIdx(pIdx) ++ + /* + ** Array of tombstone pages. Reference counted. + */ diff --git a/meta/recipes-support/sqlite/sqlite3/CVE-2026-119374.patch b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119374.patch new file mode 100644 index 0000000000..1ea9f2d1ee --- /dev/null +++ b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119374.patch @@ -0,0 +1,67 @@ +From 68bb719b1c9aba46b0de9464c5c1ef5f76aab9d8 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Jo=C3=A3o=20Marcos=20Costa?= +Date: Wed, 4 Nov 2026 17:07:06 +0100 +Subject: [PATCH] Fix a problem in fts5 secure-delete code that could lead to a + buffer overrun when dealing with a strategically corrupted database. Problem + reported by YEONBA. +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +FossilOrigin-Name: 9cd4f9e9205c5a5096388397a39349db9ff5377d19095c6b20388ff799969c31 + +CVE: CVE-2026-119374 +Upstream-Status: Backport [https://github.com/sqlite/sqlite/commit/d9de6eedbe918c074c7556400fa21df5960704d9] + +Signed-off-by: João Marcos Costa +--- + sqlite3.c | 17 +++++++++++------ + 1 file changed, 11 insertions(+), 6 deletions(-) + +diff --git a/sqlite3.c b/sqlite3.c +index 4d0513e..3ba2e27 100644 +--- a/sqlite3.c ++++ b/sqlite3.c +@@ -244287,31 +244287,36 @@ static void fts5DoSecureDelete( + const int nMove = nPg - iNextOff; /* Number of bytes to move */ + int nShift = iNextOff - iOff; /* Distance to move them */ + ++ int nNewPg = 0; + int iPrevKeyOut = 0; +- int iKeyIn = 0; ++ i64 iKeyIn = 0; + + memmove(&aPg[iOff], &aPg[iNextOff], nMove); + iPgIdx -= nShift; +- nPg = iPgIdx; ++ nNewPg = iPgIdx; + fts5PutU16(&aPg[2], iPgIdx); + + for(iIdx=0; iIdxnPg ){ ++ FTS5_CORRUPT_IDX(p); ++ break; ++ } + if( iKeyIn!=iDelKeyOff ){ + int iKeyOut = (iKeyIn - (iKeyIn>iOff ? nShift : 0)); +- nPg += sqlite3Fts5PutVarint(&aPg[nPg], iKeyOut - iPrevKeyOut); ++ nNewPg += sqlite3Fts5PutVarint(&aPg[nNewPg], iKeyOut - iPrevKeyOut); + iPrevKeyOut = iKeyOut; + } + } + +- if( iPgIdx==nPg && nIdx>0 && pSeg->iLeafPgno!=1 ){ ++ if( p->rc==SQLITE_OK && iPgIdx==nNewPg && nIdx>0 && pSeg->iLeafPgno!=1 ){ + fts5SecureDeleteIdxEntry(p, iSegid, pSeg->iLeafPgno); + } + +- assert_nc( nPg>4 || fts5GetU16(aPg)==0 ); +- fts5DataWrite(p, FTS5_SEGMENT_ROWID(iSegid,pSeg->iLeafPgno), aPg, nPg); ++ assert_nc( nNewPg>4 || fts5GetU16(aPg)==0 ); ++ fts5DataWrite(p, FTS5_SEGMENT_ROWID(iSegid,pSeg->iLeafPgno), aPg, nNewPg); + } + sqlite3_free(aIdx); + } diff --git a/meta/recipes-support/sqlite/sqlite3_3.45.3.bb b/meta/recipes-support/sqlite/sqlite3_3.45.3.bb index e7c5bcdac4..5d70e765e5 100644 --- a/meta/recipes-support/sqlite/sqlite3_3.45.3.bb +++ b/meta/recipes-support/sqlite/sqlite3_3.45.3.bb @@ -11,6 +11,8 @@ SRC_URI = "http://www.sqlite.org/2024/sqlite-autoconf-${SQLITE_PV}.tar.gz \ file://CVE-2025-70873.patch \ file://CVE-2026-11822_CVE-2026-11824.patch \ file://CVE-2026-119373.patch \ + file://CVE-2026-119374-pre.patch \ + file://CVE-2026-119374.patch \ " SRC_URI[sha256sum] = "b2809ca53124c19c60f42bf627736eae011afdcc205bb48270a5ee9a38191531"