From patchwork Thu Nov 5 05:22:19 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arpit Patel X-Patchwork-Id: 102955 Received: from rcdn-iport-6.cisco.com (rcdn-iport-6.cisco.com [173.37.86.77]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.27881.1793856142226079723 for ; Wed, 04 Nov 2026 21:22:22 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=GIjEIBK+; spf=pass (domain: cisco.com, ip: 173.37.86.77, mailfrom: arpitpa@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=12589; q=dns/txt; s=iport01; t=1793856142; x=1795065742; h=from:to:cc:subject:date:message-id:mime-version: content-transfer-encoding; bh=5YV5xuh2kniFNw8zGYjmXF0r92SQpdSyWVVd0RsnXOE=; b=GIjEIBK+bYoQRTb6S6YCIEzawgs6zrnEmutTAMJbsuczD4/y2l/PK8UT BxWblIevcX35A+eHo5bif9G31zQlm38tUWla7H63IGffFuWFZQLVNTgaA AMvjN86u7r9ERHTekGRoQlRM7vDHb144B+ba31P1M847i4EoQTg4t1W6o cF5ZGmsvhaxiIHCcHmapQBcFSR43fKK81XoRgUx6HZdIj8S4Ll9B51xX9 c9rU2yi6259vQGaI1Sl71okEQ10kvdINmtr6g2ZhUQQlBECVhMZvLeJ3i WfjmcRiuWxZlMkFN0lfBYWE88bt8IR/TBTzKs51CQ5p0CGroHmtaVWPH6 w==; X-CSE-ConnectionGUID: RggySKr8Si6XKAj5LEtVZw== X-CSE-MsgGUID: YTH/ADC2Q4aXbtZkOysW/g== X-IPAS-Result: A0AaAACFEexq/43/Ja1aHAEBAQEBAQcBARIBAQQEAQGBfAcBAQsBglZ1YENJjHKJWZ4kgX4PAQEBD0QNBAEBhD9GAo4dAiY0CQ4BAgQDAgMBAQEBAQEBAQEBAQEKAQEFAQEBAgEHBYEOE4ZPDZASAQIBKgsBGAEtLAMBAlojIYMCAYJ0AxG8OoF5M4EBgmZDAT8CQ1DZS4FoAQsUAQWBMwGFPzKHcV0YAYR9JxuBSUSEfoEFgVwBAYgmBIMugVqGQIZYAoFShnBIgR4DWSwBVRMNCgsHBYFoAzUSKhVuMh2BIz4XgQcbBgWBHYEegRKBB12BKyhdASGBCIF2AoJRggACAUlBDgdFUwklQxJHJCIIEgkBExosCoEaNTwJJj8VDGQLGgVhCAINDHI5EDAeJC8FHCZAGwoYGA1IESw3FRkEPm4Hki+DCgYBAVgiEwEHJHsdcDU6owqCIaERhCqBaIo8lToaM4VbpRYLmH2OCpZRhGmBaDyBRwsHMxoIGxWDIglKGQ+OLgsLg2CBf4MUyUQmMgIJMgEBBwIHDgMLgWiRfgEB IronPort-Data: A9a23:66/d/KmU3HD6W79jlnvmRojo5gzXJ0RdPkR7XQ2eYbSJt1+Wr1Gzt xIWX2qEbqmKNDekKtB1aYizoUoAuJWAndY3GVQ9/3szHltH+JHPbTi7wugcHM8zwunrFh8PA xA2M4GYRCwMZiaC4Errav6+/SEUOZigHtLUEPTDNj16WThqQSIgjQMLs+Mii+aEu/Dha++2k Y20+ZK31GONgWYubDtNs/7b8nuDgdyr0N8mlg1mDRx0lAe2e0k9VPo3Oay3Jn3kdYhYdsbSb /rD1ryw4lTC9B4rDN6/+p6jGqHdauePVeQmoiM+t5mK2nCulARrukoIHKZ0hXNsttm8t4sZJ OOhGnCHYVxB0qXkwIzxWvTDes10FfUuFLTveRBTvSEPpqHLWyOE/hlgMK05FbcX9fdMInsez v1GGBMkbE2nqv6I8q3uH4GAhux7RCXqFJkUtnclyXTSCuwrBMifBa7L/tRfmjw3g6iiH96HO JFfMmUpNkmdJUQTYz/7C7pm9AusrnDlazxEsFu9rqss6G+Vxwt0uFToGIeJJoDWGZoIxy50o Er3w0S+Kz0xbuXDwAqP7kCvof7UomT0Ddd6+LqQs6QCbEeo7msLBRsbUFG2rfW0hgu1XMhSA 0gV4TY1668q+UqmS9PwUxG1rDiDpBF0ZjZLO/cx5AfIzu/f5ByUQzBYCDVAc9ch8sQxQFTGy 2O0oj8gPhQ32JX9dJ5X3u78Qe+aUcTNEVI/WA== IronPort-HdrOrdr: A9a23:CX3We6DzBV+ymR7lHemA55DYdb4zR+YMi2TDGXofdfUzSL38qy nAppUmPHPP5Qr5O0tQ++xoRpPhfZq0z/cciuMs1NyZMjUO1lHFEGhK1/qH/9SZIVycysdtkY F9bqN5FNr8SXJ+jcr8/U2ENuxI+qjhzEht7t2utkuEimpRGsdd0zs= X-Talos-CUID: 9a23:7pUOKmu68oVnlxhH5idcpPkO6IsffXLM91TKc3S5V1ZKYb/IbXKMxpF7xp8= X-Talos-MUID: 9a23:h4ZSTgZ1LG1yh+BThgPMwxhOH51Rv62eAlw/krIXoPbDOnkl X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,196,1787011200"; d="scan'208";a="544444751" Received: from rcdn-l-core-04.cisco.com ([173.37.255.141]) by rcdn-iport-6.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 05 Nov 2026 05:22:21 +0000 Received: from sjc-ads-10129.cisco.com (sjc-ads-10129.cisco.com [10.30.210.133]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "ciscoit-managed-infra-smtp-auth.cisco.com", Issuer "Internal Private TLS SubCA" (verified OK)) by rcdn-l-core-04.cisco.com (Postfix) with ESMTPS id 0C6D718000182; Thu, 5 Nov 2026 05:22:21 +0000 (GMT) Received: by sjc-ads-10129.cisco.com (Postfix, from userid 1877011) id A6C8BCC2EF1; Wed, 4 Nov 2026 21:22:20 -0800 (PST) From: Arpit Patel To: openembedded-core@lists.openembedded.org Cc: xe-linux-external@cisco.com Subject: [OE-core][wrynose][PATCH 01/10] sqlite3: Fix CVE-2026-119377 Date: Wed, 4 Nov 2026 21:22:19 -0800 Message-Id: <20261105052219.2439458-1-arpitpa@cisco.com> X-Mailer: git-send-email 2.35.6 MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-Client-TLS: VERIFIED;sjc-ads-10129.cisco.com [10.30.210.133];TLSv1.3;TLS_AES_256_GCM_SHA384;256;ciscoit-managed-infra-smtp-auth.cisco.com X-Outbound-SMTP-Client: 10.30.210.133, sjc-ads-10129.cisco.com X-Outbound-Node: rcdn-l-core-04.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 05 Nov 2026 05:22:25 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249419 This patch applies the upstream fix series [1], [3], [5], and [7] for the authorizer bypass. Commits [1] and [3] are dependent commits. Commit [5] adds authorizer checks for RIGHT JOIN USING terms, and commit [7] corrects the loop so every term is checked. The GitHub mirror commits correspond to the SQLite Fossil check-ins shown in [2], [4], [6], and [8], respectively. [1] https://github.com/sqlite/sqlite/commit/c70fbd39f9c130bbe1cc45269c3b490dfdf7f259 [2] https://sqlite.org/src/info/625f78a630bb [3] https://github.com/sqlite/sqlite/commit/ddea119f825bf07f145c55f623022286bc644664 [4] https://sqlite.org/src/info/4ef88a36f9d9 [5] https://github.com/sqlite/sqlite/commit/7ff247c5b9ead3ad8a69c26d3fd264878e127237 [6] https://sqlite.org/src/info/bbd69ce27462 [7] https://github.com/sqlite/sqlite/commit/5694c3bb2a6a40770ecd2f65910eea756734dfd8 [8] https://sqlite.org/src/info/2cb228776836 Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-119377 Signed-off-by: Arpit Patel --- .../CVE-2026-119377-dependent_p1.patch | 86 +++++++++++++++++++ .../CVE-2026-119377-dependent_p2.patch | 59 +++++++++++++ .../sqlite/sqlite3/CVE-2026-119377_p1.patch | 52 +++++++++++ .../sqlite/sqlite3/CVE-2026-119377_p2.patch | 51 +++++++++++ meta/recipes-support/sqlite/sqlite3_3.51.3.bb | 4 + 5 files changed, 252 insertions(+) create mode 100644 meta/recipes-support/sqlite/sqlite3/CVE-2026-119377-dependent_p1.patch create mode 100644 meta/recipes-support/sqlite/sqlite3/CVE-2026-119377-dependent_p2.patch create mode 100644 meta/recipes-support/sqlite/sqlite3/CVE-2026-119377_p1.patch create mode 100644 meta/recipes-support/sqlite/sqlite3/CVE-2026-119377_p2.patch diff --git a/meta/recipes-support/sqlite/sqlite3/CVE-2026-119377-dependent_p1.patch b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119377-dependent_p1.patch new file mode 100644 index 0000000000..7fdcc9b99d --- /dev/null +++ b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119377-dependent_p1.patch @@ -0,0 +1,86 @@ +From fcb432b9952e9ced22fbfaa1ea0bbc7f54c78214 Mon Sep 17 00:00:00 2001 +From: drh <> +Date: Sat, 2 May 2026 17:30:33 +0000 +Subject: [PATCH] Minor optimization to the authorizer. + +FossilOrigin-Name: 625f78a630bbf897f945065f1b85a92fe26e426302c8f6edc4d26a817ff62358 + +CVE: CVE-2026-119377 +Upstream-Status: Backport [https://github.com/sqlite/sqlite/commit/c70fbd39f9c130bbe1cc45269c3b490dfdf7f259] + +Backport Changes: +- Applied the src/auth.c and src/resolve.c changes to sqlite3.c because + the Yocto sqlite-autoconf source uses the amalgamated SQLite layout. +- Kept SQLITE_PRIVATE on sqlite3AuthCheck() to match the amalgamated + source. +- Omitted manifest and manifest.uuid because they are repository + metadata and are not needed for this sqlite3.c backport. + +Signed-off-by: Arpit Patel +--- + sqlite3.c | 27 ++++++++++++++++++++++----- + 1 file changed, 22 insertions(+), 5 deletions(-) + +diff --git a/sqlite3.c b/sqlite3.c +index 2f4b77429f..46dd437d82 100644 +--- a/sqlite3.c ++++ b/sqlite3.c +@@ -109962,9 +109962,7 @@ lookupname_end: + if( cnt==1 ){ + assert( pNC!=0 ); + #ifndef SQLITE_OMIT_AUTHORIZATION +- if( pParse->db->xAuth +- && (pExpr->op==TK_COLUMN || pExpr->op==TK_TRIGGER) +- ){ ++ if( db->xAuth && (pExpr->op==TK_COLUMN || pExpr->op==TK_TRIGGER) ){ + sqlite3AuthRead(pParse, pExpr, pSchema, pNC->pSrcList); + } + #endif +@@ -124299,8 +124297,14 @@ SQLITE_PRIVATE void sqlite3AuthRead( + ** either SQLITE_OK (zero) or SQLITE_IGNORE or SQLITE_DENY. If SQLITE_DENY + ** is returned, then the error count and error message in pParse are + ** modified appropriately. ++** ++** Divided into two routines. realAuthCheck() does the work. The ++** sqlite3AuthCheck() routine is usually a fast no-op but invokes ++** realAuthCheck() (and spends time doing some stack pushes and pops ++** as a result) in the uncommon case where an authorization check is ++** actually needed. + */ +-SQLITE_PRIVATE int sqlite3AuthCheck( ++static int SQLITE_NOINLINE realAuthCheck( + Parse *pParse, + int code, + const char *zArg1, +@@ -124314,7 +124318,7 @@ SQLITE_PRIVATE int sqlite3AuthCheck( + ** or if the parser is being invoked from within sqlite3_declare_vtab. + */ + assert( !IN_RENAME_OBJECT || db->xAuth==0 ); +- if( db->xAuth==0 || db->init.busy || IN_SPECIAL_PARSE ){ ++ if( IN_SPECIAL_PARSE ){ + return SQLITE_OK; + } + +@@ -124339,6 +124343,19 @@ SQLITE_PRIVATE int sqlite3AuthCheck( + } + return rc; + } ++SQLITE_PRIVATE int sqlite3AuthCheck( ++ Parse *pParse, ++ int code, ++ const char *zArg1, ++ const char *zArg2, ++ const char *zArg3 ++){ ++ if( pParse->db->xAuth!=0 && pParse->db->init.busy==0 ){ ++ return realAuthCheck(pParse,code,zArg1,zArg2,zArg3); ++ }else{ ++ return SQLITE_OK; ++ } ++} + + /* + ** Push an authorization context. After this routine is called, the +-- +2.35.6 + diff --git a/meta/recipes-support/sqlite/sqlite3/CVE-2026-119377-dependent_p2.patch b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119377-dependent_p2.patch new file mode 100644 index 0000000000..e2f8320963 --- /dev/null +++ b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119377-dependent_p2.patch @@ -0,0 +1,59 @@ +From e6920a57640e0c3d55c74a3dd850516f6a65d838 Mon Sep 17 00:00:00 2001 +From: drh <> +Date: Mon, 1 Jun 2026 16:49:39 +0000 +Subject: [PATCH] Make sure the authenticator is called for columns that are + part of a USING in a FULL JOIN. [bugs:/info/2026-05-31T02:00:37Z|Bug + 2026-05-31T02:00:37Z]. + +FossilOrigin-Name: 4ef88a36f9d9669b0d74c58f79ad497803885ff6078e5f9685f13c96eab397cc + +CVE: CVE-2026-119377 +Upstream-Status: Backport [https://github.com/sqlite/sqlite/commit/ddea119f825bf07f145c55f623022286bc644664] + +Backport Changes: +- Applied the src/resolve.c change to sqlite3.c because this recipe + uses the amalgamated SQLite source. +- Omitted manifest and manifest.uuid updates because they are Fossil + repository metadata and are not needed in this backport. + +Signed-off-by: Arpit Patel +--- + sqlite3.c | 15 ++++++++++++--- + 1 file changed, 12 insertions(+), 3 deletions(-) + +diff --git a/sqlite3.c b/sqlite3.c +index 46dd437d82..8370952d5a 100644 +--- a/sqlite3.c ++++ b/sqlite3.c +@@ -109880,7 +109880,7 @@ static int lookupName( + ** cnt>1 means there were two or more matches. + ** + ** cnt==0 is always an error. cnt>1 is often an error, but might +- ** be multiple matches for a NATURAL LEFT JOIN or a LEFT JOIN USING. ++ ** be multiple matches for a NATURAL OUTER JOIN or a OUTER JOIN USING. + */ + assert( pFJMatch==0 || cnt>0 ); + assert( !ExprHasProperty(pExpr, EP_xIsSelect|EP_IntValue) ); +@@ -109962,8 +109962,17 @@ lookupname_end: + if( cnt==1 ){ + assert( pNC!