From patchwork Thu Nov 5 14:18:25 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Jo=C3=A3o_Marcos_Costa_=28Schneider_Electric=29?= X-Patchwork-Id: 103147 Received: from smtpout-02.galae.net (smtpout-02.galae.net [185.246.84.56]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.35606.1793888329058778887 for ; Thu, 05 Nov 2026 06:18:50 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@bootlin.com header.s=dkim header.b=Xyo7Fo4x; spf=pass (domain: bootlin.com, ip: 185.246.84.56, mailfrom: joaomarcos.costa@bootlin.com) Received: from smtpout-01.galae.net (smtpout-01.galae.net [212.83.139.233]) by smtpout-02.galae.net (Postfix) with ESMTPS id C82671A094D; Thu, 5 Nov 2026 14:18:46 +0000 (UTC) Received: from mail.galae.net (mail.galae.net [212.83.136.155]) by smtpout-01.galae.net (Postfix) with ESMTPS id 90F505FF85; Thu, 5 Nov 2026 14:18:46 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) by localhost (Mailerdaemon) with ESMTPSA id 92315103291F9; Thu, 5 Nov 2026 15:18:45 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bootlin.com; s=dkim; t=1793888326; h=from:subject:date:message-id:to:cc:mime-version:content-type: content-transfer-encoding:in-reply-to:references; bh=Y9b+JrERidHv/i6uHSmwP7mcFflQFCEPpmeC6r2GjK8=; b=Xyo7Fo4xP72axvxXROt5+8j/+w2eeYzu9BS8ytlIlit5vhZlzFDTnAvYGYMMX/wLQvN/0e v6tIsRvurD1KzDD6GoF9z7JcMKrBDTWqHV+HmlRoc2xTRh/q8fSclrHORr3TDJc875dPP6 jQGfsuUTuViC94NquXJWJM9g85rH55aP+h/QjwaY2wvLlc7KeGifh4lxhynP1KwUNf3/bW pdXxkrPJC4Ed68B4tUXthOFIyT2pvgmzrMW1993OlApxsex3dQbb8atM1rtInEd09A4E0p FYjF/DHaNj/F9kW+zZqIRE/yYMQbD6JgXyd4xOXk3CPDrlmQQ7rS7ichANjNoQ== From: =?utf-8?q?Jo=C3=A3o_Marcos_Costa_=28Schneider_Electric=29?= To: openembedded-core@lists.openembedded.org Cc: thomas.petazzoni@bootlin.com, yoann.congal@smile.fr, =?utf-8?q?Jo=C3=A3o?= =?utf-8?q?_Marcos_Costa_=28Schneider_Electric=29?= Subject: [scarthgap][PATCH 1/3] sqlite3: fix CVE-2026-119373 Date: Thu, 5 Nov 2026 15:18:25 +0100 Message-ID: <20261105141827.2142719-2-joaomarcos.costa@bootlin.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20261105141827.2142719-1-joaomarcos.costa@bootlin.com> References: <20261105141827.2142719-1-joaomarcos.costa@bootlin.com> MIME-Version: 1.0 X-Last-TLS-Session-Version: TLSv1.3 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 05 Nov 2026 14:18:58 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249554 This vulnerability, marked as High [1], was fixed upstream [2] since 3.54.0. Backport the fix to sqlite v3.45.3. [1] https://nvd.nist.gov/vuln/detail/cve-2026-119373 [2] https://github.com/sqlite/sqlite/commit/e1c9934f9f11a499029abb020ea715a08970da80 Signed-off-by: João Marcos Costa (Schneider Electric) --- .../sqlite/sqlite3/CVE-2026-119373.patch | 48 +++++++++++++++++++ meta/recipes-support/sqlite/sqlite3_3.45.3.bb | 3 +- 2 files changed, 50 insertions(+), 1 deletion(-) create mode 100644 