From c4c282f8ec2bec752ca41f4cfebe3c34f45ffade Mon Sep 17 00:00:00 2001 From: Titouan Christophe Date: Wed, 3 Sep 2025 14:42:29 +0200 Subject: [PATCH] package/sqlite: add patch for CVE-2025-6965 This fixes the following vulnerability: - CVE-2025-6965: There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. This could lead to a memory corruption issue. We recommend upgrading to version 3.50.2 or above. https://www.cve.org/CVERecord?id=CVE-2025-6965 Signed-off-by: Titouan Christophe Signed-off-by: Peter Korsgaard --- ...se-error-if-too-many-aggregate-terms.patch | 123 ++++++++++++++++++ package/sqlite/sqlite.mk | 2 + 2 files changed, 125 insertions(+) create mode 100644 package/sqlite/0003-Raise-error-if-too-many-aggregate-terms.patch diff --git a/package/sqlite/0003-Raise-error-if-too-many-aggregate-terms.patch b/package/sqlite/0003-Raise-error-if-too-many-aggregate-terms.patch new file mode 100644 index 0000000000..43be545b83 --- /dev/null +++ b/package/sqlite/0003-Raise-error-if-too-many-aggregate-terms.patch @@ -0,0 +1,123 @@ +From 1cbb088f4be95e7a02627f64de60653ef2b13ab5 Mon Sep 17 00:00:00 2001 +From: drh <> +Date: Sun, 16 Feb 2025 10:57:25 +0000 +Subject: [PATCH] Raise an error right away if the number of aggregate terms in a query exceeds the maximum number of columns. + +CVE: CVE-2025-6965 + +For more info see https://nvd.nist.gov/vuln/detail/CVE-2025-6965 + +Upstream: https://www.sqlite.org/src/vinfo/5508b56fd24016c13981ec280ecdd833007c9d8dd595edb295b984c2b487b5c8 + +[Titouan: adapt to sqlite3 "amalgamation" source code] +Signed-off-by: Titouan Christophe +--- + sqlite3.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sqlite3.c b/sqlite3.c +index 80433f6..8a43734 100644 +--- a/sqlite3.c 2025-09-03 13:04:29.799853238 +0200 ++++ b/sqlite3.c 2025-09-03 13:47:54.274155427 +0200 +@@ -20,7 +20,7 @@ + ** The content in this amalgamation comes from Fossil check-in + ** d2fe6b05f38d9d7cd78c5d252e99ac59f1ae with changes in files: + ** +-** ++** + */ + #ifndef SQLITE_AMALGAMATION + #define SQLITE_CORE 1 +@@ -15258,6 +15258,14 @@ + #define SMALLEST_INT64 (((i64)-1) - LARGEST_INT64) + + /* ++** Macro SMXV(n) return the maximum value that can be held in variable n, ++** assuming n is a signed integer type. UMXV(n) is similar for unsigned ++** integer types. ++*/ ++#define SMXV(n) ((((i64)1)<<(sizeof(n)*8-1))-1) ++#define UMXV(n) ((((i64)1)<<(sizeof(n)*8))-1) ++ ++/* + ** Round up a number to the next larger multiple of 8. This is used + ** to force 8-byte alignment on 64-bit architectures. + ** +@@ -19046,7 +19054,7 @@ + ** from source tables rather than from accumulators */ + u8 useSortingIdx; /* In direct mode, reference the sorting index rather + ** than the source table */ +- u16 nSortingColumn; /* Number of columns in the sorting index */ ++ u32 nSortingColumn; /* Number of columns in the sorting index */ + int sortingIdx; /* Cursor number of the sorting index */ + int sortingIdxPTab; /* Cursor number of pseudo-table */ + int iFirstReg; /* First register in range for aCol[] and aFunc[] */ +@@ -19055,8 +19063,8 @@ + Table *pTab; /* Source table */ + Expr *pCExpr; /* The original expression */ + int iTable; /* Cursor number of the source table */ +- i16 iColumn; /* Column number within the source table */ +- i16 iSorterColumn; /* Column number in the sorting index */ ++ int iColumn; /* Column number within the source table */ ++ int iSorterColumn; /* Column number in the sorting index */ + } *aCol; + int nColumn; /* Number of used entries in aCol[] */ + int nAccumulator; /* Number of columns that show through to the output. +@@ -116445,7 +116453,9 @@ + ){ + struct AggInfo_col *pCol; + int k; ++ int mxTerm = pParse->db->aLimit[SQLITE_LIMIT_COLUMN]; + ++ assert( mxTerm <= SMXV(i16) ); + assert( pAggInfo->iFirstReg==0 ); + pCol = pAggInfo->aCol; + for(k=0; knColumn; k++, pCol++){ +@@ -116463,6 +116473,10 @@ + assert( pParse->db->mallocFailed ); + return; + } ++ if( k>mxTerm ){ ++ sqlite3ErrorMsg(pParse, "more than %d aggregate terms", mxTerm); ++ k = mxTerm; ++ } + pCol = &pAggInfo->aCol[k]; + assert( ExprUseYTab(pExpr) ); + pCol->pTab = pExpr->y.pTab; +@@ -116496,6 +116510,7 @@ + if( pExpr->op==TK_COLUMN ){ + pExpr->op = TK_AGG_COLUMN; + } ++ assert( k <= SMXV(pExpr->iAgg) ); + pExpr->iAgg = (i16)k; + } + +@@ -116580,13 +116595,19 @@ + ** function that is already in the pAggInfo structure + */ + struct AggInfo_func *pItem = pAggInfo->aFunc; ++ int mxTerm = pParse->db->aLimit[SQLITE_LIMIT_COLUMN]; ++ assert( mxTerm <= SMXV(i16) ); + for(i=0; inFunc; i++, pItem++){ + if( NEVER(pItem->pFExpr==pExpr) ) break; + if( sqlite3ExprCompare(0, pItem->pFExpr, pExpr, -1)==0 ){ + break; + } + } +- if( i>=pAggInfo->nFunc ){ ++ if( i>mxTerm ){ ++ sqlite3ErrorMsg(pParse, "more than %d aggregate terms", mxTerm); ++ i = mxTerm; ++ assert( inFunc ); ++ }else if( i>=pAggInfo->nFunc ){ + /* pExpr is original. Make a new entry in pAggInfo->aFunc[] + */ + u8 enc = ENC(pParse->db); +@@ -116640,6 +116661,7 @@ + */ + assert( !ExprHasProperty(pExpr, EP_TokenOnly|EP_Reduced) ); + ExprSetVVAProperty(pExpr, EP_NoReduce); ++ assert( i <= SMXV(pExpr->iAgg) ); + pExpr->iAgg = (i16)i; + pExpr->pAggInfo = pAggInfo; + return WRC_Prune; diff --git a/package/sqlite/sqlite.mk b/package/sqlite/sqlite.mk index 4f4bc9d3af..29ebb0365d 100644 --- a/package/sqlite/sqlite.mk +++ b/package/sqlite/sqlite.mk @@ -15,6 +15,8 @@ SQLITE_INSTALL_STAGING = YES # 0002-Add-a-typecast-to-avoid-32-bit-integer-overflow-in-t.patch SQLITE_IGNORE_CVES = CVE-2025-29087 CVE-2025-3277 +# 0003-Raise-error-if-too-many-aggregate-terms.patch +SQLITE_IGNORE_CVES += CVE-2025-6965 ifeq ($(BR2_PACKAGE_SQLITE_STAT4),y) SQLITE_CFLAGS += -DSQLITE_ENABLE_STAT4