=0 ); + #ifndef SQLITE_OMIT_AUTHORIZATION +- if( db->xAuth && (pExpr->op==TK_COLUMN || pExpr->op==TK_TRIGGER) ){ +- sqlite3AuthRead(pParse, pExpr, pSchema, pNC->pSrcList); ++ if( db->xAuth ){ ++ if( pFJMatch ){ ++ assert( pExpr->op==TK_FUNCTION ); ++ assert( sqlite3_stricmp(pExpr->u.zToken,"coalesce")==0 ); ++ assert( pExpr->x.pList==pFJMatch ); ++ assert( pFJMatch->nExpr>0 ); ++ pExpr = pFJMatch->a[0].pExpr; ++ } ++ if( pExpr->op==TK_COLUMN || pExpr->op==TK_TRIGGER ){ ++ sqlite3AuthRead(pParse, pExpr, pSchema, pNC->pSrcList); ++ } + } + #endif + /* Increment the nRef value on all name contexts from TopNC up to +-- +2.35.6 + diff --git a/meta/recipes-support/sqlite/sqlite3/CVE-2026-119377_p1.patch b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119377_p1.patch new file mode 100644 index 0000000000..1cecb49416 --- /dev/null +++ b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119377_p1.patch @@ -0,0 +1,52 @@ +From aa67fa2ce1fa30fc1e13b169419569b487a4df22 Mon Sep 17 00:00:00 2001 +From: drh <> +Date: Sun, 5 Jul 2026 16:06:33 +0000 +Subject: [PATCH] Be sure to invoke the authorizer callback on all terms of the + USING clause in a RIGHT JOIN. [bugs:/info/2026-07-05T08:15:45Z|Bug + 2026-07-05T08:15:45Z] + +FossilOrigin-Name: bbd69ce27462000873af053bfebdd305c53deac85c426b1e7dbd927b5f17d622 + +CVE: CVE-2026-119377 +Upstream-Status: Backport [https://github.com/sqlite/sqlite/commit/7ff247c5b9ead3ad8a69c26d3fd264878e127237] + +Backport Changes: +- Applied the src/resolve.c change in sqlite3.c because the Yocto + sqlite-autoconf source uses the amalgamated layout. +- Omitted test/auth.test because the extracted recipe source lacks the + upstream Tcl test tree. +- Omitted manifest and manifest.uuid because they are repository + metadata and are not needed in this source patch. + +Signed-off-by: Arpit Patel +--- + sqlite3.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/sqlite3.c b/sqlite3.c +index 8370952d5a..fc32ca3c8f 100644 +--- a/sqlite3.c ++++ b/sqlite3.c +@@ -109964,13 +109964,16 @@ lookupname_end: + #ifndef SQLITE_OMIT_AUTHORIZATION + if( db->xAuth ){ + if( pFJMatch ){ ++ int ii; + assert( pExpr->op==TK_FUNCTION ); + assert( sqlite3_stricmp(pExpr->u.zToken,"coalesce")==0 ); + assert( pExpr->x.pList==pFJMatch ); + assert( pFJMatch->nExpr>0 ); +- pExpr = pFJMatch->a[0].pExpr; +- } +- if( pExpr->op==TK_COLUMN || pExpr->op==TK_TRIGGER ){ ++ for(ii=0; iinExpr; ii++){ ++ assert( pFJMatch->a[0].pExpr->op==TK_COLUMN ); ++ sqlite3AuthRead(pParse, pFJMatch->a[0].pExpr, pSchema, pNC->pSrcList); ++ } ++ }else if( pExpr->op==TK_COLUMN || pExpr->op==TK_TRIGGER ){ + sqlite3AuthRead(pParse, pExpr, pSchema, pNC->pSrcList); + } + } +-- +2.35.6 + diff --git a/meta/recipes-support/sqlite/sqlite3/CVE-2026-119377_p2.patch b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119377_p2.patch new file mode 100644 index 0000000000..743e6ba8b1 --- /dev/null +++ b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119377_p2.patch @@ -0,0 +1,51 @@ +From 23726411060f3440cdc3acae57d27e79d34bb116 Mon Sep 17 00:00:00 2001 +From: drh <> +Date: Fri, 24 Jul 2026 14:53:59 +0000 +Subject: [PATCH] Fix a bug in the check-in [bbd69ce274620008] causing that + bug-fix check-in to fail to completely fix the original bug. This fix is in + response to the follow-up report at [bugs:/info/2026-07-24T02:52:08Z|Bug + 2026-07-24T02:52:08Z]. + +FossilOrigin-Name: 2cb22877683680c1f89bcc9edb47bd1a4a8755d4a6b846a1a20136a657dacdcc + +CVE: CVE-2026-119377 +Upstream-Status: Backport [https://github.com/sqlite/sqlite/commit/5694c3bb2a6a40770ecd2f65910eea756734dfd8] + +Backport Changes: +- Applied the src/resolve.c correction to sqlite3.c because the Yocto + recipe source uses the amalgamated SQLite layout. +- Omitted test/auth.test because the extracted recipe source lacks the + upstream Tcl test tree. +- Omitted manifest and manifest.uuid because they are Fossil + repository metadata and are not needed in the source patch. + +Signed-off-by: Arpit Patel +--- + sqlite3.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/sqlite3.c b/sqlite3.c +index fc32ca3c8f..bb908566d4 100644 +--- a/sqlite3.c ++++ b/sqlite3.c +@@ -109964,14 +109964,13 @@ lookupname_end: + #ifndef SQLITE_OMIT_AUTHORIZATION + if( db->xAuth ){ + if( pFJMatch ){ +- int ii; + assert( pExpr->op==TK_FUNCTION ); + assert( sqlite3_stricmp(pExpr->u.zToken,"coalesce")==0 ); + assert( pExpr->x.pList==pFJMatch ); + assert( pFJMatch->nExpr>0 ); +- for(ii=0; iinExpr; ii++){ +- assert( pFJMatch->a[0].pExpr->op==TK_COLUMN ); +- sqlite3AuthRead(pParse, pFJMatch->a[0].pExpr, pSchema, pNC->pSrcList); ++ for(i=0; inExpr; i++){ ++ assert( pFJMatch->a[i].pExpr->op==TK_COLUMN ); ++ sqlite3AuthRead(pParse,pFJMatch->a[i].pExpr,pSchema,pNC->pSrcList); + } + }else if( pExpr->op==TK_COLUMN || pExpr->op==TK_TRIGGER ){ + sqlite3AuthRead(pParse, pExpr, pSchema, pNC->pSrcList); +-- +2.35.6 + diff --git a/meta/recipes-support/sqlite/sqlite3_3.51.3.bb b/meta/recipes-support/sqlite/sqlite3_3.51.3.bb index 2b0a9c0e4d..2f82176913 100644 --- a/meta/recipes-support/sqlite/sqlite3_3.51.3.bb +++ b/meta/recipes-support/sqlite/sqlite3_3.51.3.bb @@ -9,4 +9,8 @@ SRC_URI[sha256sum] = "81f5be397049b0cae1b167f2225af7646fc0f82e4a9b3c48c9ea3a533e SRC_URI += "\ file://0001-Add-option-to-disable-zlib.patch \ file://CVE-2026-11822_CVE-2026-11824.patch \ + file://CVE-2026-119377-dependent_p1.patch \ + file://CVE-2026-119377-dependent_p2.patch \ + file://CVE-2026-119377_p1.patch \ + file://CVE-2026-119377_p2.patch \ " From patchwork Thu Nov 5 05:25:59 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arpit Patel X-Patchwork-Id: 102956 Received: from rcdn-iport-3.cisco.com (rcdn-iport-3.cisco.com [173.37.86.74]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.27908.1793856364275554252 for ; Wed, 04 Nov 2026 21:26:04 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=kDhfreei; spf=pass (domain: cisco.com, ip: 173.37.86.74, mailfrom: arpitpa@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=3630; q=dns/txt; s=iport01; t=1793856364; x=1795065964; h=from:to:cc:subject:date:message-id:mime-version: content-transfer-encoding; bh=wgO4NTcXtU8EHFDsLNRgqdNoMsE9J56rHIYL0xUVta8=; b=kDhfreeifjI2EtgW/6jwVZUa4+fIN6qYGkjfTcBwsRiveG3VAlMqV9Vn j8TwVLxL9JQG7D9y4PlSjfyrpMmTqHcGuZHeKtpSk0idnUZZPGo0qTgUK ovJMMNQN3TNQIMKqA0e+0XIivghytdrrrd65U5/j9CYCeCZFjNHj5Pogl 6JQxZc6Rr04qSCaw1RL+4H3zLLK70yrQujWUGfFyjw6JqWFBwI1i/aXYT UYG/F2iBGpdvyJPgREANR2taR+djIk84sCZvolO0YaJA2Oh7jKP3KHSO0 Oe6WeEsYjKP2ArJfLhwrfW4uBvbVmg+K3Xq+rlbfJg1pEFQIpNbCdd2SI w==; X-CSE-ConnectionGUID: uQGreJAPRAKs7hpu4qDvTQ== X-CSE-MsgGUID: vV94NlwvTrGhnXQA0Z542Q== X-IPAS-Result: A0BGAgAGE+xq/5D/Ja1aHgEBCxIMggULgld1YENJlkueJBSBag8BAQEPRA0EAQGEP0aOHwImNAkOAQIEAwIDAQEBAQEBAQEBAQEBCgEBBQEBAQIBBwWBDhOGTw2QEgECASoLARgBLSwDAQIWRCMhgwIBgnQDEbw/gXkzgQGDKQE/AkNQ2UuBaAELFAEFgTOFQDKHcV0YAYR9JxuBSUSEfoEFgVwBAYEZgQaGBwSDLoFagQOMFQKBUoZwSIEeA1ksAVUTDQoLBwWBaAM1EioVbjIdgSM+F4EHGwYFgR2BHoESgQddgSsoXQEhgQiBdgKCUYIAAgFJQQ4HRVMJJUMSRyQiCBIJARMaLAqBGjU8CSY/FQxkCxoFYQgCDQxyORAwHiQvBRwmQBsKGBgNSBEsNxUZBD5uB5IvgxEBgQ0BK4I9o0SCIaERhCqBaIo8lToaM4VbpRYLmH2OCpZRhGmBaDyBRwsHMxoIGxWDIglKGQ+OLgsLg2CBf4MUyUgmMgIJMgEBBwIHDgMLgWiRfgEB IronPort-Data: A9a23:LwJ/SKLZBqrD3tvdFE+Rh5QlxSXFcZb7ZxGr2PjKsXjdYENShjYEz mpNWm2EafbfNGqhc4t2PI2y9U4P6pbWztE3HAYd+CA2RRqmiyZq6fd1j6vUF3nPRiEWZBs/t 63yUvGZcoZpCCea+Uf1WlTYhSEU/bmSQbbhA/LzNCl0RAt1IA8skhsLd9QR2uaEuvDnRVnS0 T/Oi5eHYgH8gmYoajh8B5+r8XuDgtyj4Fv0gXRmDRx7lAe2v2UYCpsZOZawIxPQKqFIHvS3T vr017qw+GXU5X8FUrtJRZ6iLyXm6paLVeS/oiI+t5qK23CulQRuukoPD8fwXG8M49m/c3+d/ /0W3XC4YV9B0qQhA43xWTEAe811FfUuFLMqvRFTvOTLp3AqfUcAzN1zNW4sMK8xwtxeInoR9 eQFdCkhcCy60rfeLLKTEoGAh+w5J8XteYdasXZ6wHSBUrAtQIvIROPB4towMDUY358VW62BI ZBENHw2MEiojx5nYj/7DLo3hv+pmmH2WzZZs1mS46Ew5gA/ySQsjOS8YIqKIoTiqcN9gHjJ+ kTC4HrFGD4aMuym4GK3ry72v7qa9c/8cMdIfFGizdZtmFCVy2kZBREaWFf+qv6jh2a6WslDM AoT4icooK04+UCnQ9W7WAe3yENopTYGUNZWVul/4waXx++MvECSB3MPSXhKb9lOWNIKeAHGH 2Shx7vBbQGDepXMIZ5B3t94dQ+PBBU= IronPort-HdrOrdr: A9a23:2pKQsa3/efEIZi8PIL/CHwqjBJ4kLtp133Aq2lEZdPWaSKOlfq eV7ZEmPHDP6Qr5NEtMpTniAtjjfZqjz/5ICOAqVN/INjUO01HHEGgN1+ffKhTbaknDH5ZmpM RdWpk7LsHsBl5nisu/ygy5H9E8hOSjysmT9IDjJ7MHd3ASV0mmhD0JbDqmLg== X-Talos-CUID: 9a23:CrJfjGnvCRrWvW4xS2BuZ+7zobzXOWDk423dAWaAM09KU+KVUULM4Y96r/M7zg== X-Talos-MUID: 9a23:3TWD6gRNKWZdjz9RRXTyumA+EsN3/Zi0J0ALoawv4/vZaXZJbmI= X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,196,1787011200"; d="scan'208";a="544988700" Received: from rcdn-l-core-07.cisco.com ([173.37.255.144]) by rcdn-iport-3.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 05 Nov 2026 05:26:01 +0000 Received: from sjc-ads-10129.cisco.com (sjc-ads-10129.cisco.com [10.30.210.133]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "ciscoit-managed-infra-smtp-auth.cisco.com", Issuer "Internal Private TLS SubCA" (verified OK)) by rcdn-l-core-07.cisco.com (Postfix) with ESMTPS id 91AC4180004B8; Thu, 5 Nov 2026 05:26:01 +0000 (GMT) Received: by sjc-ads-10129.cisco.com (Postfix, from userid 1877011) id 37F19CC2EF1; Wed, 4 Nov 2026 21:26:01 -0800 (PST) From: Arpit Patel To: openembedded-core@lists.openembedded.org Cc: xe-linux-external@cisco.com Subject: [OE-core][wrynose][PATCH 02/10] sqlite3: fix CVE-2026-119373 Date: Wed, 4 Nov 2026 21:25:59 -0800 Message-Id: <20261105052559.2442748-1-arpitpa@cisco.com> X-Mailer: git-send-email 2.35.6 MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-Client-TLS: VERIFIED;sjc-ads-10129.cisco.com [10.30.210.133];TLSv1.3;TLS_AES_256_GCM_SHA384;256;ciscoit-managed-infra-smtp-auth.cisco.com X-Outbound-SMTP-Client: 10.30.210.133, sjc-ads-10129.cisco.com X-Outbound-Node: rcdn-l-core-07.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 05 Nov 2026 05:26:04 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249420 This patch applies the upstream fix [1], which prevents a buffer overflow when merging FTS5 detail=none prefix lists with negative docids. The GitHub mirror commit [1] corresponds to the SQLite Fossil check-in shown in [2]. [1] https://github.com/sqlite/sqlite/commit/e1c9934f9f11a499029abb020ea715a08970da80 [2] https://sqlite.org/src/info/a7f8c92f62 Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-119373 Signed-off-by: Arpit Patel --- .../sqlite/sqlite3/CVE-2026-119373.patch | 56 +++++++++++++++++++ meta/recipes-support/sqlite/sqlite3_3.51.3.bb | 1 + 2 files changed, 57 insertions(+) create mode 100644 meta/recipes-support/sqlite/sqlite3/CVE-2026-119373.patch diff --git a/meta/recipes-support/sqlite/sqlite3/CVE-2026-119373.patch b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119373.patch new file mode 100644 index 0000000000..6bf27f3a1f --- /dev/null +++ b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119373.patch @@ -0,0 +1,56 @@ +From ddb597d563f2b17e9f42911f78ef0573cae047ed Mon Sep 17 00:00:00 2001 +From: dan +Date: Tue, 4 Aug 2026 11:04:17 +0000 +Subject: [PATCH] In fts5, account for the possibility of negative docids when + allocating a buffer to store the results of merging detail=none prefix lists. + Fix for report [bugs:/info/2026-08-04T08:49:27Z | 2026-08-04T08:49:27Z]. + +FossilOrigin-Name: a7f8c92f623e9cbe8a61266d949916acc9e5110c94dff4aa6fd1ad2ea8a60d4e + +CVE: CVE-2026-119373 +Upstream-Status: Backport [https://github.com/sqlite/sqlite/commit/e1c9934f9f11a499029abb020ea715a08970da80] + +Backport Changes: +- Applied the FTS5 fix from ext/fts5/fts5_index.c to sqlite3.c because + the recipe source uses the amalgamated SQLite layout. +- Omitted ext/fts5/test/fts5prefix2.test because the extracted source + does not include SQLite's Tcl test tree. +- Omitted manifest and manifest.uuid because they are Fossil + repository metadata and are not needed for this source patch. + +Signed-off-by: Arpit Patel +--- + sqlite3.