meta/recipes-support/sqlite/sqlite3/CVE-2026-119373.patch diff --git a/meta/recipes-support/sqlite/sqlite3/CVE-2026-119373.patch b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119373.patch new file mode 100644 index 0000000000..ff89746e6c --- /dev/null +++ b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119373.patch @@ -0,0 +1,48 @@ +From ab37658e91b4a19923eb930a9e2ee62b561a4ec6 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Jo=C3=A3o=20Marcos=20Costa?= +Date: Wed, 4 Nov 2026 16:38:46 +0100 +Subject: [PATCH] In fts5, account for the possibility of negative docids when + allocating a buffer to store the results of merging detail=none prefix lists. + Fix for report [bugs:/info/2026-08-04T08:49:27Z | 2026-08-04T08:49:27Z]. +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +FossilOrigin-Name: a7f8c92f623e9cbe8a61266d949916acc9e5110c94dff4aa6fd1ad2ea8a60d4e + +CVE: CVE-2026-119373 +Upstream-Status: Backport [https://github.com/sqlite/sqlite/commit/e1c9934f9f11a499029abb020ea715a08970da80] + +Signed-off-by: João Marcos Costa +--- + sqlite3.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/sqlite3.c b/sqlite3.c +index 6acf46a..2b1e6b9 100644 +--- a/sqlite3.c ++++ b/sqlite3.c +@@ -244805,7 +244805,7 @@ static void fts5MergeRowidLists( + (void)nBuf; + memset(&out, 0, sizeof(out)); + assert( nBuf==1 ); +- sqlite3Fts5BufferSize(&p->rc, &out, p1->n + p2->n); ++ sqlite3Fts5BufferSize(&p->rc, &out, p1->n + p2->n + 9); + if( p->rc ) return; + + fts5NextRowid(p1, &i1, &iRowid1); +@@ -244813,12 +244813,12 @@ static void fts5MergeRowidLists( + while( i1>=0 || i2>=0 ){ + if( i1>=0 && (i2<0 || iRowid1iOut ); +- fts5BufferSafeAppendVarint(&out, iRowid1 - iOut); ++ fts5BufferSafeAppendVarint(&out, (u64)iRowid1 - (u64)iOut); + iOut = iRowid1; + fts5NextRowid(p1, &i1, &iRowid1); + }else{ + assert( iOut==0 || iRowid2>iOut ); +- fts5BufferSafeAppendVarint(&out, iRowid2 - iOut); ++ fts5BufferSafeAppendVarint(&out, (u64)iRowid2 - (u64)iOut); + iOut = iRowid2; + if( i1>=0 && iRowid1==iRowid2 ){ + fts5NextRowid(p1, &i1, &iRowid1); diff --git a/meta/recipes-support/sqlite/sqlite3_3.45.3.bb b/meta/recipes-support/sqlite/sqlite3_3.45.3.bb index 975f3bdab8..e7c5bcdac4 100644 --- a/meta/recipes-support/sqlite/sqlite3_3.45.3.bb +++ b/meta/recipes-support/sqlite/sqlite3_3.45.3.bb @@ -10,6 +10,7 @@ SRC_URI = "http://www.sqlite.org/2024/sqlite-autoconf-${SQLITE_PV}.tar.gz \ file://CVE-2025-7709.patch \ file://CVE-2025-70873.patch \ file://CVE-2026-11822_CVE-2026-11824.patch \ - " + file://CVE-2026-119373.patch \ +" SRC_URI[sha256sum] = "b2809ca53124c19c60f42bf627736eae011afdcc205bb48270a5ee9a38191531" From patchwork Thu Nov 5 14:18:26 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Jo=C3=A3o_Marcos_Costa_=28Schneider_Electric=29?