new file mode 100644
@@ -0,0 +1,78 @@
+From 17e3b5a6f6c3a5e852a86597ad68f259d802296a Mon Sep 17 00:00:00 2001
+From: dan <Dan Kennedy>
+Date: Mon, 17 Aug 2026 11:31:59 +0000
+Subject: [PATCH] Avoid a buffer overrun when processing a strategically
+ corrupted changeset. Report [bugs:/info/2026-08-16T10:15:25Z |
+ 2026-08-16T10:15:25Z].
+
+FossilOrigin-Name: 3f57024aecea0f3b565ed823cf94b085031c481fd6323c1f2e4319a53500864f
+
+CVE: CVE-2026-119379
+Upstream-Status: Backport [https://github.com/sqlite/sqlite/commit/64459c87cc702d600704fb77ee40ca1782398a52]
+
+Backport Changes:
+- Applied the ext/session/sqlite3session.c fix to sqlite3.c because
+ the recipe source uses the amalgamated SQLite layout.
+- Omitted ext/session/sessioncorrupt.test because the extracted source
+ does not include the upstream test tree.
+- Omitted manifest and manifest.uuid because they are Fossil
+ metadata and are not required for this backport.
+
+Signed-off-by: Arpit Patel <arpitpa@cisco.com>
+---
+ sqlite3.c | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+diff --git a/sqlite3.c b/sqlite3.c
+index 52bd4aa19c..8cbe1d3ec7 100644
+--- a/sqlite3.c
++++ b/sqlite3.c
+@@ -228425,9 +228425,9 @@ static int sessionChangesetApply(
+ int schemaMismatch = 0;
+ int rc = SQLITE_OK; /* Return code */
+ const char *zTab = 0; /* Name of current table */
+- int nTab = 0; /* Result of sqlite3Strlen30(zTab) */
+ SessionApplyCtx sApply; /* changeset_apply() context object */
+ int bPatchset;
++ int bNew = 0; /* True for first entry of new table */
+
+ assert( xConflict!=0 );
+
+@@ -228443,15 +228443,16 @@ static int sessionChangesetApply(
+ if( rc==SQLITE_OK ){
+ rc = sqlite3_exec(db, "PRAGMA defer_foreign_keys = 1", 0, 0, 0);
+ }
+- while( rc==SQLITE_OK && SQLITE_ROW==sqlite3changeset_next(pIter) ){
++ while( rc==SQLITE_OK && SQLITE_ROW==sessionChangesetNext(pIter, 0, 0,&bNew) ){
+ int nCol;
+ int op;
+ const char *zNew;
+
+ sqlite3changeset_op(pIter, &zNew, &nCol, &op, 0);
+
+- if( zTab==0 || sqlite3_strnicmp(zNew, zTab, nTab+1) ){
++ if( bNew ){
+ u8 *abPK;
++ bNew = 0;
+
+ rc = sessionRetryConstraints(
+ db, pIter->bPatchset, zTab, &sApply, xConflict, pCtx
+@@ -228486,7 +228487,6 @@ static int sessionChangesetApply(
+ rc = SQLITE_NOMEM;
+ break;
+ }
+- nTab = (int)strlen(zTab);
+ sApply.azCol = (const char **)zTab;
+ }else{
+ int nMinCol = 0;
+@@ -228538,7 +228538,6 @@ static int sessionChangesetApply(
+ sApply.bStat1 = 0;
+ }
+ }
+- nTab = sqlite3Strlen30(zTab);
+ }
+ }
+
+--
+2.35.6
+
@@ -17,6 +17,7 @@ SRC_URI = "http://www.sqlite.org/2024/sqlite-autoconf-${SQLITE_PV}.tar.gz \
file://CVE-2026-119373.patch \
file://CVE-2026-119374.patch \
file://CVE-2026-119375.patch \
+ file://CVE-2026-119379.patch \
"
SRC_URI[sha256sum] = "b2809ca53124c19c60f42bf627736eae011afdcc205bb48270a5ee9a38191531"
This patch applies the upstream fix [1], which prevents a buffer overrun when applying a strategically corrupted changeset through SQLite's session extension. The GitHub mirror commit [1] corresponds to the SQLite Fossil check-in shown in [2]. [1] https://github.com/sqlite/sqlite/commit/64459c87cc702d600704fb77ee40ca1782398a52 [2] https://sqlite.org/src/info/3f57024aecea0f3b Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-119379 Signed-off-by: Arpit Patel <arpitpa@cisco.com> --- .../sqlite/sqlite3/CVE-2026-119379.patch | 78 +++++++++++++++++++ meta/recipes-support/sqlite/sqlite3_3.45.3.bb | 1 + 2 files changed, 79 insertions(+) create mode 100644 meta/recipes-support/sqlite/sqlite3/CVE-2026-119379.patch