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/sqlite3.c b/sqlite3.c +index bb908566d4..bfd285777d 100644 +--- a/sqlite3.c ++++ b/sqlite3.c +@@ -253340,7 +253340,7 @@ static void fts5MergeRowidLists( + (void)nBuf; + memset(&out, 0, sizeof(out)); + assert( nBuf==1 ); +- sqlite3Fts5BufferSize(&p->rc, &out, p1->n + p2->n); ++ sqlite3Fts5BufferSize(&p->rc, &out, p1->n + p2->n + 9); + if( p->rc ) return; + + fts5NextRowid(p1, &i1, &iRowid1); +@@ -253348,12 +253348,12 @@ static void fts5MergeRowidLists( + while( i1>=0 || i2>=0 ){ + if( i1>=0 && (i2<0 || iRowid1iOut ); +- fts5BufferSafeAppendVarint(&out, iRowid1 - iOut); ++ fts5BufferSafeAppendVarint(&out, (u64)iRowid1 - (u64)iOut); + iOut = iRowid1; + fts5NextRowid(p1, &i1, &iRowid1); + }else{ + assert( iOut==0 || iRowid2>iOut ); +- fts5BufferSafeAppendVarint(&out, iRowid2 - iOut); ++ fts5BufferSafeAppendVarint(&out, (u64)iRowid2 - (u64)iOut); + iOut = iRowid2; + if( i1>=0 && iRowid1==iRowid2 ){ + fts5NextRowid(p1, &i1, &iRowid1); +-- +2.35.6 + diff --git a/meta/recipes-support/sqlite/sqlite3_3.51.3.bb b/meta/recipes-support/sqlite/sqlite3_3.51.3.bb index 2f82176913..52e7659a8e 100644 --- a/meta/recipes-support/sqlite/sqlite3_3.51.3.bb +++ b/meta/recipes-support/sqlite/sqlite3_3.51.3.bb @@ -13,4 +13,5 @@ SRC_URI += "\ file://CVE-2026-119377-dependent_p2.patch \ file://CVE-2026-119377_p1.patch \ file://CVE-2026-119377_p2.patch \ + file://CVE-2026-119373.patch \ " From patchwork Thu Nov 5 05:26:28 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arpit Patel X-Patchwork-Id: 102957 Received: from rcdn-iport-5.cisco.com (rcdn-iport-5.cisco.com [173.37.86.76]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.27739.1793856392225095439 for ; Wed, 04 Nov 2026 21:26:32 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=EFZD6ohC; spf=pass (domain: cisco.com, ip: 173.37.86.76, mailfrom: arpitpa@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=4016; q=dns/txt; s=iport01; t=1793856392; x=1795065992; h=from:to:cc:subject:date:message-id:mime-version: content-transfer-encoding; bh=vfRwK+kzNvG1i3bofr1KCKvq0119ps+NMgWCVeh+Fyc=; b=EFZD6ohCbfnhpLj0Z6aSL6/0CqISwJ553SWwlzauPjTwTQrVZ4alYK+w dNN0u44fsLeomnIjyKTqUcbC0Wlo964tYTPMyGrP6ZEr79+vygbfvFNpe dzxuIbhn4E0Dr5ySErAIAaDt4ctjQyQuw2FSAODDJ5D+72V6jvvRosJ4x CboooMm0CxUwBX2VaI/+agOD/porYzfEjYiJ1jkA0y6Psr/TT8Ohz+OAF q3M8xuCN9v6NmG40Et2g5Nutx+E9P03SOmG4mxJgFjaMgbGk1vfW11qt3 8feC2h4b/5OrTUTMM9QMt26MIOSU/sutU6XS1usX2KaKPJy6T/G3Ad0wS w==; X-CSE-ConnectionGUID: G9OSEDb6Rh6A2b9rczhpiw== X-CSE-MsgGUID: RY7SPHyZT/eQztd9uoHHaw== X-IPAS-Result: A0AaAACDEuxq/47/Ja1aHAEBAQEBAQcBARIBAQQEAQGBfAcBAQsBglZ1YENJjHKJWZ4kgX4PAQEBD0QNBAEBhD9Gjh8CJjQJDgECBAMCAwEBAQEBAQEBAQEBAQoBAQUBAQECAQcFgQ4Thk8NkBIBAgEqCwEYAS0sAwECWiMhgwIBgnQDEbw6gXkzgQGCZkMBPwJDUNlLgWgBCxQBBYEzAYU/ModxXRgBhH0nG4FJRIR+gQWBXAEBiCYEgy6BWo0YAoFShnBIgR4DWSwBVRMNCgsHBYFoAzUSKhVuMh2BIz4XgQcbBgWBHYEegRKBB12BKyhdASGBCIF2AoJRggACAUlBDgdFUwklQxJHJCIIEgkBExosCoEaNTwJJj8VDGQLGgVhCAINDHI5EDAeJC8FHCZAGwoYGA1IESw3FRkEPm4Hki+DEQGBDQErgQVAYhajRIIhoRGEKoFoijyVOhozhVulFguYfY4KllGEaYFoPEaBAQsHMxoIGxWDIglKGQ+OKwMLC4NggX+DFMlEJjICCTIBAQcCBw4DC4FokX4BAQ IronPort-Data: A9a23:7hFHtKO7X9WCeZ/vrR3zlsFynXyQoLVcMsEvi/4bfWQNrUohhWcEx zQXXGGFOPzbNDf1c9ByPIri80sF6MCGyocyGXM5pCpnJ55oRWUpJjg4wmPYZX76whjrFRo/h ykmQoCeap1yFjmD9k/F3oHJ9RFUzbuPSqf3FNnKMyVwQR4MYCo6gHqPocZh6mJTqYb/WVzlV e/a+ZWFZgb8g2IsaAr41orawP9RlKWq0N8nlgRWicBj5Df2i3QTBZQDEqC9R1OQapVUBOOzW 9HYx7i/+G7Dlz91Yj9yuu+mGqGiaue60Tmm0hK6aYD76vRxjnBaPpIACRYpQRw/ZwNlMDxG4 I4lWZSYEW/FN0BX8QgXe0Ew/ypWZcWq9FJbSJSymZT78qHIT5fj69o/K3obEYdGwOYpKDtEp OYTOjAVbw/W0opawJrjIgVtrt4oIM+uOMYUvWttiGmES/0nWpvEBa7N4Le03h9p2ZsIRqmYP ZdEL2MzNnwsYDUXUrsTIJskhOa0nnDXeDxDo1XTrq0yi4TW5FEtjOezaoGLJrRmQ+1vrxmjn kLXzVi+DygIKNDO1D2l0nuz07qncSTTHdh6+KeD3vlyjVuew2YeBBEbWR6wpuO0okq/QM5Eb UsM9ywjqKI/+ECmQp/6RRLQnZKflgQXV9wVF6gx7xuAj/KJpQ2YHWMDCDVGbbTKqfMLeNDj7 XfR9/uBONClmOf9pa61nltMkQ6PBA== IronPort-HdrOrdr: A9a23:CwDCwK1rZeYx//Zf0FADywqjBJ4kLtp133Aq2lEZdPWaSKOlfq eV7ZEmPHDP6Qr5NEtMpTniAtjjfZqjz/5ICOAqVN/INjUO01HHEGgN1+ffKhTbaknDH5ZmpM RdWpk7LsHsBl5nisu/ygy5H9E8hOSjysmT9IDjJ7MHd3ASV0mmhD0JbDqmLg== X-Talos-CUID: 9a23:plL/B2pfZCyyPnBAUdylnG3mUe90VUbw4H2OGU/mIDxjGaeeW1+I+bwxxg== X-Talos-MUID: 9a23:Me+UMQWCRAAfia3q/AXd2wpaFNZa3+OjMVIRncQbvOmkPDMlbg== X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,196,1787011200"; d="scan'208";a="544762364" Received: from rcdn-l-core-05.cisco.com ([173.37.255.142]) by rcdn-iport-5.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 05 Nov 2026 05:26:31 +0000 Received: from sjc-ads-10129.cisco.com (sjc-ads-10129.cisco.com [10.30.210.133]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "ciscoit-managed-infra-smtp-auth.cisco.com", Issuer "Internal Private TLS SubCA" (verified OK)) by rcdn-l-core-05.cisco.com (Postfix) with ESMTPS id 2564E18000223; Thu, 5 Nov 2026 05:26:31 +0000 (GMT) Received: by sjc-ads-10129.cisco.com (Postfix, from userid 1877011) id C7A90CC2EF1; Wed, 4 Nov 2026 21:26:30 -0800 (PST) From: Arpit Patel To: openembedded-core@lists.openembedded.org Cc: xe-linux-external@cisco.com Subject: [OE-core][wrynose][PATCH 03/10] sqlite3: fix CVE-2026-119374 Date: Wed, 4 Nov 2026 21:26:28 -0800 Message-Id: <20261105052628.2443928-1-arpitpa@cisco.com> X-Mailer: git-send-email 2.35.6 MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-Client-TLS: VERIFIED;sjc-ads-10129.cisco.com [10.30.210.133];TLSv1.3;TLS_AES_256_GCM_SHA384;256;ciscoit-managed-infra-smtp-auth.cisco.com X-Outbound-SMTP-Client: 10.30.210.133, sjc-ads-10129.cisco.com X-Outbound-Node: rcdn-l-core-05.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 05 Nov 2026 05:26:34 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249421 This patch applies the upstream fix [1], which addresses an FTS5 secure-delete buffer overrun when handling a corrupted database. The GitHub mirror commit [1] corresponds to the SQLite Fossil check-in shown in [2]. [1] https://github.com/sqlite/sqlite/commit/d9de6eedbe918c074c7556400fa21df5960704d9 [2] https://sqlite.org/src/info/9cd4f9e920 Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-119374 Signed-off-by: Arpit Patel --- .../sqlite/sqlite3/CVE-2026-119374.patch | 76 +++++++++++++++++++ meta/recipes-support/sqlite/sqlite3_3.51.3.bb | 1 + 2 files changed, 77 insertions(+) create mode 100644 meta/recipes-support/sqlite/sqlite3/CVE-2026-119374.patch diff --git a/meta/recipes-support/sqlite/sqlite3/CVE-2026-119374.patch b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119374.patch new file mode 100644 index 0000000000..e82f48951b --- /dev/null +++ b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119374.patch @@ -0,0 +1,76 @@ +From 260a971baff8140195c181b94ce2264efbb042b9 Mon Sep 17 00:00:00 2001 +From: dan +Date: Tue, 11 Aug 2026 14:16:12 +0000 +Subject: [PATCH] Fix a problem in fts5 secure-delete code that could lead to a + buffer overrun when dealing with a strategically corrupted database. Problem + reported by YEONBA. + +FossilOrigin-Name: 9cd4f9e9205c5a5096388397a39349db9ff5377d19095c6b20388ff799969c31 + +CVE: CVE-2026-119374 +Upstream-Status: Backport [https://github.com/sqlite/sqlite/commit/d9de6eedbe918c074c7556400fa21df5960704d9] + +Backport Changes: +- Applied the fix from ext/fts5/fts5_index.c to sqlite3.c because the + recipe uses SQLite's amalgamated source. +- Omitted ext/fts5/test/fts5corruptB.test because the extracted source + does not include the upstream Tcl test tree. +- Omitted manifest and manifest.uuid because they are Fossil metadata + and are not needed for this source patch. + +Signed-off-by: Arpit Patel +--- + sqlite3.c | 18 +++++++++++------- + 1 file changed, 11 insertions(+), 7 deletions(-) + +diff --git a/sqlite3.c b/sqlite3.c +index bfd285777d..1889632086 100644 +--- a/sqlite3.c ++++ b/sqlite3.c +@@ -252752,32 +252752,36 @@ static void fts5DoSecureDelete( + if( p->rc==SQLITE_OK ){ + const int nMove = nPg - iNextOff; /* Number of bytes to move */ + int nShift = iNextOff - iOff; /* Distance to move them */ +- ++ int nNewPg = 0; + int iPrevKeyOut = 0; +- int iKeyIn = 0; ++ i64 iKeyIn = 0; + + memmove(&aPg[iOff], &aPg[iNextOff], nMove); + iPgIdx -= nShift; +- nPg = iPgIdx; ++ nNewPg = iPgIdx; + fts5PutU16(&aPg[2], iPgIdx); + + for(iIdx=0; iIdxnPg ){ ++ FTS5_CORRUPT_IDX(p); ++ break; ++ } + if( iKeyIn!=iDelKeyOff ){ + int iKeyOut = (iKeyIn - (iKeyIn>iOff ? nShift : 0)); +- nPg += sqlite3Fts5PutVarint(&aPg[nPg], iKeyOut - iPrevKeyOut); ++ nNewPg += sqlite3Fts5PutVarint(&aPg[nNewPg], iKeyOut - iPrevKeyOut); + iPrevKeyOut = iKeyOut; + } + } + +- if( iPgIdx==nPg && nIdx>0 && pSeg->iLeafPgno!=1 ){ ++ if( p->rc==SQLITE_OK && iPgIdx==nNewPg && nIdx>0 && pSeg->iLeafPgno!=1 ){ + fts5SecureDeleteIdxEntry(p, iSegid, pSeg->iLeafPgno); + } + +- assert_nc( nPg>4 || fts5GetU16(aPg)==0 ); +- fts5DataWrite(p, FTS5_SEGMENT_ROWID(iSegid,pSeg->iLeafPgno), aPg, nPg); ++ assert_nc( nNewPg>4 || fts5GetU16(aPg)==0 ); ++ fts5DataWrite(p, FTS5_SEGMENT_ROWID(iSegid,pSeg->iLeafPgno), aPg, nNewPg); + } + sqlite3_free(aIdx); + } +-- +2.35.6 + diff --git a/meta/recipes-support/sqlite/sqlite3_3.51.3.bb b/meta/recipes-support/sqlite/sqlite3_3.51.3.bb index 52e7659a8e..f76ca8bd56 100644 --- a/meta/recipes-support/sqlite/sqlite3_3.51.3.bb +++ b/meta/recipes-support/sqlite/sqlite3_3.51.3.bb @@ -14,4 +14,5 @@ SRC_URI += "\ file://CVE-2026-119377_p1.patch \ file://CVE-2026-119377_p2.patch \ file://CVE-2026-119373.patch \ + file://CVE-2026-119374.patch \ " From patchwork Thu Nov 5 05:28:22 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arpit Patel X-Patchwork-Id: 102963 Received: from rcdn-iport-9.cisco.com (rcdn-iport-9.cisco.com [173.37.86.80]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.27756.1793856505221509612 for ; Wed, 04 Nov 2026 21:28:25 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=Mjya69Tk; spf=pass (domain: cisco.com, ip: 173.37.86.80, mailfrom: arpitpa@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=3081; q=dns/txt; s=iport01; t=1793856505; x=1795066105; h=from:to:cc:subject:date:message-id:mime-version: content-transfer-encoding; bh=knXAL2fC0MlNS+7ZXb8Kcn9ggaTnvc7pET9YckiIZ4A=; b=Mjya69TkZF+LHtRxiysYB1s0ReLk7gclokAIvygLD6PfLeX9Id3b/Z3E MqSTmdVbjdMbGQRjDhI3mpj4eb+r6ObRvVhVqQuIyytFTxGlkaaU2GFYL AcGpyW2m7gbUKpwQgW7pjvUvHQeJ3hNrgsjV7F1S1YznKDbT1XoUOIFBG 3rFrRr/VyXVYFwPIskzXR+NUYYtQU15nfS/41xBjomFrX6GAiuwPc7TPp EMU4zbjy3ntC59WAc/2WngARhARTfwGucWoY5r19Q0tmFB4QIB8R/Bbm/ +GSjuhHLeoo7OqrB56eFKw/DqwjL1g5ueSihvY0vlBRaSf7bSbzvoAruv g==; X-CSE-ConnectionGUID: wtcOyvcZTLC7l18HfCZbOQ== X-CSE-MsgGUID: WEXcGp+qTF2SkFMmM6S75A== X-IPAS-Result: A0BFAgCDEuxq/4r/Ja1aglmCV3VgQ0mWS54kgX4PAQEBD0QNBAEBhD9Gjh8CJjQJDgECBAMCAwEBAQEBAQEBAQEBAQoBAQUBAQECAQcFgQ4Thk8NkBIBAgEqCwEYAS0sAwECWiMhgwIBgnQDEbw6gXkzgQGDKQE/AkNQ2UuBaAELFAEFgTOFQDKHcV0YAYR9JxuBSUSEfoEFgVwBAYEnhn8Egy6BWo0YAoFShnBIgR4DWSwBVRMNCgsHBYFoAzUSKhVuMh2BIz4XgQcbBgWBHYEegRKBB12BKyhdASGBCIF2AoJRggACAUlBDgdFUwklQxJHJCIIEgkBExosCoEaNTwJJj8VDGQLGgVhCAINDHI5EDAeJC8FHCZAGwoYGA1IESw3FRkEPm4Hki+DEAEBgQ0BK4IFOKNEgiGhEYQqgWiKPJU6GjOEBJQZklQLmH2OCpZRhGmBaDxGgQELBzMaCBsVgyIJShkPji4LC4NggX+DFMlEJjICCTIBAQcCBw4DC4FokACBfgEB IronPort-Data: A9a23:JkcIVqOtKZCXwyTvrR3zlsFynXyQoLVcMsEvi/4bfWQNrUon0D0Pz WRKXz+DPfnbZDSjf4x3YNiw8kIG7JGGy4JmHHM5pCpnJ55oRWUpJjg4wmPYZX76whjrFRo/h ykmQoCeap1yFjmD9k/F3oHJ9RFUzbuPSqf3FNnKMyVwQR4MYCo6gHqPocZh6mJTqYb/WVzlV e/a+ZWFZgb8g2IsaAr41orawP9RlKWq0N8nlgRWicBj5Df2i3QTBZQDEqC9R1OQapVUBOOzW 9HYx7i/+G7Dlz91Yj9yuu+mGqGiaue60Tmm0hK6aYD76vRxjnBaPpIACRYpQRw/ZwNlMDxG4 I4lWZSYEW/FN0BX8QgXe0Ew/ypWZcWq9FJbSJSymZT78qHIT5fj6+pyB2YnI4YqxsJcXmUXp dwWAwIHSSnW0opawJrjIgVtrt4oIM+uOMYUvWttiGmAS/0nWpvEBa7N4Le03h9p2ZsIRqmYP ZdEL2M0PHwsYDUXUrsTIJskhOa0nnDXeDxDo1XTrq0yi4TW5FEti+W9a4eMJLRmQ+1qs3aTi XqF5ljXWCoZGvma7GS+rS+F07qncSTTHdh6+KeD3vlyjVuew2YeBBEbWR6wpuO0okq/QM5Eb UsM9ywjqKI/+ECmQp/6RRLQnZKflgQXV9wVF6gx7xuAj/KNpQ2YHWMDCDVGbbTKqfMLeNDj7 XfR9/uBONClmOT9pa61nltMkQ6PBA== IronPort-HdrOrdr: A9a23:xK4Hs6vMvEkG3h6+rbyvMMKm7skDWtV00zEX/kB9WHVpmwKj+P xG+85rsCMc5wxxZJhNo7290cq7MBHhHOBOgbX5VI3KNGKNhILCFu9fBOXZrwEIMheOktK1rZ 0QEJRWOZnXEUVwi9r87U2TFtYtx8TCzYWT7N2uqEuEiWpRGthdB8ATMHf8LnFL X-Talos-CUID: 9a23:0+FkWG22DWVVsg+MopuUzbxfBdwuVWzDx0XsB2TnDT85aLO+e1W3wfYx X-Talos-MUID: 9a23:OShrDAuazGJlOoXqI82nuxxSP+hwoL2SJho2krsjvuzaDnMtEmLI X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,196,1787011200"; d="scan'208";a="543583516" Received: from rcdn-l-core-01.cisco.com ([173.37.255.138]) by rcdn-iport-9.