= X-Patchwork-Id: 103148 Received: from smtpout-02.galae.net (smtpout-02.galae.net [185.246.84.56]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.35396.1793888330180153991 for ; Thu, 05 Nov 2026 06:18:50 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@bootlin.com header.s=dkim header.b=j1lEcjBf; spf=pass (domain: bootlin.com, ip: 185.246.84.56, mailfrom: joaomarcos.costa@bootlin.com) Received: from smtpout-01.galae.net (smtpout-01.galae.net [212.83.139.233]) by smtpout-02.galae.net (Postfix) with ESMTPS id 843F21A09F3 for ; Thu, 5 Nov 2026 14:18:48 +0000 (UTC) Received: from mail.galae.net (mail.galae.net [212.83.136.155]) by smtpout-01.galae.net (Postfix) with ESMTPS id 5356B5FF85; Thu, 5 Nov 2026 14:18:48 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) by localhost (Mailerdaemon) with ESMTPSA id 7689A103292A7; Thu, 5 Nov 2026 15:18:47 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bootlin.com; s=dkim; t=1793888327; h=from:subject:date:message-id:to:cc:mime-version:content-type: content-transfer-encoding:in-reply-to:references; bh=QoDkQYXwu+B6safCUHGwuUs/RJTksA/BcWQ0WdXxZBo=; b=j1lEcjBfXa2b/fWpC2ViYyk81hEQhwzjs3ptBHeFsiSuS0ovI2Rbt0jeoRkiwhWp7T31Xo MMqnrDJcMbhsIiGIeyRS7h7RHBuQkKOn8A0bjs+0r/089wnOnYjSN6nZq2uzyU7rVPgcV1 s32D64+zaG6V25NOL2GT/xqHiGQ1F3eIgjo2GcgUzWI1kgP78i0iJLRmJn7PEM4SATKcAY 8KtY2kPHJ6T+j+IkEHRJ+MRffvcnsxwDmuLwAyIPiXdJHKrucAPHszBcuc36rdcjehQCMn w23mPQpEBy0K6+4IaATdKCDHDTYxc9el+y9ohgYfsbwCSE22j9ZYL1iBBjlatg== From: =?utf-8?q?Jo=C3=A3o_Marcos_Costa_=28Schneider_Electric=29?= To: openembedded-core@lists.openembedded.org Cc: thomas.petazzoni@bootlin.com, yoann.congal@smile.fr, =?utf-8?q?Jo=C3=A3o?= =?utf-8?q?_Marcos_Costa_=28Schneider_Electric=29?= Subject: [scarthgap][PATCH 2/3] sqlite3: fix CVE-2026-119374 Date: Thu, 5 Nov 2026 15:18:26 +0100 Message-ID: <20261105141827.2142719-3-joaomarcos.costa@bootlin.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20261105141827.2142719-1-joaomarcos.costa@bootlin.com> References: <20261105141827.2142719-1-joaomarcos.costa@bootlin.com> MIME-Version: 1.0 X-Last-TLS-Session-Version: TLSv1.3 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 05 Nov 2026 14:18:58 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249555 This vulnerability, marked as High [1], was fixed upstream [2] since 3.54.0. Backport the fix to sqlite v3.45.3. Some function/macro definitions are required to compile the backported code, and they are provided in the *-pre.patch. [1] https://nvd.nist.gov/vuln/detail/cve-2026-119374 [2] https://github.com/sqlite/sqlite/commit/d9de6eedbe918c074c7556400fa21df5960704d9 Signed-off-by: João Marcos Costa (Schneider Electric) --- .../sqlite/sqlite3/CVE-2026-119374-pre.patch | 73 +++++++++++++++++++ .../sqlite/sqlite3/CVE-2026-119374.patch | 67 +++++++++++++++++ meta/recipes-support/sqlite/sqlite3_3.45.3.bb | 2 + 3 files changed, 142 insertions(+) create mode 100644 meta/recipes-support/sqlite/sqlite3/CVE-2026-119374-pre.patch