1. photon
  2. Commit ec2dcbcd1224b78a80f33606bf4b4d2fc78cdb38
Browse code

sqlite: patched CVE-2023-7104

The upstream patch: https://sqlite.org/src/info/0e4e7a05c4204b47
is not directly applicable to the source that we are consuming because
Expected source: https://www.sqlite.org/src/tarball/sqlite.tar.gz?r=release
But we are consuming: https://sqlite.org/2022/sqlite-autoconf-%{sourcever}.tar.gz

So the patch had to be modified.
The upstream patch involves 2 code changes.

Change1: code change to mitigate the vulnerability - Implemented in our patch

Change2: test code - Not implemented in our patch as the required test code to be patched is not found in the source we are consuming

Change-Id: Ie02b8cb1a8ceaf305d3ab69a8d61994e2f333823
Reviewed-on: http://photon-jenkins.eng.vmware.com:8082/c/photon/+/23040
Tested-by: Shreenidhi Shedi <shreenidhi.shedi@broadcom.com>
Reviewed-by: Shreenidhi Shedi <shreenidhi.shedi@broadcom.com>

Srish Srinivasan authored on 2024/01/09 15:47:58
Showing 2 changed files
SPECS/sqlite/CVE-2023-7104.patch
History View file @ ec2dcbc
1 1 
new file mode 100644
... ... 
@@ -0,0 +1,57 @@
0 
+From 09f1652f36c5c4e8a6a640ce887f9ea0f48a7958 Mon Sep 17 00:00:00 2001
1 
+From: dan <Dan Kennedy>
2 
+Date: Thu, 7 Sep 2023 13:53:09 +0000
3 
+Subject: [PATCH] Fix a buffer overread in the sessions extension that could
4 
+ occur when processing a corrupt changeset.
5 
+
6 
+FossilOrigin-Name: 0e4e7a05c4204b47a324d67e18e76d2a98e26b2723d19d5c655ec9fd2e41f4b7
7 
+
8 
+The upstream patch: https://sqlite.org/src/info/0e4e7a05c4204b47
9 
+is not directly applicable to the source that we are consuming because
10 
+Expected source: https://www.sqlite.org/src/tarball/sqlite.tar.gz?r=release
11 
+But we are consuming: https://sqlite.org/2022/sqlite-autoconf-%{sourcever}.tar.gz
12 
+
13 
+So the patch had to be modified.
14 
+The upstream patch involves 2 code changes.
15 
+
16 
+Change1: code change to mitigate the vulnerability - Implemented in our patch
17 
+Change2: a test to check if the vulnerability still exists - Not implemented in our patch as the required test file to be patched is not found in the source we are consuming
18 
+
19 
+Signed-off-by: Srish Srinivasan <ssrish@vmware.com>
20 
+---
21 
+ sqlite3.c | 18 +++++++++++-------
22 
+ 1 file changed, 11 insertions(+), 7 deletions(-)
23 
+
24 
+diff --git a/sqlite3.c b/sqlite3.c
25 
+index eb8d7d5..c8a3002 100644
26 
+--- a/sqlite3.c
27 
+@@ -213481,15 +213481,19 @@ static int sessionReadRecord(
28 
+         }
29 
+       }
30 
+       if( eType==SQLITE_INTEGER || eType==SQLITE_FLOAT ){
31 
+-        sqlite3_int64 v = sessionGetI64(aVal);
32 
+-        if( eType==SQLITE_INTEGER ){
33 
+-          sqlite3VdbeMemSetInt64(apOut[i], v);
34 
++        if( (pIn->nData-pIn->iNext)<8 ){
35 
++          rc = SQLITE_CORRUPT_BKPT;
36 
+         }else{
37 
+-          double d;
38 
+-          memcpy(&d, &v, 8);
39 
+-          sqlite3VdbeMemSetDouble(apOut[i], d);
40 
++          sqlite3_int64 v = sessionGetI64(aVal);
41 
++          if( eType==SQLITE_INTEGER ){
42 
++            sqlite3VdbeMemSetInt64(apOut[i], v);
43 
++          }else{
44 
++            double d;
45 
++            memcpy(&d, &v, 8);
46 
++            sqlite3VdbeMemSetDouble(apOut[i], d);
47 
++          }
48 
++          pIn->iNext += 8;
49 
+         }
50 
+-        pIn->iNext += 8;
51 
+       }
52 
+     }
53 
+   }
54 
+--
55 
+2.35.6
SPECS/sqlite/sqlite.spec
History View file @ ec2dcbc
... ... 
@@ -3,7 +3,7 @@
3 3 
 Summary:        A portable, high level programming interface to various calling conventions
4 4 
 Name:           sqlite
5 5 
 Version:        3.40.1
6 
-Release:        1%{?dist}
6 
+Release:        2%{?dist}
7 7 
 License:        Public Domain
8 8 
 URL:            http://www.sqlite.org
9 9 
 Group:          System Environment/GeneralLibraries
... ... 
@@ -13,6 +13,8 @@ Distribution:   Photon
13 13 
 Source0: http://sqlite.org/2022/%{name}-autoconf-%{sourcever}.tar.gz
14 14 
 %define sha512 %{name}=50ff85b40b0017a73b52988843ec439358a8dde7d5d012a33ecfdaa67006697692f091a62d5f052f64e6fee84e27251864d331f63039a326ae4d5bf4a4dd5a91
15 15
16 
+Patch0:         CVE-2023-7104.patch
17 
+
16 18 
 Obsoletes:      sqlite-autoconf
17 19 
 Obsoletes:      sqlite-devel <= 3.27.2-5
18 20 
 Requires:       sqlite-libs = %{version}-%{release}
... ... 
@@ -93,6 +95,8 @@ rm -rf %{buildroot}/*
93 93 
 %{_libdir}/libsqlite3.so.0
94 94
95 95 
 %changelog
96 
+* Tue Jan 09 2024 Srish Srinivasan <srish.srinivasan@broadcom.com> 3.40.1-2
97 
+- Patched CVE-2023-7104
96 98 
 * Wed Jan 11 2023 Oliver Kurth <okurth@vmware.com> 3.40.1-1
97 99 
 - bump version to 3.40.1
98 100 
 * Wed Dec 21 2022 Shreenidhi Shedi <sshedi@vmware.com> 3.39.4-2