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 05 Nov 2026 05:28:24 +0000 Received: from sjc-ads-10129.cisco.com (sjc-ads-10129.cisco.com [10.30.210.133]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "ciscoit-managed-infra-smtp-auth.cisco.com", Issuer "Internal Private TLS SubCA" (verified OK)) by rcdn-l-core-01.cisco.com (Postfix) with ESMTPS id 24DE51800030D; Thu, 5 Nov 2026 05:28:24 +0000 (GMT) Received: by sjc-ads-10129.cisco.com (Postfix, from userid 1877011) id BFE3CCC2EF1; Wed, 4 Nov 2026 21:28:23 -0800 (PST) From: Arpit Patel To: openembedded-core@lists.openembedded.org Cc: xe-linux-external@cisco.com Subject: [OE-core][wrynose][PATCH 04/10] sqlite3: fix CVE-2026-119375 Date: Wed, 4 Nov 2026 21:28:22 -0800 Message-Id: <20261105052822.2445547-1-arpitpa@cisco.com> X-Mailer: git-send-email 2.35.6 MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-Client-TLS: VERIFIED;sjc-ads-10129.cisco.com [10.30.210.133];TLSv1.3;TLS_AES_256_GCM_SHA384;256;ciscoit-managed-infra-smtp-auth.cisco.com X-Outbound-SMTP-Client: 10.30.210.133, sjc-ads-10129.cisco.com X-Outbound-Node: rcdn-l-core-01.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 05 Nov 2026 05:28:35 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249428 This patch applies the upstream fix [1], which fully initializes the page read when the WAL and database page sizes differ, preventing disclosure of uninitialized page data. The GitHub mirror commit [1] corresponds to the SQLite Fossil check-in shown in [2]. [1] https://github.com/sqlite/sqlite/commit/e5bf119821f25be1d7f10ef0a2edbe175289166e [2] https://sqlite.org/src/info/f9b4ee369557c36c Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-119375 Signed-off-by: Arpit Patel --- .../sqlite/sqlite3/CVE-2026-119375.patch | 47 +++++++++++++++++++ meta/recipes-support/sqlite/sqlite3_3.51.3.bb | 1 + 2 files changed, 48 insertions(+) create mode 100644 meta/recipes-support/sqlite/sqlite3/CVE-2026-119375.patch diff --git a/meta/recipes-support/sqlite/sqlite3/CVE-2026-119375.patch b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119375.patch new file mode 100644 index 0000000000..94bf2752a3 --- /dev/null +++ b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119375.patch @@ -0,0 +1,47 @@ +From 01d00d78bc2c756021a2f8f01733d58af7dec1ef Mon Sep 17 00:00:00 2001 +From: drh <> +Date: Sun, 16 Aug 2026 10:49:39 +0000 +Subject: [PATCH] When reading a frame from a WAL file where the WAL pagesize + and the database pagesize disagree, be sure to fully initialize the page that + is read. + +FossilOrigin-Name: f9b4ee369557c36c606666bd7e6d8dc4685d87531993d3ce4e7a718aa814a5ac + +CVE: CVE-2026-119375 +Upstream-Status: Backport [https://github.com/sqlite/sqlite/commit/e5bf119821f25be1d7f10ef0a2edbe175289166e] + +Backport Changes: +- Applied the src/wal.c change to sqlite3.c because the recipe source + uses the amalgamated SQLite layout. +- Omitted manifest and manifest.uuid because they are Fossil + repository metadata and are not needed in this source patch. + +Signed-off-by: Arpit Patel +--- + sqlite3.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/sqlite3.c b/sqlite3.c +index 1889632086..bcd317206b 100644 +--- a/sqlite3.c ++++ b/sqlite3.c +@@ -70412,11 +70412,15 @@ SQLITE_PRIVATE int sqlite3WalReadFrame( + i64 iOffset; + sz = pWal->hdr.szPage; + sz = (sz&0xfe00) + ((sz&0x0001)<<16); ++ if( nOut>sz ){ ++ memset(pOut+sz, 0, nOut-sz); ++ nOut = sz; ++ } + testcase( sz<=32768 ); + testcase( sz>=65536 ); + iOffset = walFrameOffset(iRead, sz) + WAL_FRAME_HDRSIZE; + /* testcase( IS_BIG_INT(iOffset) ); // requires a 4GiB WAL */ +- return sqlite3OsRead(pWal->pWalFd, pOut, (nOut>sz ? sz : nOut), iOffset); ++ return sqlite3OsRead(pWal->pWalFd, pOut, nOut, iOffset); + } + + /* +-- +2.35.6 + diff --git a/meta/recipes-support/sqlite/sqlite3_3.51.3.bb b/meta/recipes-support/sqlite/sqlite3_3.51.3.bb index f76ca8bd56..79d12d4b03 100644 --- a/meta/recipes-support/sqlite/sqlite3_3.51.3.bb +++ b/meta/recipes-support/sqlite/sqlite3_3.51.3.bb @@ -15,4 +15,5 @@ SRC_URI += "\ file://CVE-2026-119377_p2.patch \ file://CVE-2026-119373.patch \ file://CVE-2026-119374.patch \ + file://CVE-2026-119375.patch \ " From patchwork Thu Nov 5 05:28:52 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arpit Patel X-Patchwork-Id: 102964 Received: from rcdn-iport-6.cisco.com (rcdn-iport-6.cisco.com [173.37.86.77]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.27760.1793856535727475321 for ; Wed, 04 Nov 2026 21:28:55 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=hvXLkGbz; spf=pass (domain: cisco.com, ip: 173.37.86.77, mailfrom: arpitpa@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=4058; q=dns/txt; s=iport01; t=1793856535; x=1795066135; h=from:to:cc:subject:date:message-id:mime-version: content-transfer-encoding; bh=JsbhnijrIqUTdL4la4cAi95tGro9w6ayWJZ3/Gwkv5s=; b=hvXLkGbzOo2NegvOxeUZhMUXNRjQ8irboHKL5glRlFOTpzJwFeG1ooD4 v5wSDWnFAesVK257X3GOfdY3dFNhuZ6OBTghTYTxcHreflrfurA/kLABF 8BP2LVTZs/bkEi8UwOv1WRuPpOPmurxMCwcBwcCfhI8M2BfnwfKbDlXgf Zwvp+ySORpCVhuXfJhhzbSgxMAfCUwaTkEhVKKfBdyOLegx/rsQ2yFdgz ICVIOGgCMtQ5zpFTCapPCui+F+Ax0hxsuFDZ/+fVuP7oF10Sd+FbPndBN AbSK2WngpCzuNIxwj6/bB3jPL7PaEUgewuFOHIgCXi80++oLzTBMuO6eY g==; X-CSE-ConnectionGUID: HSBAx+uzTYeqpRxcJt6mhg== X-CSE-MsgGUID: B5JwdRHmRnKXJ/srI3NiVA== X-IPAS-Result: A0BFAgCDEuxq/5X/Ja1aglmCV3VgQ0mWS54kgX4PAQEBD0QNBAEBhD9Gjh8CJjQJDgECBAMCAwEBAQEBAQEBAQEBAQoBAQUBAQECAQcFgQ4Thk8NkBIBAgEqCwEYAS0sAwECWiMhgwIBgnQDEbw6gXkzgQGCZkMBPwJDUNlLgWgBCxQBBYEzhUAyh3FdGAGEfScbgUlEglCCLoEFgVwBAYgmBIMugVqNGAKBUoZwSIEeA1ksAVUTDQoLBwWBaAM1EioVbjIdgSM+F4EHGwYFgR2BHoESgQddgSsoXQEhgQiBdgKCUYIAAgFJQQ4HRVMJJUMSRyQiCBIJARMaLAqBGjU8CSY/FQxkCxoFYQgCDQxyORAwHiQvBRwmQBsKGBgNSBEsNxUZBD5uB5IvgxEBPFEBK4IENgOTAJBEgiGhEYQqgWiKPJU6GjOFW6UWC5h9jgqWUYRpgWg8gUcLBzMaCBsVgyIJShkPji4LC4NggX+DFMlEJjICCTIBAQcCBw4DC4FokX4BAQ IronPort-Data: A9a23:nfM0YKoL4z8klVBZsuP9EP3oREJeBmJOZBIvgKrLsJaIsI4StFCzt garIBmAOPiMZjD1ed9/YYS09kNV75CDndE1T1drrn1nFHhBo+PIVI+TRqvS04x+DSFioGZPt Zh2hgzodZhsJpPkjk7zdOWn9T8jhfngqoPUUIbsIjp2SRJvVBAvgBdin/9RqoNziLBVOSvV0 T/Ji5OZYgDNNwJcaDpOtfva8E835pwehRtB1rAATaET1LPhvyF94KI3fcmZM3b+S49IKe+2L 86r5K255G7Q4yA2AdqjlLvhGmVSKlIFFVHT4pb+c/HKbilq/kTe4I5iXBYvQRs/ZwGyojxE4 I4lWapc5useFvakdOw1C3G0GszlVEFM0OevzXOX6aR/w6BaGpfh660GMa04AWEX0sZMK0het uEKFAEAdwi5l+mU3Oy+SuY506zPLOGzVG8ekmtrwTecCbMtRorOBvyQo9RZxzw3wMtJGJ4yZ eJANmEpN0uGOUASfA5LWfrSn8/w7pX7WzRCsFOJvaMf6GnIxws327/oWDbQUoHWGZkJzhjD/ Aoq+UzTXzMFOOa/zACD0UKOwfTVvHjdWbw7QejQGvlCxQf7KnYoIBoOWF22pPO0hkKzV5dUL FYZ0i4vtrQpskuzQ9/wWhe1rHKJslgbQdU4LgEhwBuGxqyR50OSAXIJC2cbLtcnr8QxAzct0 zdlgu/UONCmi5XNIVr1y1tehWra1fQ9RYPaWRI5cA== IronPort-HdrOrdr: A9a23:AejH/KkMcne428BDVL9w6oJeGa3pDfIA3DAbv31ZSRFFG/FwWf rAoB19726QtN9/YhAdcLy7VZVoIkmsl6Kdn7NwAV7KZmCP0wGVxepZg7cKrQeNJ8TWzJ846U 4ZSdkcNPTASX5nkM39/A60V/wkwNWB7eSUoN229QYLcemvAJsQljuQzW2gYytLeDU= X-Talos-CUID: 9a23:8nlMCmGTkGivD1VMqmJHz2Q9CoM4YEHswW7IGV+zK3o3Tb2aHAo= X-Talos-MUID: 9a23:Ieyn5wX+6dclW8rq/BWxpi5uDudt2aKNOGJKio8n4O+FCwUlbg== X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,196,1787011200"; d="scan'208";a="544448632" Received: from rcdn-l-core-12.cisco.com ([173.37.255.149]) by rcdn-iport-6.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 05 Nov 2026 05:28:54 +0000 Received: from sjc-ads-10129.cisco.com (sjc-ads-10129.cisco.com [10.30.210.133]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "ciscoit-managed-infra-smtp-auth.cisco.com", Issuer "Internal Private TLS SubCA" (verified OK)) by rcdn-l-core-12.cisco.com (Postfix) with ESMTPS id C5330180001D3; Thu, 5 Nov 2026 05:28:54 +0000 (GMT) Received: by sjc-ads-10129.cisco.com (Postfix, from userid 1877011) id 71F52CC2EF1; Wed, 4 Nov 2026 21:28:54 -0800 (PST) From: Arpit Patel To: openembedded-core@lists.openembedded.org Cc: xe-linux-external@cisco.com Subject: [OE-core][wrynose][PATCH 05/10] sqlite3: fix CVE-2026-119379 Date: Wed, 4 Nov 2026 21:28:52 -0800 Message-Id: <20261105052852.2446500-1-arpitpa@cisco.com> X-Mailer: git-send-email 2.35.6 MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-Client-TLS: VERIFIED;sjc-ads-10129.cisco.com [10.30.210.133];TLSv1.3;TLS_AES_256_GCM_SHA384;256;ciscoit-managed-infra-smtp-auth.cisco.com X-Outbound-SMTP-Client: 10.30.210.133, sjc-ads-10129.cisco.com X-Outbound-Node: rcdn-l-core-12.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 05 Nov 2026 05:29:05 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249429 This patch applies the upstream fix [1], which prevents a buffer overrun when applying a strategically corrupted changeset through SQLite's session extension. The GitHub mirror commit [1] corresponds to the SQLite Fossil check-in shown in [2]. [1] https://github.com/sqlite/sqlite/commit/64459c87cc702d600704fb77ee40ca1782398a52 [2] https://sqlite.org/src/info/3f57024aecea0f3b Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-119379 Signed-off-by: Arpit Patel --- .../sqlite/sqlite3/CVE-2026-119379.patch | 79 +++++++++++++++++++ meta/recipes-support/sqlite/sqlite3_3.51.3.bb | 1 + 2 files changed, 80 insertions(+) create mode 100644 meta/recipes-support/sqlite/sqlite3/CVE-2026-119379.patch diff --git a/meta/recipes-support/sqlite/sqlite3/CVE-2026-119379.patch b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119379.patch new file mode 100644 index 0000000000..3a882bd0a9 --- /dev/null +++ b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119379.patch @@ -0,0 +1,79 @@ +From f613058ee3c084c6ec1b49e5b9874197df6e7304 Mon Sep 17 00:00:00 2001 +From: dan +Date: Mon, 17 Aug 2026 11:31:59 +0000 +Subject: [PATCH] Avoid a buffer overrun when processing a strategically + corrupted changeset. Report [bugs:/info/2026-08-16T10:15:25Z | + 2026-08-16T10:15:25Z]. + +FossilOrigin-Name: 3f57024aecea0f3b565ed823cf94b085031c481fd6323c1f2e4319a53500864f + +CVE: CVE-2026-119379 +Upstream-Status: Backport [https://github.com/sqlite/sqlite/commit/64459c87cc702d600704fb77ee40ca1782398a52] + +Backport Changes: +- Applied the ext/session/sqlite3session.c fix to sqlite3.c because + the recipe source uses the amalgamated SQLite layout. +- Omitted ext/session/sessioncorrupt.test because the extracted source + does not include the upstream test tree. +- Omitted manifest and manifest.uuid because they are Fossil + metadata and are not required for this backport. + +Signed-off-by: Arpit Patel +--- + sqlite3.c | 9 ++++----- + 1 file changed, 4 insertions(+), 5 deletions(-) + +diff --git a/sqlite3.c b/sqlite3.c +index bcd317206b..83a018d3fc 100644 +--- a/sqlite3.c ++++ b/sqlite3.c +@@ -236199,10 +236199,10 @@ static int sessionChangesetApply( + int schemaMismatch = 0; + int rc = SQLITE_OK; /* Return code */ + const char *zTab = 0; /* Name of current table */ +- int nTab = 0; /* Result of sqlite3Strlen30(zTab) */ + SessionApplyCtx sApply; /* changeset_apply() context object */ + int bPatchset; + u64 savedFlag = db->flags & SQLITE_FkNoAction; ++ int bNew = 0; /* True for first entry of new table */ + + assert( xConflict!