create mode 100644 meta/recipes-support/sqlite/sqlite3/CVE-2026-119374.patch diff --git a/meta/recipes-support/sqlite/sqlite3/CVE-2026-119374-pre.patch b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119374-pre.patch new file mode 100644 index 0000000000..1192cef006 --- /dev/null +++ b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119374-pre.patch @@ -0,0 +1,73 @@ +From 315df7b9dc2ac2abc55c3636439fd532e3090ef6 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Jo=C3=A3o=20Marcos=20Costa?= +Date: Thu, 5 Nov 2026 11:48:59 +0100 +Subject: [PATCH] sqlite3.c: add fts5IndexCorrupt* and FTS5_CORRUPT_* helpers +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +These functions/macros come from multiple upstream commits, and are required by +the backport for CVE-2026-119374. + +Upstream-Status: Backport [multiple changes from v3.54.1] + +Signed-off-by: João Marcos Costa +--- + sqlite3.c | 44 ++++++++++++++++++++++++++++++++++++++++++++ + 1 file changed, 44 insertions(+) + +diff --git a/sqlite3.c b/sqlite3.c +index 2b1e6b9..4d0513e 100644 +--- a/sqlite3.c ++++ b/sqlite3.c +@@ -239371,6 +239371,50 @@ struct Fts5SegIter { + u8 bDel; /* True if the delete flag is set */ + }; + ++void sqlite3Fts5ConfigErrmsg(Fts5Config *pConfig, const char *zFmt, ...){ ++ va_list ap; /* ... printf arguments */ ++ char *zMsg = 0; ++ ++ va_start(ap, zFmt); ++ zMsg = sqlite3_vmprintf(zFmt, ap); ++ if( pConfig->pzErrmsg ){ ++ *pConfig->pzErrmsg = zMsg; ++ }else{ ++ sqlite3_free(zMsg); ++ } ++ ++ va_end(ap); ++} ++ ++static int fts5IndexCorruptRowid(Fts5Index *pIdx, i64 iRowid){ ++ pIdx->rc = FTS5_CORRUPT; ++ sqlite3Fts5ConfigErrmsg(pIdx->pConfig, ++ "fts5: corruption found reading blob %lld from table \"%s\"", ++ iRowid, pIdx->pConfig->zName ++ ); ++ return SQLITE_CORRUPT_VTAB; ++} ++#define FTS5_CORRUPT_ROWID(pIdx, iRowid) fts5IndexCorruptRowid(pIdx, iRowid) ++ ++static int fts5IndexCorruptIter(Fts5Index *pIdx, Fts5SegIter *pIter){ ++ pIdx->rc = FTS5_CORRUPT; ++ sqlite3Fts5ConfigErrmsg(pIdx->pConfig, ++ "fts5: corruption on page %d, segment %d, table \"%s\"", ++ pIter->iLeafPgno, pIter->pSeg->iSegid, pIdx->pConfig->zName ++ ); ++ return SQLITE_CORRUPT_VTAB; ++} ++#define FTS5_CORRUPT_ITER(pIdx, pIter) fts5IndexCorruptIter(pIdx, pIter) ++ ++static int fts5IndexCorruptIdx(Fts5Index *pIdx){ ++ pIdx->rc = FTS5_CORRUPT; ++ sqlite3Fts5ConfigErrmsg(pIdx->pConfig, ++ "fts5: corruption in table \"%s\"", pIdx->pConfig->zName ++ ); ++ return SQLITE_CORRUPT_VTAB; ++} ++#define FTS5_CORRUPT_IDX(pIdx) fts5IndexCorruptIdx(pIdx) ++ + /* + ** Array of tombstone pages. Reference counted. + */ diff --git a/meta/recipes-support/sqlite/sqlite3/CVE-2026-119374.patch b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119374.patch new file mode 100644 index 0000000000..1ea9f2d1ee --- /dev/null +++ b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119374.patch @@ -0,0 +1,67 @@ +From 68bb719b1c9aba46b0de9464c5c1ef5f76aab9d8 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Jo=C3=A3o=20Marcos=20Costa?= +Date: Wed, 4 Nov 2026 17:07:06 +0100 +Subject: [PATCH] Fix a problem in fts5 secure-delete code that could lead to a + buffer overrun when dealing with a strategically corrupted database. Problem + reported by YEONBA. +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +FossilOrigin-Name: 9cd4f9e9205c5a5096388397a39349db9ff5377d19095c6b20388ff799969c31 + +CVE: CVE-2026-119374 +Upstream-Status: Backport [https://github.com/sqlite/sqlite/commit/d9de6eedbe918c074c7556400fa21df5960704d9] + +Signed-off-by: João Marcos Costa +--- + sqlite3.c | 17 +++++++++++------ + 1 file changed, 11 insertions(+), 6 deletions(-) + +diff --git a/sqlite3.c b/sqlite3.c +index 4d0513e..3ba2e27 100644 +--- a/sqlite3.c ++++ b/sqlite3.c +@@ -244287,31 +244287,36 @@ static void fts5DoSecureDelete( + const int nMove = nPg - iNextOff; /* Number of bytes to move */ + int nShift = iNextOff - iOff; /* Distance to move them */ + ++ int nNewPg = 0; + int iPrevKeyOut = 0; +- int iKeyIn = 0; ++ i64 iKeyIn = 0; + + memmove(&aPg[iOff], &aPg[iNextOff], nMove); + iPgIdx -= nShift; +- nPg = iPgIdx; ++ nNewPg = iPgIdx; + fts5PutU16(&aPg[2], iPgIdx); + + for(iIdx=0; iIdxnPg ){ ++ FTS5_CORRUPT_IDX(p); ++ break; ++ } + if( iKeyIn!=iDelKeyOff ){ + int iKeyOut = (iKeyIn - (iKeyIn>iOff ? nShift : 0)); +- nPg += sqlite3Fts5PutVarint(&aPg[nPg], iKeyOut - iPrevKeyOut); ++ nNewPg += sqlite3Fts5PutVarint(&aPg[nNewPg], iKeyOut - iPrevKeyOut); + iPrevKeyOut = iKeyOut; + } + } + +- if( iPgIdx==nPg && nIdx>0 && pSeg->iLeafPgno!=1 ){ ++ if( p->rc==SQLITE_OK && iPgIdx==nNewPg && nIdx>0 && pSeg->iLeafPgno!=1 ){ + fts5SecureDeleteIdxEntry(p, iSegid, pSeg->iLeafPgno); + } + +- assert_nc( nPg>4 || fts5GetU16(aPg)==0 ); +- fts5DataWrite(p, FTS5_SEGMENT_ROWID(iSegid,pSeg->iLeafPgno), aPg, nPg); ++ assert_nc( nNewPg>4 || fts5GetU16(aPg)==0 ); ++ fts5DataWrite(p, FTS5_SEGMENT_ROWID(iSegid,pSeg->iLeafPgno), aPg, nNewPg); + } + sqlite3_free(aIdx); + } diff --git a/meta/recipes-support/sqlite/sqlite3_3.45.3.bb b/meta/recipes-support/sqlite/sqlite3_3.45.3.bb index e7c5bcdac4..5d70e765e5 100644 --- a/meta/recipes-support/sqlite/sqlite3_3.45.3.bb +++ b/meta/recipes-support/sqlite/sqlite3_3.45.3.bb @@ -11,6 +11,8 @@ SRC_URI = "http://www.sqlite.org/2024/sqlite-autoconf-${SQLITE_PV}.tar.gz \ file://CVE-2025-70873.patch \ file://CVE-2026-11822_CVE-2026-11824.patch \ file://CVE-2026-119373.patch \ + file://CVE-2026-119374-pre.patch \ + file://CVE-2026-119374.patch \ " SRC_URI[sha256sum] = "b2809ca53124c19c60f42bf627736eae011afdcc205bb48270a5ee9a38191531" From patchwork Thu Nov 5 14:18:27 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Jo=C3=A3o_Marcos_Costa_=28Schneider_Electric=29?