=0 ); + +@@ -236223,15 +236223,16 @@ static int sessionChangesetApply( + if( rc==SQLITE_OK ){ + rc = sqlite3_exec(db, "PRAGMA defer_foreign_keys = 1", 0, 0, 0); + } +- while( rc==SQLITE_OK && SQLITE_ROW==sqlite3changeset_next(pIter) ){ ++ while( rc==SQLITE_OK && SQLITE_ROW==sessionChangesetNext(pIter, 0, 0,&bNew) ){ + int nCol; + int op; + const char *zNew; + + sqlite3changeset_op(pIter, &zNew, &nCol, &op, 0); + +- if( zTab==0 || sqlite3_strnicmp(zNew, zTab, nTab+1) ){ ++ if( bNew ){ + u8 *abPK; ++ bNew = 0; + + rc = sessionRetryConstraints( + db, pIter->bPatchset, zTab, &sApply, xConflict, pCtx +@@ -236266,7 +236267,6 @@ static int sessionChangesetApply( + rc = SQLITE_NOMEM; + break; + } +- nTab = (int)strlen(zTab); + sApply.azCol = (const char **)zTab; + }else{ + int nMinCol = 0; +@@ -236319,7 +236319,6 @@ static int sessionChangesetApply( + sApply.bStat1 = 0; + } + } +- nTab = sqlite3Strlen30(zTab); + } + } + +-- +2.35.6 + diff --git a/meta/recipes-support/sqlite/sqlite3_3.51.3.bb b/meta/recipes-support/sqlite/sqlite3_3.51.3.bb index 79d12d4b03..9dd182b168 100644 --- a/meta/recipes-support/sqlite/sqlite3_3.51.3.bb +++ b/meta/recipes-support/sqlite/sqlite3_3.51.3.bb @@ -16,4 +16,5 @@ SRC_URI += "\ file://CVE-2026-119373.patch \ file://CVE-2026-119374.patch \ file://CVE-2026-119375.patch \ + file://CVE-2026-119379.patch \ " From patchwork Thu Nov 5 05:29:22 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arpit Patel X-Patchwork-Id: 102965 Received: from rcdn-iport-1.cisco.com (rcdn-iport-1.cisco.com [173.37.86.72]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.27942.1793856564904204218 for ; Wed, 04 Nov 2026 21:29:25 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=jeB59aiA; spf=pass (domain: cisco.com, ip: 173.37.86.72, mailfrom: arpitpa@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=3524; q=dns/txt; s=iport01; t=1793856564; x=1795066164; h=from:to:cc:subject:date:message-id:mime-version: content-transfer-encoding; bh=4DtXjU2rmr0l0rBU5K/rTh/Yq7edLkP0pvl+VcNGwW4=; b=jeB59aiAYzS/IOw/JctKoRGk3RSS73uT8XiuqqUlgTcCMNVJVL4TZARd POw86OasrgY1kt0NA0y4WS0pvhtpXNmDeed9MWoH15u6weSfRtdJoZiNR 0StFKYaxoaFLQ2RRINgqIQwxPVa5yIpCg1IYH/nbaCJhig9bLs8qVtOIl wrYF/GabcluXcV/mv1cGNoRLAqL1SeyazZaIuCz+1Ur5l/G6o0D3lESmo MY0uASEnlNIHU8gQKxw0NQogxSedy9pByYrnFhjsvLOIjVb2GLA82lBX6 oSqqhsp75A4CUH4aLj4bk633COCuQZYKeXyqp1M3IHhvVc8iwi2FP7KPm A==; X-CSE-ConnectionGUID: 9XIue9ntROWlv2TP2lQUfg== X-CSE-MsgGUID: FmwGqEzrSMmaFBfjU/HcXw== X-IPAS-Result: A0AaAAAGE+xq/4//Ja1aHAEBAQEBAQcBARIBAQQEAQGBfAcBAQsBglZ1YENJjHKJWZ4kgX4PAQEBD0QNBAEBhD9Gjh8CJjQJDgECBAMCAwEBAQEBAQEBAQEBAQoBAQUBAQECAQcFgQ4Thk8NkBIBAgEqCwEYAS0sAwECWiMhgwIBgnQDEbw/gXkzgQGDKQE/AkNQ2UuBaAELFAEFgTMBhT8yh3FdGAGEfScbgUlEhH6BBYFcAQGIJgSDLoFajRgCgVKGcEiBHgNZLAFVEw0KCwcFgWgDNRIqFW4yHYEjPheBBxsGBYEdgR6BEoEHXYErKF0BIYEIgXYCglGCAAIBSUEOB0VTCSVDEkckIggSCQETGiwKgRo1PAkmPxUMZAsaBWEIAg0McjkQMB4kLwUcJkAbChgYDUgRLDcVGQQ+bgeSL4MKBwGBDQETGIEFQHiTAJBEgiGhEYQqgWiKPJU6GjOFW6UWC5h9jgqWUYRpgWg8gUcLBzMaCBsVgyIJShkPjisDCwuDYIF/gxTJSCYyAgkyAQEHAgcOAwuBaJF+AQE IronPort-Data: A9a23:ynLt+69BjzBFfL8f26d5DrUD1n+TJUtcMsCJ2f8bNWPcYEJGY0x3n TEbWjjXb6mJYjekcoh2aYXi9EgPvpPRyYdnTQVlrStEQiMRo6IpJzg2wmQcns+2BpeeJK6yx 5xGMrEsFOhtEDmB4E/rbei5xZVF/fngbqLmD+LZMTxGSwZhSSMw4TpugOdRbrRA2bBVOCvT/ 4mtyyHjEAX9gWAtazpIs/jrRC5H5ZwehhtJ5jTSWtgT1LPuvyF9JI4SI6i3M0z5TuF8dsamR /zOxa2O5WjQ+REgELuNyt4XpWVTH9Y+lSDX4pZnc/DKbipq/0Te4Y5nXBYoUnq7vh3S9zxHJ HqhgrTrIeshFvWkdO3wyHC0GQkmVUFN0OevzXRSLaV/wmWeG0YAzcmCA2lnDawF97dxHVtpy vgGcgw1NBS6uuy5lefTpulE3qzPLeHxN48Z/3UlxjbDALN+H9bIQr7B4plT2zJYasJmRKmFI ZFGL2AyMVKZP0Yn1lQ/UPrSmM+hnGH+byVRgFmUvqEwpWPUyWSd1ZCwbIaPJ4DUFJU9ckCwi GfZ0H3UEAshEdmW5xCL8E/rpuT/gnauMG4VPPjinhJwu3WU3mEVBRgcWFe3rPX8gUmkVvpbK lcI4WwptaU0+UmhQ9XxUhH+p2SL1iPwQPJKGOE8rQXIwa3O7kPBWC4PTyVKb5ots8peqSEW6 2JlVujBXVRH2IB5g1rHnltIhVte4RQoEFI= IronPort-HdrOrdr: A9a23:cpe2tKswKSbhVg+0D2v5MPCN7skDWtV00zEX/kB9WHVpmwKj+P xG+85rsCMc5wxxZJhNo7290cq7MBHhHOBOgbX5VI3KNGKNhILCFu9fBOXZrwEIMheOktK1rZ 0QEJRWOZnXEUVwi9r87U2TFtYtx8TCzYWT7N2uqEuEiWpRGthdB8ATMHf8LnFL X-Talos-CUID: 9a23:gRbCTmkNcgrewnxzshiIqoeBdzfXOSzt7WrdckmkM0FWTKPPdWfK/JpZncU7zg== X-Talos-MUID: 9a23:o79UqgwxbjOn4HJODS+0IFMnveyaqIqrF28UvIccgOyBPAJaNTWgyxS8cpByfw== X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,196,1787011200"; d="scan'208";a="544254698" Received: from rcdn-l-core-06.cisco.com ([173.37.255.143]) by rcdn-iport-1.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 05 Nov 2026 05:29:23 +0000 Received: from sjc-ads-10129.cisco.com (sjc-ads-10129.cisco.com [10.30.210.133]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "ciscoit-managed-infra-smtp-auth.cisco.com", Issuer "Internal Private TLS SubCA" (verified OK)) by rcdn-l-core-06.cisco.com (Postfix) with ESMTPS id B0FAB1800024F; Thu, 5 Nov 2026 05:29:23 +0000 (GMT) Received: by sjc-ads-10129.cisco.com (Postfix, from userid 1877011) id 5F42BCC2EF1; Wed, 4 Nov 2026 21:29:23 -0800 (PST) From: Arpit Patel To: openembedded-core@lists.openembedded.org Cc: xe-linux-external@cisco.com Subject: [OE-core][wrynose][PATCH 06/10] sqlite3: fix CVE-2026-119372 Date: Wed, 4 Nov 2026 21:29:22 -0800 Message-Id: <20261105052922.2447352-1-arpitpa@cisco.com> X-Mailer: git-send-email 2.35.6 MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-Client-TLS: VERIFIED;sjc-ads-10129.cisco.com [10.30.210.133];TLSv1.3;TLS_AES_256_GCM_SHA384;256;ciscoit-managed-infra-smtp-auth.cisco.com X-Outbound-SMTP-Client: 10.30.210.133, sjc-ads-10129.cisco.com X-Outbound-Node: rcdn-l-core-06.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 05 Nov 2026 05:29:25 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249430 This patch applies the upstream fix [1], which prevents a use-after-free in FTS3 snippet() processing. The GitHub mirror commit [1] corresponds to the SQLite Fossil check-in shown in [2]. [1] https://github.com/sqlite/sqlite/commit/a87bd2471a9c0606e78d3c3678bcd9cecaa0e731 [2] https://sqlite.org/src/info/e4635c41536a Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-119372 Signed-off-by: Arpit Patel --- .../sqlite/sqlite3/CVE-2026-119372.patch | 56 +++++++++++++++++++ meta/recipes-support/sqlite/sqlite3_3.51.3.bb | 1 + 2 files changed, 57 insertions(+) create mode 100644 meta/recipes-support/sqlite/sqlite3/CVE-2026-119372.patch diff --git a/meta/recipes-support/sqlite/sqlite3/CVE-2026-119372.patch b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119372.patch new file mode 100644 index 0000000000..c05000cb49 --- /dev/null +++ b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119372.patch @@ -0,0 +1,56 @@ +From 52acd34ba6d51393d9f714b3e0c5ae7d805ddeae Mon Sep 17 00:00:00 2001 +From: dan +Date: Mon, 17 Aug 2026 13:55:38 +0000 +Subject: [PATCH] Avoid a problem causing a use-after-free in the fts3 + snippet() function. Report [bugs:/info/2026-08-17T09:18:24Z | + 2026-08-17T09:18:24Z]. + +FossilOrigin-Name: e4635c41536a0b3620780c3f1c872de33121370bafb608fce9fe7e3113e2ae01 + +CVE: CVE-2026-119372 +Upstream-Status: Backport [https://github.com/sqlite/sqlite/commit/a87bd2471a9c0606e78d3c3678bcd9cecaa0e731] + +Backport Changes: +- Applied the ext/fts3/fts3_snippet.c fix to sqlite3.c because the + recipe source uses the amalgamated SQLite layout. +- Omitted test/fts3snippet2.test because the extracted source does not + include the upstream Tcl test tree. +- Omitted manifest and manifest.uuid because they are Fossil + repository metadata and are not needed for this source patch. + +Signed-off-by: Arpit Patel +--- + sqlite3.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +diff --git a/sqlite3.c b/sqlite3.c +index 83a018d3fc..cbad7b2ae5 100644 +--- a/sqlite3.c ++++ b/sqlite3.c +@@ -208133,6 +208133,7 @@ static int fts3BestSnippet( + sqlite3_int64 nByte; /* Number of bytes of space to allocate */ + int iBestScore = -1; /* Best snippet score found so far */ + int i; /* Loop counter */ ++ Fts3Expr *pExpr = pCsr->pExpr; + + memset(&sIter, 0, sizeof(sIter)); + +@@ -208161,9 +208162,12 @@ static int fts3BestSnippet( + sIter.nSnippet = nSnippet; + sIter.nPhrase = nList; + sIter.iCurrent = -1; +- rc = sqlite3Fts3ExprIterate( +- pCsr->pExpr, fts3SnippetFindPositions, (void*)&sIter +- ); ++ rc = sqlite3Fts3ExprIterate(pExpr, fts3SnippetFindPositions, (void*)&sIter); ++ if( rc==SQLITE_OK ){ ++ /* Iterate through the expression twice, in case pointers garnered during ++ ** the first iteration are invalidated by a call to fts5EvalRestart(). */ ++ rc = sqlite3Fts3ExprIterate(pExpr, fts3SnippetFindPositions, (void*)&sIter); ++ } + if( rc==SQLITE_OK ){ + + /* Set the *pmSeen output variable. */ +-- +2.35.6 + diff --git a/meta/recipes-support/sqlite/sqlite3_3.51.3.bb b/meta/recipes-support/sqlite/sqlite3_3.51.3.bb index 9dd182b168..c6a19525fa 100644 --- a/meta/recipes-support/sqlite/sqlite3_3.51.3.bb +++ b/meta/recipes-support/sqlite/sqlite3_3.51.3.bb @@ -17,4 +17,5 @@ SRC_URI += "\ file://CVE-2026-119374.patch \ file://CVE-2026-119375.patch \ file://CVE-2026-119379.patch \ + file://CVE-2026-119372.patch \ " From patchwork Thu Nov 5 05:29:53 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arpit Patel X-Patchwork-Id: 102966 Received: from rcdn-iport-2.cisco.com (rcdn-iport-2.cisco.com [173.37.86.73]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.27772.1793856596944158097 for ; Wed, 04 Nov 2026 21:29:57 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=NEPW1z0m; spf=pass (domain: cisco.com, ip: 173.37.86.73, mailfrom: arpitpa@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=3499; q=dns/txt; s=iport01; t=1793856596; x=1795066196; h=from:to:cc:subject:date:message-id:mime-version: content-transfer-encoding; bh=eKhT5xplhHv2UyFL7BoQcixxCy+loGhkeKyQdFo+pNs=; b=NEPW1z0mMRWfjrd3o+kHdzzZjto9w2rqoCZDRwi+1T6Fq2E/vywlWxUY 9tDEIAwQn22SwQUgJ45VkjjNkjOh4ZhmGXVAx2tlsElHugmXCg7nAq4B+ 6ZAL42xFi2nzR57cTjGpCXI2Mi1swcuwPyWIs2JPP2SwODkKJ+DSNC6xh NmR7LLDs7y+vd+PJtyQch4IxBdxMHcGoNNp73NfMawf8sySgbEY85tf42 +JZkUoRJ3desPCnYqqtFzs9ccMxZzC7otLnFG6+2Zvrwp+xgZr5+1v/U8 Apj/ROkJeIy+04vzOJtQcqFFwCDPn4VJD6b3FC4oWoKhCHuwSfsSK5jW6 g==; X-CSE-ConnectionGUID: I6DeSFbkTAirOLEUfU52yQ== X-CSE-MsgGUID: Rqsw7vW4RYWoEfhtWWFQcA== X-IPAS-Result: A0BFAgCDE+xq/5D/Ja1aglmCV3VgQ0mWS54kgX4PAQEBD0QNBAEBhD9Gjh8CJjQJDgECBAMCAwEBAQEBAQEBAQEBAQoBAQUBAQECAQcFgQ4Thk8NkBIBAgEqCwEYAS0sAwECWiMhgwIBgnQDEbw/gXkzgQGCZkMBPwJDUNlLgWgBCxQBBYEzhUAyh3FdGAGEfScbgUlEhAh2gQWBXAEBgSeGfwSDLoFajRgCgVKGcEiBHgNZLAFVEw0KCwcFgWgDNRIqFW4yHYEjPheBBxsGBYEdgR6BEoEHXYErKF0BIYEIgXYCglGCAAIBSUEOB0VTCSVDEkckIggSCQETGiwKgRo1PAkmPxUMZAsaBWEIAg0McjkQMB4kLwUcJkAbChgYDUgRLDcVGQQ+bgeSL4MKBwEsRxoBExiBRXiTAJBEgiGhEYQqgWiKPJU6GjOFW6UWC5h9jgqWUYRpgWg8gUcLBzMaCBsVgyIJShkPji0BCwuDYIF/gxTJSCYyAgkyAQEHAgcOAwuBaJAAgX4BAQ IronPort-Data: A9a23:mosicaCjo+TrQhVW/3/iw5YqxClBgxIJ4kV8jS/XYbTApD90hDAOx jEfD22Gaa2JNGGjfN8jbNjk8U8PvZ/Vz4cxOVdlrnsFo1CmBibm6XV1Cm+qYkt+++WaFBoPA /02M4eGcYZsCCCM/n9BC5C5xVFkz6aEW7HgP+DNPyF1VGdMRTwo4f5Zs7ZRbrVA357jXGthh fuo+5eBYQb9h2YuWo4pw/vrRC1H7ayaVAww5jTSVdgT1HfCmn8cCo4oJK3ZBxPQXolOE+emc P3Ixbe/83mx109F5gSNy+uTnuUiG9Y+DCDW4pZkc/HKbitq+kTe5p0G2M80Mi+7vdkmc+dZk 72hvbToIesg0zaldO41C3G0GAkmVUFKFSOuzXWX6aSuI0P6n3TE4qtCAXoYN44k0+dtJkVjy PIldWocV0XW7w626OrTpuhEnM8vKozveYgYoHwllW6fBvc9SpeFSKLPjTNa9G5v3YYVQrCEO pdfMGYzBPjDS0Un1lM/AYgmnfuwj1H0ciZTrxSeoq9fD237kVcpiuK8aYaOEjCMbf9MhVnHu F2axVXGBTwUNMCg9hS8+Vv504cjmgu+Aur+DoaQ8eZnhlCWzGEfBBAaEFC8u/SRjk+lR8kZL FQZ/Ccrp6U++EGnCN7nUHWFTGWspBUQXZ9UVuY98gzIkvWS6AeCDW9CRTlEADA7iPILqfUR/ gfht7vU6fZH6dV5lVr1Gm+okA6P IronPort-HdrOrdr: A9a23:svx0m65KxePHn0HJQgPXwOTXdLJyesId70hD6qm+c3Nom6uj5q WTdZsgtCMc5Ax9ZJhCo6HjBED/exPhHPdOiOF7V4tKNzOJhILHFu1fBKLZslnd8lXFh41g/J YlVbRiA9vtClU/p8P77A6kV+sE+rC8gceVbSO09QYVcemsAJsQiTtENg== X-Talos-CUID: 9a23:ZZkKvmmiBo443/CCS+ot/LbUGbrXOVyD4HrrDUW7NU9oUpqxZGKexf4+gvM7zg== X-Talos-MUID: 9a23:wPoq1Qla1Bb7Zhw7jbEIdnpYLdx3vLqRVHo8rpIrtcmYChNeAjy02WE= X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,196,1787011200"; d="scan'208";a="530229143" Received: from rcdn-l-core-07.cisco.com ([173.37.255.144]) by rcdn-iport-2.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 05 Nov 2026 05:29:56 +0000 Received: from sjc-ads-10129.cisco.com (sjc-ads-10129.cisco.com [10.30.210.133]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "ciscoit-managed-infra-smtp-auth.cisco.com", Issuer "Internal Private TLS SubCA" (verified OK)) by rcdn-l-core-07.cisco.com (Postfix) with ESMTPS id CE86C180003C5; Thu, 5 Nov 2026 05:29:55 +0000 (GMT) Received: by sjc-ads-10129.cisco.com (Postfix, from userid 1877011) id 7A0AFCC2EF1; Wed, 4 Nov 2026 21:29:55 -0800 (PST) From: Arpit Patel To: openembedded-core@lists.openembedded.org Cc: xe-linux-external@cisco.com Subject: [OE-core][wrynose][PATCH 07/10] sqlite3: fix CVE-2026-119378 Date: Wed, 4 Nov 2026 21:29:53 -0800 Message-Id: <20261105052953.2448155-1-arpitpa@cisco.com> X-Mailer: git-send-email 2.35.6 MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-Client-TLS: VERIFIED;sjc-ads-10129.cisco.com [10.30.210.133];TLSv1.3;TLS_AES_256_GCM_SHA384;256;ciscoit-managed-infra-smtp-auth.cisco.com X-Outbound-SMTP-Client: 10.30.210.133, sjc-ads-10129.cisco.com X-Outbound-Node: rcdn-l-core-07.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 05 Nov 2026 05:30:05 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249431 This patch applies the upstream fix [1], which prevents a use-after-free in R-Tree when a manipulated shadow-table schema causes sqlite3_last_insert_rowid() to return 0. The GitHub mirror commit [1] corresponds to the SQLite Fossil check-in shown in [2]. [1] https://github.com/sqlite/sqlite/commit/d21bd37c7cfc1b85b17a6703555f0926b6236e04 [2] https://sqlite.org/src/info/6a9e1415659f9e75 Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-119378 Signed-off-by: Arpit Patel --- .../sqlite/sqlite3/CVE-2026-119378.patch | 52 +++++++++++++++++++ meta/recipes-support/sqlite/sqlite3_3.51.3.bb | 1 + 2 files changed, 53 insertions(+) create mode 100644 meta/recipes-support/sqlite/sqlite3/CVE-2026-119378.patch diff --git a/meta/recipes-support/sqlite/sqlite3/CVE-2026-119378.patch b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119378.patch new file mode 100644 index 0000000000..5228e32cb6 --- /dev/null +++ b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119378.patch @@ -0,0 +1,52 @@ +From e92efe57e1f9cc51f7d819bb7fb05bff182b708b Mon Sep 17 00:00:00 2001 +From: dan +Date: Thu, 24 Sep 2026 20:14:31 +0000 +Subject: [PATCH] Avoid a use-after-free problem in rtree triggered by an + attacker manipulating the shadow table schema to ensure + sqlite3_last_insert_rowid() returns 0 after certain INSERTs. Problem reported + by Claude and Ada Logics. + +FossilOrigin-Name: 6a9e1415659f9e75940b3c3a6f6e123f61c5e9e2a7a612693ee395d7b7567bef + +CVE: CVE-2026-119378 +Upstream-Status: Backport [https://github.com/sqlite/sqlite/commit/d21bd37c7cfc1b85b17a6703555f0926b6236e04] + +Backport Changes: +- Applied the ext/rtree/rtree.c fix to sqlite3.c because the recipe + source uses the amalgamated SQLite layout. +- Omitted ext/rtree/rtreeI.test because the extracted source does not + include the upstream test tree. +- Omitted manifest and manifest.uuid because they are Fossil + repository metadata and are not needed for this source patch. + +Signed-off-by: Arpit Patel +--- + sqlite3.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/sqlite3.c b/sqlite3.c +index cbad7b2ae5..45ade42b16 100644 +--- a/sqlite3.c ++++ b/sqlite3.c +@@ -216677,7 +216677,17 @@ static int nodeWrite(Rtree *pRtree, RtreeNode *pNode){ + sqlite3_bind_null(p, 2); + if( pNode->iNode==0 && rc==SQLITE_OK ){ + pNode->iNode = sqlite3_last_insert_rowid(pRtree->db); +- nodeHashInsert(pRtree, pNode); ++ if( pNode->iNode==0 ){ ++ /* If the SQL statement has succeeded but sqlite3_last_insert_rowid() ++ ** returns 0, then the shadow table schema has been corrupted somehow ++ ** (e.g. the %_node table has been replaced by a WITHOUT ROWID table). ++ ** It would be dangerous to continue in this case as the hash table ++ ** implementation assumes iNode==0 means that the node is not part ++ ** of the hash table. */ ++ rc = SQLITE_CORRUPT_VTAB; ++ }else{ ++ nodeHashInsert(pRtree, pNode); ++ } + } + } + return rc; +-- +2.35.6 + diff --git a/meta/recipes-support/sqlite/sqlite3_3.51.3.bb b/meta/recipes-support/sqlite/sqlite3_3.51.3.bb index c6a19525fa..7c8658a977 100644 --- a/meta/recipes-support/sqlite/sqlite3_3.51.3.bb +++ b/meta/recipes-support/sqlite/sqlite3_3.51.3.bb @@ -18,4 +18,5 @@ SRC_URI += "\ file://CVE-2026-119375.patch \ file://CVE-2026-119379.patch \ file://CVE-2026-119372.patch \ + file://CVE-2026-119378.patch \ " From patchwork Thu Nov 5 05:30:23 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arpit Patel X-Patchwork-Id: 102967 Received: from rcdn-iport-2.cisco.com (rcdn-iport-2.cisco.com [173.37.86.73]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.27951.1793856625938429352 for ; Wed, 04 Nov 2026 21:30:26 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=IMsqxsKg; spf=pass (domain: cisco.com, ip: 173.37.86.73, mailfrom: arpitpa@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=4679; q=dns/txt; s=iport01; t=1793856625; x=1795066225; h=from:to:cc:subject:date:message-id:mime-version: content-transfer-encoding; bh=hesU5emkxWs5YHZwkeC91XLovar+RS46GcHLi6vnsfk=; b=IMsqxsKgiUinfCVnooj5ILld2V6Ws5ZPrpX/je3D0D0bSyaX+OnW75N+ /fGcORGmJ2GWvYo3Ujb1RpGkF/jX2ziqwjJ5SQdK2/3eYQP12hv/tFJL5 CZIfEe+nXvTIxyOpuS8OtEOLSMzOpwGqndYK7kG6WSV9wc0wP9PKfMpnP 1+OT6lqizcY0RKG3pbZ7bS6KvxKmLamVnJUb8qF+Sn5sk1LGjqJa9Jxcd 3DR+YYcqsAVU/y3pWEIrYermPhhz2NJ73bcOAl8ZWxRqNNz0jfjo3TTG6 q7A6mgQDVWRj3kMt3Nx596Aolgr7xVeAIHe6qrVuKydZ3XJmrYq9mNeMg Q==; X-CSE-ConnectionGUID: iLmg3OzyRLS4FXLCkxzSjQ== X-CSE-MsgGUID: bWEBBlR9RSiKpLJyBimFfw== X-IPAS-Result: A0BFAgCDE+xq/4v/Ja1aHgEBCxIMggULgld1YENJlkueJIF+DwEBAQ9EDQQBAYQ/Ro4fAiY0CQ4BAgQDAgMBAQEBAQEBAQEBAQEKAQEFAQEBAgEHBYEOE4ZPDZASAQIBKgsBGAEtLAMBAlojIYMCAYJ0AxG8P4F5M4EBgmZDAT8CQ1DZS4FoAQsUAQWBM4VAModxXRgBhH0nG4FJRIJQgi6BBYFcAQGBOIZuBIMugVqNGAKBUoZwSIEeA1ksAVUTDQoLBwWBaAM1EioVbjIdgSM+F4EHGwYFgR2BHoESgQddgSsoXQEhgQiBdgKCUYIAAgFJQQ4HRVMJJUMSRyQiCBIJARMaLAqBGjU8CSY/FQxkCxoFYQgCDQxyORAwHiQvBRwmQBsKGBgNSBEsNxUZBD5uB5Ivgn4TAYENASuCPaNEgiGhEYQqgWiKPJU6GjOFW6UWC5h9jgqWUYRpgWg8gUcLBzMaCBsVgyIJShkPji4LC4NggX+DFMlIJjICCTIBAQcCBw4DC4FokAGBfQEB IronPort-Data: A9a23:+0YS96+UH1Qr8V2fLZAoDrUD1n+TJUtcMsCJ2f8bNWPcYEJGY0x3x 2QdX2qFbv/bYWGgftp3PISzo08FvpGAm98yGQpsqn1EQiMRo6IpJzg2wmQcns+2BpeeJK6yx 5xGMrEsFOhtEDmB4E/rbei5xZVF/fngbqLmD+LZMTxGSwZhSSMw4TpugOdRbrRA2bBVOCvT/ 4mtyyHjEAX9gWAtazpIs/jrRC5H5ZwehhtJ5jTSWtgT1LPuvyF9JI4SI6i3M0z5TuF8dsamR /zOxa2O5WjQ+REgELuNyt4XpWVTH9Y+lSDX4pZnc/DKbipq/0Te4Y5nXBYoUnq7vh3S9zxHJ HqhgrTrIeshFvWkdO3wyHC0GQkmVUFN0OevzXRSLaV/wmWeG0YAzcmCA2k3GYgXocFlEFtqz qA2GBQmbQCRvOCPlefTpulE3qzPLeHxN48Z/3UlxjbDALN+G9bIQr7B4plT2zJYasJmRKmFI ZFGL2AyMVKZOEwn1lQ/UPrSmM+hnGH+byVRgFmUvqEwpWPUyWSd1ZCwa4KPII3WGpo9ckCwr F3r1U79OEAgD9280R6n41itg8HBgnauMG4VPPjinhJwu3WU3mEVBRgcWFe3rPX8gUmkVvpbK lcI4WwptaU0+UmhQ9XxUhH+p2SL1iPwQPJKGOE8rQXIwa3O7kPBXC4PTyVKb5ots8peqSEW6 2JlVujBXVRH2IB5g1rGnltIhVte4RQoEFI= IronPort-HdrOrdr: A9a23:cc4JJqG4CW3+L/kApLqExMeALOsnbusQ8zAXPo5KJiC9Ffbo8v xG88576faZslsssRIb6LK90de7IU80nKQdieJ6AV7IZmfbUQWTQL2KxLGSpwEIYxeOldJ15O NHb7V0DsH2ABxRiMb35xT9LvMbqeP3l5xBQYzlvg5QpcYAUdAH0ztE X-Talos-CUID: 9a23:JMJNnmCyteRcWD/6EyhD8UFPPdI0SFnmkFngB2S7GXRSSoTAHA== X-Talos-MUID: 9a23:h4a3aQxS6qNNHNBnujYbdxPI80eaqK6RJWonla9XgfKFFjRUGSa3jTGZTJByfw== X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,196,1787011200"; d="scan'208";a="530229477" Received: from rcdn-l-core-02.cisco.com ([173.37.255.139]) by rcdn-iport-2.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 05 Nov 2026 05:30:25 +0000 Received: from sjc-ads-10129.cisco.com (sjc-ads-10129.cisco.com [10.30.210.133]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "ciscoit-managed-infra-smtp-auth.cisco.com", Issuer "Internal Private TLS SubCA" (verified OK)) by rcdn-l-core-02.cisco.com (Postfix) with ESMTPS id 0C3A21800036B; Thu, 5 Nov 2026 05:30:25 +0000 (GMT) Received: by sjc-ads-10129.cisco.com (Postfix, from userid 1877011) id AD93DCC2EF1; Wed, 4 Nov 2026 21:30:24 -0800 (PST) From: Arpit Patel To: openembedded-core@lists.openembedded.org Cc: xe-linux-external@cisco.com Subject: [OE-core][wrynose][PATCH 08/10] sqlite3: fix CVE-2026-119376 Date: Wed, 4 Nov 2026 21:30:23 -0800 Message-Id: <20261105053023.2448641-1-arpitpa@cisco.com> X-Mailer: git-send-email 2.35.6 MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-Client-TLS: VERIFIED;sjc-ads-10129.cisco.com [10.30.210.133];TLSv1.3;TLS_AES_256_GCM_SHA384;256;ciscoit-managed-infra-smtp-auth.cisco.com X-Outbound-SMTP-Client: 10.30.210.133, sjc-ads-10129.cisco.com X-Outbound-Node: rcdn-l-core-02.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 05 Nov 2026 05:30:35 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249432 This patch applies the upstream fix [1], which includes COLLATE expressions in expression tree depth calculations and prevents bypass of the expression depth limit. The GitHub mirror commit [1] corresponds to the SQLite Fossil check-in shown in [2]. [1] https://github.com/sqlite/sqlite/commit/d54522a5b832422ab893a1e9fa7a99ab314ea4e2 [2] https://sqlite.org/src/info/252c0b7bf5a727d2 Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-119376 Signed-off-by: Arpit Patel --- .../sqlite/sqlite3/CVE-2026-119376.patch | 75 +++++++++++++++++++ meta/recipes-support/sqlite/sqlite3_3.51.3.bb | 1 + 2 files changed, 76 insertions(+) create mode 100644 meta/recipes-support/sqlite/sqlite3/CVE-2026-119376.patch diff --git a/meta/recipes-support/sqlite/sqlite3/CVE-2026-119376.patch b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119376.patch new file mode 100644 index 0000000000..32060a5444 --- /dev/null +++ b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119376.patch @@ -0,0 +1,75 @@ +From 0e3ec7377ba0ef29b02e258e9fbb395d0d6dd431 Mon Sep 17 00:00:00 2001 +From: drh <> +Date: Sun, 4 Oct 2026 21:54:17 +0000 +Subject: [PATCH] Fix expression tree depth calculations for COLLATE. + [bugs:/info/2026-10-04T04:50:56Z|Bug 2026-10-04T04:50:56Z] + +FossilOrigin-Name: 252c0b7bf5a727d29605672bb58e06c758173c276671df3e388a68294998b4d3 + +CVE: CVE-2026-119376 +Upstream-Status: Backport [https://github.com/sqlite/sqlite/commit/d54522a5b832422ab893a1e9fa7a99ab314ea4e2] + +Backport Changes: +- Ported the src/expr.c and src/sqliteInt.h changes into sqlite3.c + because the recipe source uses the amalgamated SQLite layout. +- Omitted test/sqllimits1.test because the extracted source does not + include the upstream test tree. +- Omitted manifest and manifest.uuid because they are Fossil + repository metadata and are not needed for this source patch. + +Signed-off-by: Arpit Patel +--- + sqlite3.c | 16 +++++++++++----- + 1 file changed, 11 insertions(+), 5 deletions(-) + +diff --git a/sqlite3.c b/sqlite3.c +index 45ade42b16..603ca28a27 100644 +--- a/sqlite3.c ++++ b/sqlite3.c +@@ -21992,8 +21992,8 @@ SQLITE_PRIVATE void sqlite3SetTextEncoding(sqlite3 *db, u8); + SQLITE_PRIVATE CollSeq *sqlite3ExprCollSeq(Parse *pParse, const Expr *pExpr); + SQLITE_PRIVATE CollSeq *sqlite3ExprNNCollSeq(Parse *pParse, const Expr *pExpr); + SQLITE_PRIVATE int sqlite3ExprCollSeqMatch(Parse*,const Expr*,const Expr*); +-SQLITE_PRIVATE Expr *sqlite3ExprAddCollateToken(const Parse *pParse, Expr*, const Token*, int); +-SQLITE_PRIVATE Expr *sqlite3ExprAddCollateString(const Parse*,Expr*,const char*); ++SQLITE_PRIVATE Expr *sqlite3ExprAddCollateToken(Parse *pParse, Expr*, const Token*, int); ++SQLITE_PRIVATE Expr *sqlite3ExprAddCollateString(Parse*,Expr*,const char*); + SQLITE_PRIVATE Expr *sqlite3ExprSkipCollate(Expr*); + SQLITE_PRIVATE Expr *sqlite3ExprSkipCollateAndLikely(Expr*); + SQLITE_PRIVATE int sqlite3CheckCollSeq(Parse *, CollSeq *); +@@ -111640,23 +111640,29 @@ SQLITE_PRIVATE int sqlite3ExprDataType(const Expr *pExpr){ + ** and the pExpr parameter is returned unchanged. + */ + SQLITE_PRIVATE Expr *sqlite3ExprAddCollateToken( +- const Parse *pParse, /* Parsing context */ ++ Parse *pParse, /* Parsing context */ + Expr *pExpr, /* Add the "COLLATE" clause to this expression */ + const Token *pCollName, /* Name of collating sequence */ + int dequote /* True to dequote pCollName */ + ){ +- if( pCollName->n>0 ){ ++ if( pCollName->n>0 && pParse->nErr==0 ){ + Expr *pNew = sqlite3ExprAlloc(pParse->db, TK_COLLATE, pCollName, dequote); ++ assert( pExpr!