= X-Patchwork-Id: 103149 Received: from smtpout-03.galae.net (smtpout-03.galae.net [185.246.85.4]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.35397.1793888332309865189 for ; Thu, 05 Nov 2026 06:18:52 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@bootlin.com header.s=dkim header.b=wv9yEvUD; spf=pass (domain: bootlin.com, ip: 185.246.85.4, mailfrom: joaomarcos.costa@bootlin.com) Received: from smtpout-01.galae.net (smtpout-01.galae.net [212.83.139.233]) by smtpout-03.galae.net (Postfix) with ESMTPS id 642134E40826; Thu, 5 Nov 2026 14:18:50 +0000 (UTC) Received: from mail.galae.net (mail.galae.net [212.83.136.155]) by smtpout-01.galae.net (Postfix) with ESMTPS id 39FB45FF85; Thu, 5 Nov 2026 14:18:50 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) by localhost (Mailerdaemon) with ESMTPSA id 28409103291F9; Thu, 5 Nov 2026 15:18:48 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bootlin.com; s=dkim; t=1793888329; h=from:subject:date:message-id:to:cc:mime-version:content-type: content-transfer-encoding:in-reply-to:references; bh=DVePOTE8DI9hhVTFVw389vu9T3ZkmDOJ/7lqmuljy7s=; b=wv9yEvUDwUth4rdFlPkx21+eg69ViTNkihLQPgq521kaV2ORrABUrp05I38wMvD3zAd2Zd 4HaSumli1p18mE0lZT2+v3rcPEB7yjm+ccexzoF4qGZOCeaJ56QKepAi7EirX4TiWMsDJo 3jL+mS6Vb6lXtfuiHOuXmYlf6K5a9nTOaP4okupDf5uqaRNNhkzJss4bPjM2FcJTWlscFq jSU1CIP5Tzou73vfNaolcw4FvCmj+VzKe9DAhh1/B2MzmEv5PqXGD+UsQ3i82iFkTY5t9G +J6PpvYvb3NJ2SkuTAggtJf4tMkpQ8eix/+PP735u3WCfzpSjSSSQv+IUo7hnQ== From: =?utf-8?q?Jo=C3=A3o_Marcos_Costa_=28Schneider_Electric=29?= To: openembedded-core@lists.openembedded.org Cc: thomas.petazzoni@bootlin.com, yoann.congal@smile.fr, =?utf-8?q?Jo=C3=A3o?= =?utf-8?q?_Marcos_Costa_=28Schneider_Electric=29?= Subject: [scarthgap][PATCH 3/3] sqlite3: fix CVE-2026-119379 Date: Thu, 5 Nov 2026 15:18:27 +0100 Message-ID: <20261105141827.2142719-4-joaomarcos.costa@bootlin.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20261105141827.2142719-1-joaomarcos.costa@bootlin.com> References: <20261105141827.2142719-1-joaomarcos.costa@bootlin.com> MIME-Version: 1.0 X-Last-TLS-Session-Version: TLSv1.3 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 05 Nov 2026 14:18:58 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249556 This vulnerability, marked as High [1], was fixed upstream [2] since 3.54.0. Backport the fix to sqlite v3.45.3. [1] https://nvd.nist.gov/vuln/detail/cve-2026-119379 [2] https://github.com/sqlite/sqlite/commit/64459c87cc702d600704fb77ee40ca1782398a52 Signed-off-by: João Marcos Costa (Schneider Electric) --- .../sqlite/sqlite3/CVE-2026-119379.patch | 70 +++++++++++++++++++ meta/recipes-support/sqlite/sqlite3_3.45.3.bb | 1 + 2 files changed, 71 insertions(+) create mode 100644 meta/recipes-support/sqlite/sqlite3/CVE-2026-119379.patch diff --git a/meta/recipes-support/sqlite/sqlite3/CVE-2026-119379.patch b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119379.patch new file mode 100644 index 0000000000..4ecf538690 --- /dev/null +++ b/meta/recipes-support/sqlite/sqlite3/CVE-2026-119379.patch @@ -0,0 +1,70 @@ +From 7ced15a861a05e25f5a8ad29d0dca95806af3a9e Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Jo=C3=A3o=20Marcos=20Costa?