=0 ); + if( pNew ){ + pNew->pLeft = pExpr; + pNew->flags |= EP_Collate|EP_Skip; ++#if SQLITE_MAX_EXPR_DEPTH>0 ++ pNew->nHeight = pExpr->nHeight+1; ++ sqlite3ExprCheckHeight(pParse, pNew->nHeight); ++ testcase( pParse->nErr>0 ); ++#endif + pExpr = pNew; + } + } + return pExpr; + } + SQLITE_PRIVATE Expr *sqlite3ExprAddCollateString( +- const Parse *pParse, /* Parsing context */ ++ Parse *pParse, /* Parsing context */ + Expr *pExpr, /* Add the "COLLATE" clause to this expression */ + const char *zC /* The collating sequence name */ + ){ +-- +2.35.6 + diff --git a/meta/recipes-support/sqlite/sqlite3_3.51.3.bb b/meta/recipes-support/sqlite/sqlite3_3.51.3.bb index 7c8658a977..c16576354a 100644 --- a/meta/recipes-support/sqlite/sqlite3_3.51.3.bb +++ b/meta/recipes-support/sqlite/sqlite3_3.51.3.bb @@ -19,4 +19,5 @@ SRC_URI += "\ file://CVE-2026-119379.patch \ file://CVE-2026-119372.patch \ file://CVE-2026-119378.patch \ + file://CVE-2026-119376.patch \ " From patchwork Thu Nov 5 05:30:46 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arpit Patel X-Patchwork-Id: 102968 Received: from rcdn-iport-1.cisco.com (rcdn-iport-1.cisco.com [173.37.86.72]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.27959.1793856648780669959 for ; Wed, 04 Nov 2026 21:30:48 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=TvzVR0Ew; spf=pass (domain: cisco.com, ip: 173.37.86.72, mailfrom: arpitpa@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=10796; q=dns/txt; s=iport01; t=1793856648; x=1795066248; h=from:to:cc:subject:date:message-id:mime-version: content-transfer-encoding; bh=Z42Y8LK2/7QvEuvfnK6xAAzuzr+8mttiGVAJ9m1ReKc=; b=TvzVR0EwbAhOP9HNHVo+aSPJ0QuGW9svNoECcCgvDWGF2Ti1zCvRzQKa 6KQ0vGo2ZW81+MOTBv2foDT/3+Pj1ziTP4TF0//oWD1KNzh8+YYc7THQF fupKtY+eovA/9iB2mdEHpkvLWUnKBtzVW8l+vclXvwVhrzR0YaZuUPUFQ 2t+KISFU3vIFfGgnBHo5h9leNdhybmeczdaCpqCA/YuL58UGkAqM64usl x5LgULQK5NlVni4HIvVEOQDlBRJgzFqPbgRhr2KrPVRZS0xcaArHf1XRL IxD8N71xkjum25e4VrLY2cMxklBp1ebjyTUn/YkSuwMzbR+nr2s7EXcmU Q==; X-CSE-ConnectionGUID: 9OX2Q4kbQMKXE2cGL+SOmw== X-CSE-MsgGUID: Vs7Rfc2OSFOI9s+K8+3htA== X-IPAS-Result: A0AaAAAGE+xq/5H/Ja1aHAEBAQEBAQcBARIBAQQEAQGBfAcBAQsBglZ1YENJjHKJWZMjiwGBfg8BAQEPRA0EAQGEP0aOHwImNAkOAQIEAwIDAQEBAQEBAQEBAQEBCgEBBQEBAQIBBwWBDhOGTw2QEgECASoLARgBLSwDAQJaIyGDAgGCdAMRvD+BeTOBAYJmQwE/AkNQ2UuBaAELFAEFgTMBhT8yh3FdGAGEfScbgUlEhH6BBYFcAQGBOIZuBIMugVqBA4wVAoFShnBIgR4DWSwBVRMNCgsHBYFoAzUSKhVuMh2BIz4XgQcbBgWBHYEegRKBB12BKyhdASGBCIF2AoJRggACAUlBDgdFUwklQxJHJCIIEgkBExosCoEaNTwJJj8VDGQLGgVhCAINDHI5EDAeJC8FHCZAGwoYGA1IESw3FRkEPm4Hki+DEQE8PhMBJQaBBT56K5MDkBaCIaERhCqBaIo8lToaM4VbpRYLmH2OCpZRhGmBaDyBRwsHMxoIGxU7gmcJShkPjisDCwuDYIF/gxTJSCYyAgkyAQEHAgcOAwuBaJABgX0BAQ IronPort-Data: A9a23:9qv2SaMbowB/klLvrR3zlsFynXyQoLVcMsEvi/4bfWQNrUp03mdVm GpKCD+HaKmPajGne48nPIixpENUvZ/TmN9iSXM5pCpnJ55oRWUpJjg4wmPYZX76whjrFRo/h ykmQoCeap1yFjmD9k/F3oHJ9RFUzbuPSqf3FNnKMyVwQR4MYCo6gHqPocZh6mJTqYb/WVzlV e/a+ZWFZgb8g2IsaAr41orawP9RlKWq0N8nlgRWicBj5Df2i3QTBZQDEqC9R1OQapVUBOOzW 9HYx7i/+G7Dlz91Yj9yuu+mGqGiaue60Tmm0hK6aYD76vRxjnBaPpIACRYpQRw/ZwNlMDxG4 I4lWZSYEW/FN0BX8QgXe0Ew/ypWZcWq9FJbSJSymZT78qHIT5fj66RJPBsPYY4Sw8NUMUwU/ tM8awsqaw/W0opawJrjIgVtrt4oIM+uOMYUvWttiGmJS/0nWpvEBa7N4Le03h9p2ZsIRqmYP ZdEL2MzMXwsYDUXUrsTIJskhOa0nnDXeDxDo1XTrq0yi4TW5FEtjOKwbYqNJLRmQ+1rhRmiq Gmc2F/XJTBLL5+8mXne8m6F07qncSTTHdh6+KeD3vlyjVuew2YeBBEbWR6wpuO0okq/QM5Eb UsM9ywjqKI/+ECmQp/6RRLQnZKflgQXV9wVF6gx7xuAj/KEpQ2YHWMDCDVGbbTKqfMLeNDj7 XfR9/uBONClmOT9pa61nltMkQ6PBA== IronPort-HdrOrdr: A9a23:SjGsLKBkvHrgKeDlHemA55DYdb4zR+YMi2TDGXofdfUzSL38qy nAppUmPHPP5Qr5O0tQ++xoRpPhfZq0z/cciuMs1NyZMjUO1lHFEGhK1/qH/9SZIVycysdtkY F9bqN5FNr8SXJ+jcr8/U2ENuxI+qjhzEht7t2utkuEimpRGsdd0zs= X-Talos-CUID: 9a23:q4K2smlzgflQGrBLQbkZuauecp3XOSz6/C3pf0yyMENKeJDPQnC0u5hDltU7zg== X-Talos-MUID: 9a23:ff2p1giFgewFvM75leh/JMMpCtw32aqlUmc2v7In6tLHFnwzYDeBpWHi X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,196,1787011200"; d="scan'208";a="544255806" Received: from rcdn-l-core-08.cisco.com ([173.37.255.145]) by rcdn-iport-1.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 05 Nov 2026 05:30:47 +0000 Received: from sjc-ads-10129.cisco.com (sjc-ads-10129.cisco.com [10.30.210.133]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "ciscoit-managed-infra-smtp-auth.cisco.com", Issuer "Internal Private TLS SubCA" (verified OK)) by rcdn-l-core-08.cisco.com (Postfix) with ESMTPS id BAFAF18000440; Thu, 5 Nov 2026 05:30:47 +0000 (GMT) Received: by sjc-ads-10129.cisco.com (Postfix, from userid 1877011) id 685A1CC2EF1; Wed, 4 Nov 2026 21:30:47 -0800 (PST) From: Arpit Patel To: openembedded-core@lists.openembedded.org Cc: xe-linux-external@cisco.com Subject: [OE-core][wrynose][PATCH 09/10] sqlite3: fix CVE-2026-119371 Date: Wed, 4 Nov 2026 21:30:46 -0800 Message-Id: <20261105053046.2449268-1-arpitpa@cisco.com> X-Mailer: git-send-email 2.35.6 MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-Client-TLS: VERIFIED;sjc-ads-10129.cisco.com [10.30.210.133];TLSv1.3;TLS_AES_256_GCM_SHA384;256;ciscoit-managed-infra-smtp-auth.cisco.com X-Outbound-SMTP-Client: 10.30.210.133, sjc-ads-10129.cisco.com X-Outbound-Node: rcdn-l-core-08.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 05 Nov 2026 05:30:55 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249433 This patch series applies the upstream prerequisite [1] and CTE recursion fix [3]. Commit [1] adds VIEW and subquery nesting tracking; commit [3] uses that counter to limit recursive CTE depth. The GitHub commits [1] and [3] correspond to SQLite Fossil check-ins [2] and [4], respectively. [1] https://github.com/sqlite/sqlite/commit/9fb225190c3ac0e51f11a7fddab0d4cc960417ad [2] https://sqlite.org/src/info/3f3fb9b638f59ad9 [3] https://github.com/sqlite/sqlite/commit/e6ff280c839fdfc7418fd5add12e8f32702a17fb [4] https://sqlite.org/src/info/f54730871303e655 Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-119371 Signed-off-by: Arpit Patel --- .../sqlite3/CVE-2026-119371-dependent.patch | 109 ++++++++++++++++++ .../sqlite/sqlite3/CVE-2026-119371.patch | 103 +++++++++++++++++ meta/recipes-support/sqlite/sqlite3_3.51.3.bb | 2 + 3 files changed, 214 insertions(+) create mode 100644 meta/recipes-support/sqlite/sqlite3/CVE-2026-119371-dependent.patch create mode 100644 meta/recipes-support/sqlite/sqlite3/CVE-2026-119371.patch diff --git a/meta/recipes-support/sqlite/sqlite3/CVE-2026-119371-dependent.patch b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119371-dependent.patch new file mode 100644 index 0000000000..21fed4b6f8 --- /dev/null +++ b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119371-dependent.patch @@ -0,0 +1,109 @@ +From 15fc374428c9fa554b25e8f51ebb9b3d38107a00 Mon Sep 17 00:00:00 2001 +From: drh <> +Date: Tue, 16 Jun 2026 13:43:08 +0000 +Subject: [PATCH] Limit VIEW recursion depth to SQLITE_LIMIT_EXPR_DEPTH to + prevent static overflow in malicious schemas with tens of thousands of levels + of recursive views. [bugs:/info/2026-06-16T04:21:51Z|Bug + 2026-06-16T04:21:51Z] + +FossilOrigin-Name: 3f3fb9b638f59ad982beafb7c117f24ddd3da612e62c862510805fa672ffae06 + +CVE: CVE-2026-119371 +Upstream-Status: Backport [https://github.com/sqlite/sqlite/commit/9fb225190c3ac0e51f11a7fddab0d4cc960417ad] + +Backport Changes: +- Ported src/select.c and src/sqliteInt.h code into the amalgamated + sqlite3.c source file. +- Updated limit documentation in sqlite3.c and sqlite3.h. +- Omitted test/view.test because the extracted source lacks the upstream + test tree. +- Omitted manifest and manifest.uuid because they are Fossil metadata. + +Signed-off-by: Arpit Patel +--- + sqlite3.c | 16 ++++++++++++++-- + sqlite3.h | 6 ++++-- + 2 files changed, 18 insertions(+), 4 deletions(-) + +diff --git a/sqlite3.c b/sqlite3.c +index 603ca28a27..87c568b41e 100644 +--- a/sqlite3.c ++++ b/sqlite3.c +@@ -4655,7 +4655,8 @@ SQLITE_API int sqlite3_limit(sqlite3*, int id, int newVal); + ** or in an ORDER BY or GROUP BY clause.)^ + ** + ** [[SQLITE_LIMIT_EXPR_DEPTH]] ^(
SQLITE_LIMIT_EXPR_DEPTH
+-**
The maximum depth of the parse tree on any expression.
)^ ++**
The maximum depth of the parse tree on any expression and ++** the maximum nesting depth for subqueries and VIEWs
)^ + ** + ** [[SQLITE_LIMIT_COMPOUND_SELECT]] ^(
SQLITE_LIMIT_COMPOUND_SELECT
+ **
The maximum number of terms in a compound SELECT statement.
)^ +@@ -4682,7 +4683,8 @@ SQLITE_API int sqlite3_limit(sqlite3*, int id, int newVal); + **
The maximum index number of any [parameter] in an SQL statement.)^ + ** + ** [[SQLITE_LIMIT_TRIGGER_DEPTH]] ^(
SQLITE_LIMIT_TRIGGER_DEPTH
+-**
The maximum depth of recursion for triggers.
)^ ++**
The maximum depth of recursion for triggers, and the maximum ++** nesting depth for separate triggers.
)^ + ** + ** [[SQLITE_LIMIT_WORKER_THREADS]] ^(
SQLITE_LIMIT_WORKER_THREADS
+ **
The maximum number of auxiliary worker threads that a single +@@ -20531,6 +20533,7 @@ struct Parse { + int szOpAlloc; /* Bytes of memory space allocated for Vdbe.aOp[] */ + int iSelfTab; /* Table associated with an index on expr, or negative + ** of the base register during check-constraint eval */ ++ int nNestSel; /* Number of nested SELECT statements and/or VIEWs */ + int nLabel; /* The *negative* of the number of labels used */ + int nLabelAlloc; /* Number of slots in aLabel */ + int *aLabel; /* Space to hold the labels */ +@@ -149283,6 +149286,13 @@ SQLITE_PRIVATE Table *sqlite3ResultSetOfSelect(Parse *pParse, Select *pSelect, c + sqlite3 *db = pParse->db; + u64 savedFlags; + ++ pParse->nNestSel++; ++#if SQLITE_MAX_EXPR_DEPTH>0 ++ if( pParse->nNestSel >= db->aLimit[SQLITE_LIMIT_EXPR_DEPTH] ){ ++ sqlite3ErrorMsg(pParse, "VIEWs and/or subqueries nested too deep"); ++ return 0; ++ } ++#endif + savedFlags = db->flags; + db->flags &= ~(u64)SQLITE_FullColNames; + db->flags |= SQLITE_ShortColNames; +@@ -149304,6 +149314,8 @@ SQLITE_PRIVATE Table *sqlite3ResultSetOfSelect(Parse *pParse, Select *pSelect, c + sqlite3DeleteTable(db, pTab); + return 0; + } ++ pParse->nNestSel--; ++ assert( pParse->nNestSel>=0 ); + return pTab; + } + +diff --git a/sqlite3.h b/sqlite3.h +index 302f0f5b16..b34982a3e5 100644 +--- a/sqlite3.h ++++ b/sqlite3.h +@@ -4334,7 +4334,8 @@ SQLITE_API int sqlite3_limit(sqlite3*, int id, int newVal); + ** or in an ORDER BY or GROUP BY clause.