= +Date: Thu, 5 Nov 2026 12:06:23 +0100 +Subject: [PATCH] Avoid a buffer overrun when processing a strategically + corrupted changeset. Report [bugs:/info/2026-08-16T10:15:25Z | + 2026-08-16T10:15:25Z]. +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +FossilOrigin-Name: 3f57024aecea0f3b565ed823cf94b085031c481fd6323c1f2e4319a53500864f + +CVE: CVE-2026-119379 +Upstream-Status: Backport [https://github.com/sqlite/sqlite/commit/64459c87cc702d600704fb77ee40ca1782398a52] + +Signed-off-by: João Marcos Costa +--- + sqlite3.c | 9 ++++----- + 1 file changed, 4 insertions(+), 5 deletions(-) + +diff --git a/sqlite3.c b/sqlite3.c +index 3ba2e27..9f4fe9d 100644 +--- a/sqlite3.c ++++ b/sqlite3.c +@@ -228393,9 +228393,9 @@ static int sessionChangesetApply( + int schemaMismatch = 0; + int rc = SQLITE_OK; /* Return code */ + const char *zTab = 0; /* Name of current table */ +- int nTab = 0; /* Result of sqlite3Strlen30(zTab) */ + SessionApplyCtx sApply; /* changeset_apply() context object */ + int bPatchset; ++ int bNew = 0; /* True for first entry of new table */ + + assert( xConflict!=0 ); + +@@ -228411,15 +228411,16 @@ static int sessionChangesetApply( + if( rc==SQLITE_OK ){ + rc = sqlite3_exec(db, "PRAGMA defer_foreign_keys = 1", 0, 0, 0); + } +- while( rc==SQLITE_OK && SQLITE_ROW==sqlite3changeset_next(pIter) ){ ++ while( rc==SQLITE_OK && SQLITE_ROW==sessionChangesetNext(pIter, 0, 0,&bNew) ){ + int nCol; + int op; + const char *zNew; + + sqlite3changeset_op(pIter, &zNew, &nCol, &op, 0); + +- if( zTab==0 || sqlite3_strnicmp(zNew, zTab, nTab+1) ){ ++ if( bNew ){ + u8 *abPK; ++ bNew = 0; + + rc = sessionRetryConstraints( + db, pIter->bPatchset, zTab, &sApply, xConflict, pCtx +@@ -228454,7 +228455,6 @@ static int sessionChangesetApply( + rc = SQLITE_NOMEM; + break; + } +- nTab = (int)strlen(zTab); + sApply.azCol = (const char **)zTab; + }else{ + int nMinCol = 0; +@@ -228506,7 +228506,6 @@ static int sessionChangesetApply( + sApply.bStat1 = 0; + } + } +- nTab = sqlite3Strlen30(zTab); + } + } + diff --git a/meta/recipes-support/sqlite/sqlite3_3.45.3.bb b/meta/recipes-support/sqlite/sqlite3_3.45.3.bb index 5d70e765e5..97f81a6b17 100644 --- a/meta/recipes-support/sqlite/sqlite3_3.45.3.bb +++ b/meta/recipes-support/sqlite/sqlite3_3.45.3.bb @@ -13,6 +13,7 @@ SRC_URI = "http://www.sqlite.org/2024/sqlite-autoconf-${SQLITE_PV}.tar.gz \ file://CVE-2026-119373.patch \ file://CVE-2026-119374-pre.patch \ file://CVE-2026-119374.patch \ + file://CVE-2026-119379.patch \ " SRC_URI[sha256sum] = "b2809ca53124c19c60f42bf627736eae011afdcc205bb48270a5ee9a38191531"