)^ + ** + ** [[SQLITE_LIMIT_EXPR_DEPTH]] ^(
SQLITE_LIMIT_EXPR_DEPTH
+-**
The maximum depth of the parse tree on any expression.
)^ ++**
The maximum depth of the parse tree on any expression and ++** the maximum nesting depth for subqueries and VIEWs
)^ + ** + ** [[SQLITE_LIMIT_COMPOUND_SELECT]] ^(
SQLITE_LIMIT_COMPOUND_SELECT
+ **
The maximum number of terms in a compound SELECT statement.
)^ +@@ -4361,7 +4362,8 @@ SQLITE_API int sqlite3_limit(sqlite3*, int id, int newVal); + **
The maximum index number of any [parameter] in an SQL statement.)^ + ** + ** [[SQLITE_LIMIT_TRIGGER_DEPTH]] ^(
SQLITE_LIMIT_TRIGGER_DEPTH
+-**
The maximum depth of recursion for triggers.
)^ ++**
The maximum depth of recursion for triggers, and the maximum ++** nesting depth for separate triggers.
)^ + ** + ** [[SQLITE_LIMIT_WORKER_THREADS]] ^(
SQLITE_LIMIT_WORKER_THREADS
+ **
The maximum number of auxiliary worker threads that a single +-- +2.35.6 + diff --git a/meta/recipes-support/sqlite/sqlite3/CVE-2026-119371.patch b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119371.patch new file mode 100644 index 0000000000..d2d99cf8d8 --- /dev/null +++ b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119371.patch @@ -0,0 +1,103 @@ +From f6040218564d03a040d991179d1b3491f4e9a566 Mon Sep 17 00:00:00 2001 +From: drh <> +Date: Mon, 5 Oct 2026 09:32:24 +0000 +Subject: [PATCH] Limit the depth of recursion for CTEs using + SQLITE_LIMIT_EXPR_DEPTH. [bugs:/info/2026-10-04T04:58:58Z|Bug + 2026-10-04T04:58:58Z]. + +FossilOrigin-Name: f54730871303e655a70f3167ce1a39dcd4e53fcf017d225f429e2bb67ad96604 + +CVE: CVE-2026-119371 +Upstream-Status: Backport [https://github.com/sqlite/sqlite/commit/e6ff280c839fdfc7418fd5add12e8f32702a17fb] + +Backport Changes: +- Ported src/select.c changes into the amalgamated sqlite3.c file. +- Omitted test/with2.test because the extracted source lacks the + upstream test tree. +- Omitted manifest and manifest.uuid because they are Fossil metadata. + +Signed-off-by: Arpit Patel +--- + sqlite3.c | 36 ++++++++++++++++++++++++------------ + 1 file changed, 24 insertions(+), 12 deletions(-) + +diff --git a/sqlite3.c b/sqlite3.c +index 87c568b41e..19ab450812 100644 +--- a/sqlite3.c ++++ b/sqlite3.c +@@ -149277,6 +149277,20 @@ SQLITE_PRIVATE void sqlite3SubqueryColumnTypes( + pTab->szTabRow = 1; /* Any non-zero value works */ + } + ++/* ++** Check the current subquery nesting depth. Return true and set an ++** error if it has gone too deep. ++*/ ++static int checkSubqueryNestingDepth(Parse *pParse){ ++#if SQLITE_MAX_EXPR_DEPTH>0 ++ if( pParse->nNestSel >= pParse->db->aLimit[SQLITE_LIMIT_EXPR_DEPTH] ){ ++ sqlite3ErrorMsg(pParse, "VIEWs and/or subqueries nested too deep"); ++ return 1; ++ } ++#endif ++ return 0; ++} ++ + /* + ** Given a SELECT statement, generate a Table structure that describes + ** the result set of that SELECT. +@@ -149287,12 +149301,7 @@ SQLITE_PRIVATE Table *sqlite3ResultSetOfSelect(Parse *pParse, Select *pSelect, c + u64 savedFlags; + + pParse->nNestSel++; +-#if SQLITE_MAX_EXPR_DEPTH>0 +- if( pParse->nNestSel >= db->aLimit[SQLITE_LIMIT_EXPR_DEPTH] ){ +- sqlite3ErrorMsg(pParse, "VIEWs and/or subqueries nested too deep"); +- return 0; +- } +-#endif ++ if( checkSubqueryNestingDepth(pParse) ) return 0; + savedFlags = db->flags; + db->flags &= ~(u64)SQLITE_FullColNames; + db->flags |= SQLITE_ShortColNames; +@@ -152617,14 +152626,13 @@ SQLITE_PRIVATE With *sqlite3WithPush(Parse *pParse, With *pWith, u8 bFree){ + } + + /* +-** This function checks if argument pFrom refers to a CTE declared by ++** This function checks to see if argument pFrom refers to a CTE declared by + ** a WITH clause on the stack currently maintained by the parser (on the +-** pParse->pWith linked list). And if currently processing a CTE +-** CTE expression, through routine checks to see if the reference is +-** a recursive reference to the CTE. ++** pParse->pWith linked list). And if currently processing a CTE expression, ++** it also checks to see if the reference is a recursive reference to the CTE. + ** +-** If pFrom matches a CTE according to either of these two above, pFrom->pSTab +-** and other fields are populated accordingly. ++** If pFrom matches a CTE, pFrom->pSTab and other fields are populated ++** accordingly. + ** + ** Return 0 if no match is found. + ** Return 1 if a match is found. +@@ -152753,6 +152761,8 @@ static int resolveFromTermToCte( + pRecTerm = pRecTerm->pPrior; + } + ++ pParse->nNestSel++; ++ if( checkSubqueryNestingDepth(pParse) ) return 2; + pCte->zCteErr = "circular reference: %s"; + pSavedWith = pParse->pWith; + pParse->pWith = pWith; +@@ -152777,6 +152787,8 @@ static int resolveFromTermToCte( + } + } + pParse->pWith = pWith; ++ pParse->nNestSel--; ++ assert( pParse->nNestSel>=0 ); + + for(pLeft=pSel; pLeft->pPrior; pLeft=pLeft->pPrior); + pEList = pLeft->pEList; +-- +2.35.6 + diff --git a/meta/recipes-support/sqlite/sqlite3_3.51.3.bb b/meta/recipes-support/sqlite/sqlite3_3.51.3.bb index c16576354a..4073a48202 100644 --- a/meta/recipes-support/sqlite/sqlite3_3.51.3.bb +++ b/meta/recipes-support/sqlite/sqlite3_3.51.3.bb @@ -20,4 +20,6 @@ SRC_URI += "\ file://CVE-2026-119372.patch \ file://CVE-2026-119378.patch \ file://CVE-2026-119376.patch \ + file://CVE-2026-119371-dependent.patch \ + file://CVE-2026-119371.patch \ " From patchwork Thu Nov 5 05:31:20 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arpit Patel X-Patchwork-Id: 102969 Received: from rcdn-iport-5.cisco.com (rcdn-iport-5.cisco.com [173.37.86.76]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.27789.1793856685136154306 for ; Wed, 04 Nov 2026 21:31:25 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=avo5oKPI; spf=pass (domain: cisco.com, ip: 173.37.86.76, mailfrom: arpitpa@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=2717; q=dns/txt; s=iport01; t=1793856685; x=1795066285; h=from:to:cc:subject:date:message-id:mime-version: content-transfer-encoding; bh=n/s+tWkyBMv0ngW9tBZ3a0fGsB4dmYvLRUbZeGIyDBg=; b=avo5oKPIKYyRBz+TYsJv3IS/b+2EzqYg9y9qFcOJ8L1CcApr0wWZ2nr6 gezfJNiGjIFdJeKg1zhDwmo5QGgADMRHbp4K20I6GMN5LdQOQ+LPuBWtQ fHBrXrtidN837I8FlUFvB7rOHCbsN4a47SxBpTDq97wW+WaxbcAsmaZhM VKFk39d9UWsEPWLHJZ36xm9d/rOoCEBT19Jd9fGc1sFX96kgetuR1AsgF oMX5iZzt+YWfxdfROlrieDia9NLDC2162EE0jSdNJeY4fZeA90qWvGJwU 1CIcviGxzITRblcrl8UjZMiuIy6s21xlU8qxpH87ryLKZ5S0f1mYejbz+ A==; X-CSE-ConnectionGUID: d1Siu5aTQN+/LASYlijxRA== X-CSE-MsgGUID: P8CYbIcKRiGQW79PUFuaHg== X-IPAS-Result: A0BFAgCDE+xq/4r/Ja1aHgEBCxIMggULgld1YENJlkueJIF+DwEBAQ9EDQQBAYQ/Ro4fAiY0CQ4BAgQDAgMBAQEBAQEBAQEBAQEKAQEFAQEBAgEHBYEOE4ZPDZASAQIBKgsBGAEtLAMBAlojIYMCAYJ0AxG8P4F5M4EBgykBPwJDUNlLgWgBCxQBBYEzhUAyh3FdGAGEfScbgUlEhH6BBYFcAQGCLYV5BIMugVqNGAKBUoZwSIEeA1ksAVUTDQoLBwWBaAM1EioVbjIdgSM+F4EHGwYFgR2BHoESgQddgSsoXQEhgQiBdgKCUYIAAgFJQQ4HRVMJJUMSRyQiCBIJARMaLAqBGjU8CSY/FQxkCxoFYQgCDQxyORAwHiQvBRwmQBsKGBgNSBEsNxUZBD5uB5IvgxABAYENASuBQ3oroxmCIaERhCqBaIo8lToaM6pxC5h9jgqWUYRpgWg8gUcLBzMaCBsVgyIJShkPji4LC4NggX+DFMlIJjICCTIBAQcCBw4DC4FokX4BAQ IronPort-Data: A9a23:hnv80qoqy/aSyrZoDEuFYsfdzCleBmJOZBIvgKrLsJaIsI4StFCzt garIBmHM6mCMWr2Ldt2bti//UoC657XnYRkQANspS9kHylE8+PIVI+TRqvS04x+DSFioGZPt Zh2hgzodZhsJpPkjk7zdOWn9T8jhfngqoPUUIbsIjp2SRJvVBAvgBdin/9RqoNziLBVOSvV0 T/Ji5OZYgDNNwJcaDpOtfva8E835pwehRtB1rAATaET1LPhvyF94KI3fcmZM3b+S49IKe+2L 86r5K255G7Q4yA2AdqjlLvhGmVSKlIFFVHT4pb+c/HKbilq/kTe4I5iXBYvQRs/ZwGyojxE4 I4lWapc5useFvakdOw1C3G0GszlVEFM0OevzXOX6aR/w6BaGpfh660GMa04AWEX0uouOmBTq PUkERZOKTSqvNOywbCrcMA506zPLOGzVG8ekmtrwTecCbMtRorOBv2To9RZxzw3wMtJGJ4yZ eJANmEpN0uGOUASfA5MWPrSn8/w7pX7WzRCsFOJvaMf6GnIxws327/oWDbQUoHWGZoLwxjH+ Aoq+UzBUjorPv2U6gCE3UuT2b73oA3mUaIdQejQGvlCxQf7KnYoIBoOWF22pPO0hkKzV5dUL FYZ0i4vtrQpskuzQ9/wWhe1rHKJslgbQdU4LgEhwBuGxqyR50OSAXIJC2YYLtcnr8QxAzct0 zdlgu/UONCmi5XNIVr1y1tehWna1fQ9RYPaWRI5cA== IronPort-HdrOrdr: A9a23:JuL9oK1pnF9qFCzvBtzBrgqjBJ4kLtp133Aq2lEZdPWaSKOlfq eV7ZEmPHDP6Qr5NEtMpTniAtjjfZqjz/5ICOAqVN/INjUO01HHEGgN1+ffKhTbaknDH5ZmpM RdWpk7LsHsBl5nisu/ygy5H9E8hOSjysmT9IDjJ7MHd3ASV0mmhD0JbDqmLg== X-Talos-CUID: 9a23:P3VrvGk5kweeiKjYmOJUihxaHKDXOXGE93bNfkaEMEAqD5m8cm6U+aF0qeM7zg== X-Talos-MUID: 9a23:wvuWBA7O0EW3KClFWaK+MhADxoxQs4+fAmEGsq8HlPC7an1IBhmAhRS4F9o= X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,196,1787011200"; d="scan'208";a="544765676" Received: from rcdn-l-core-01.cisco.com ([173.37.255.138]) by rcdn-iport-5.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 05 Nov 2026 05:31:22 +0000 Received: from sjc-ads-10129.cisco.com (sjc-ads-10129.cisco.com [10.30.210.133]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "ciscoit-managed-infra-smtp-auth.cisco.com", Issuer "Internal Private TLS SubCA" (verified OK)) by rcdn-l-core-01.cisco.com (Postfix) with ESMTPS id 2796818000306; Thu, 5 Nov 2026 05:31:22 +0000 (GMT) Received: by sjc-ads-10129.cisco.com (Postfix, from userid 1877011) id C9F8DCC2EF1; Wed, 4 Nov 2026 21:31:21 -0800 (PST) From: Arpit Patel To: openembedded-core@lists.openembedded.org Cc: xe-linux-external@cisco.com Subject: [OE-core][wrynose][PATCH 10/10] sqlite3: fix CVE-2026-119591 Date: Wed, 4 Nov 2026 21:31:20 -0800 Message-Id: <20261105053120.2449836-1-arpitpa@cisco.com> X-Mailer: git-send-email 2.35.6 MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-Client-TLS: VERIFIED;sjc-ads-10129.cisco.com [10.30.210.133];TLSv1.3;TLS_AES_256_GCM_SHA384;256;ciscoit-managed-infra-smtp-auth.cisco.com X-Outbound-SMTP-Client: 10.30.210.133, sjc-ads-10129.cisco.com X-Outbound-Node: rcdn-l-core-01.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 05 Nov 2026 05:31:25 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249434 This patch applies the upstream fix [1] for stack exhaustion in the count-of-view optimization. The GitHub mirror commit [1] corresponds to the SQLite Fossil check-in shown in [2]. [1] https://github.com/sqlite/sqlite/commit/eff50a067c55f972909e7780e506e91382d08de2 [2] https://sqlite.org/src/info/ab621a3e11ee4acc Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-119591 Signed-off-by: Arpit Patel --- .../sqlite/sqlite3/CVE-2026-119591.patch | 40 +++++++++++++++++++ meta/recipes-support/sqlite/sqlite3_3.51.3.bb | 1 + 2 files changed, 41 insertions(+) create mode 100644 meta/recipes-support/sqlite/sqlite3/CVE-2026-119591.patch diff --git a/meta/recipes-support/sqlite/sqlite3/CVE-2026-119591.patch b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119591.patch new file mode 100644 index 0000000000..3b616842fb --- /dev/null +++ b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119591.patch @@ -0,0 +1,40 @@ +From 0894e1c6c54cde37d822bd1cb367fd1ed2765732 Mon Sep 17 00:00:00 2001 +From: drh <> +Date: Mon, 5 Oct 2026 12:18:23 +0000 +Subject: [PATCH] Prevent the expression generated by the count-of-view + optimization from getting too deep and causing a CPU stack overflow. + [bugs:/info/2026-10-04T05:34:47Z|Bug 2026-10-04T05:34:47Z] + +FossilOrigin-Name: ab621a3e11ee4accce14bf6c90a7cc273d9c25a7c3d9dd2466f2bdc2bbbf8084 + +CVE: CVE-2026-119591 +Upstream-Status: Backport [https://github.com/sqlite/sqlite/commit/eff50a067c55f972909e7780e506e91382d08de2] + +Backport Changes: +- Ported the src/select.c change into the amalgamated sqlite3.c. +- Omitted manifest and manifest.uuid because they are Fossil metadata + and are not needed for this source layout. + +Signed-off-by: Arpit Patel +--- + sqlite3.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/sqlite3.c b/sqlite3.c +index 19ab450812..f3f10400c4 100644 +--- a/sqlite3.c ++++ b/sqlite3.c +@@ -154164,6 +154164,10 @@ static int countOfViewOptimization(Parse *pParse, Select *p){ + }else{ + pExpr = sqlite3PExpr(pParse, TK_PLUS, pTerm, pExpr); + } ++ if( pParse->nErr ){ ++ sqlite3ExprDelete(db, pExpr); ++ pExpr = 0; ++ } + pSub = pPrior; + } + p->pEList->a[0].pExpr = pExpr; +-- +2.35.6 + diff --git a/meta/recipes-support/sqlite/sqlite3_3.51.3.bb b/meta/recipes-support/sqlite/sqlite3_3.51.3.bb index 4073a48202..6347fcd8d5 100644 --- a/meta/recipes-support/sqlite/sqlite3_3.51.3.bb +++ b/meta/recipes-support/sqlite/sqlite3_3.51.3.bb @@ -22,4 +22,5 @@ SRC_URI += "\ file://CVE-2026-119376.patch \ file://CVE-2026-119371-dependent.patch \ file://CVE-2026-119371.patch \ + file://CVE-2026-119591.patch \ "