!64 [sync] PR-60: 修复 CVE-2022-35737

From: @openeuler-sync-bot 
Reviewed-by: @bzhaoop 
Signed-off-by: @bzhaoop

0003-CVE-2021-36690.patch

@@ -0,0 +1,44 @@
+diff -rNu a/ext/expert/sqlite3expert.c b/ext/expert/sqlite3expert.c
+--- a/ext/expert/sqlite3expert.c	2021-11-25 09:00:19.267831518 +0800
++++ b/ext/expert/sqlite3expert.c	2021-11-25 09:07:38.551969861 +0800
+@@ -690,11 +690,13 @@
+   rc = idxPrintfPrepareStmt(db, &p1, pzErrmsg, "PRAGMA table_xinfo=%Q", zTab);
+   while( rc==SQLITE_OK && SQLITE_ROW==sqlite3_step(p1) ){
+     const char *zCol = (const char*)sqlite3_column_text(p1, 1);
++    const char *zColSeq = 0;
+     nByte += 1 + STRLEN(zCol);
+     rc = sqlite3_table_column_metadata(
+-        db, "main", zTab, zCol, 0, &zCol, 0, 0, 0
++        db, "main", zTab, zCol, 0, &zColSeq, 0, 0, 0
+     );
+-    nByte += 1 + STRLEN(zCol);
++    if( zColSeq==0 ) zColSeq = "binary";
++    nByte += 1 + STRLEN(zColSeq);
+     nCol++;
+     nPk += (sqlite3_column_int(p1, 5)>0);
+   }
+@@ -714,6 +716,7 @@
+   nCol = 0;
+   while( rc==SQLITE_OK && SQLITE_ROW==sqlite3_step(p1) ){
+     const char *zCol = (const char*)sqlite3_column_text(p1, 1);
++    const char *zColSeq = 0;
+     int nCopy = STRLEN(zCol) + 1;
+     pNew->aCol[nCol].zName = pCsr;
+     pNew->aCol[nCol].iPk = (sqlite3_column_int(p1, 5)==1 && nPk==1);
+@@ -721,12 +724,13 @@
+     pCsr += nCopy;
+ 
+     rc = sqlite3_table_column_metadata(
+-        db, "main", zTab, zCol, 0, &zCol, 0, 0, 0
++        db, "main", zTab, zCol, 0, &zColSeq, 0, 0, 0
+     );
+     if( rc==SQLITE_OK ){
+-      nCopy = STRLEN(zCol) + 1;
++      if( zColSeq==0 ) zColSeq = "binary";
++      nCopy = STRLEN(zColSeq) + 1;
+       pNew->aCol[nCol].zColl = pCsr;
+-      memcpy(pCsr, zCol, nCopy);
++      memcpy(pCsr, zColSeq, nCopy);
+       pCsr += nCopy;
+     }
+ 

0004-CVE-2022-35737.patch

@@ -0,0 +1,80 @@
+From effc07ec9c6e08d3bd17665f8800054770f8c643 Mon Sep 17 00:00:00 2001
+From: drh <>
+Date: Fri, 15 Jul 2022 12:34:31 +0000
+Subject: [PATCH] Fix the whereKeyStats() routine (part of STAT4 processing
+ only) so that it is able to cope with row-value comparisons against the
+ primary key index of a WITHOUT ROWID table.
+ [forum:/forumpost/3607259d3c|Forum post 3607259d3c].
+
+FossilOrigin-Name: 2a6f761864a462de5c2d5bc666b82fb0b7e124a03443cd1482620dde344b34bb
+
+---
+ src/where.c        |  4 ++--
+ test/rowvalue.test | 31 +++++++++++++++++++++++++++++++
+ 2 files changed, 33 insertions(+), 2 deletions(-)
+
+diff --git a/src/where.c b/src/where.c
+index de6ea91e3..110eb4845 100644
+--- a/src/where.c
++++ b/src/where.c
+@@ -1433,7 +1433,7 @@ static int whereKeyStats(
+ #endif
+   assert( pRec!=0 );
+   assert( pIdx->nSample>0 );
+-  assert( pRec->nField>0 && pRec->nField<=pIdx->nSampleCol );
++  assert( pRec->nField>0 );
+ 
+   /* Do a binary search to find the first sample greater than or equal
+   ** to pRec. If pRec contains a single field, the set of samples to search
+@@ -1479,7 +1479,7 @@ static int whereKeyStats(
+   ** it is extended to two fields. The duplicates that this creates do not 
+   ** cause any problems.
+   */
+-  nField = pRec->nField;
++  nField = MIN(pRec->nField, pIdx->nSample);
+   iCol = 0;
+   iSample = pIdx->nSample * nField;
+   do{
+diff --git a/test/rowvalue.test b/test/rowvalue.test
+index 12fee8237..59b44d938 100644
+--- a/test/rowvalue.test
++++ b/test/rowvalue.test
+@@ -751,4 +751,35 @@ do_execsql_test 30.3 {
+ 
+ 
+ 
++# 2022-07-15
++# https://sqlite.org/forum/forumpost/3607259d3c
++#
++reset_db
++do_execsql_test 33.1 {
++  CREATE TABLE t1(a INT, b INT PRIMARY KEY) WITHOUT ROWID;
++  INSERT INTO t1(a, b) VALUES (0, 1),(15,-7),(3,100);
++  ANALYZE;
++} {}
++do_execsql_test 33.2 {
++  SELECT * FROM t1 WHERE (b,a) BETWEEN (0,5) AND (99,-2);
++} {0 1}
++do_execsql_test 33.3 {
++  SELECT * FROM t1 WHERE (b,a) BETWEEN (-8,5) AND (0,-2);
++} {15 -7}
++do_execsql_test 33.3 {
++  SELECT * FROM t1 WHERE (b,a) BETWEEN (3,5) AND (100,4);
++} {3 100}
++do_execsql_test 33.3 {
++  SELECT * FROM t1 WHERE (b,a) BETWEEN (3,5) AND (100,2);
++} {}
++do_execsql_test 33.3 {
++  SELECT * FROM t1 WHERE (a,b) BETWEEN (-2,99) AND (1,0);
++} {0 1}
++do_execsql_test 33.3 {
++  SELECT * FROM t1 WHERE (a,b) BETWEEN (14,99) AND (16,0);
++} {15 -7}
++do_execsql_test 33.3 {
++  SELECT * FROM t1 WHERE (a,b) BETWEEN (2,99) AND (4,0);
++} {3 100}
++
+ finish_test
+-- 
+2.25.1
+

CVE-2021-20227.patch

@@ -1,69 +0,0 @@
-Index: sqlite-src-3320300/src/select.c
-==================================================================
---- sqlite-src-3320300/src/select.c
-+++ sqlite-src-3320300/src/select.c
-@@ -5613,11 +5613,13 @@
- ** within the HAVING expression with a constant "1".
- */
- static int havingToWhereExprCb(Walker *pWalker, Expr *pExpr){
-   if( pExpr->op!=TK_AND ){
-     Select *pS = pWalker->u.pSelect;
--    if( sqlite3ExprIsConstantOrGroupBy(pWalker->pParse, pExpr, pS->pGroupBy) ){
-+    if( sqlite3ExprIsConstantOrGroupBy(pWalker->pParse, pExpr, pS->pGroupBy) 
-+     && ExprAlwaysFalse(pExpr)==0
-+    ){
-       sqlite3 *db = pWalker->pParse->db;
-       Expr *pNew = sqlite3Expr(db, TK_INTEGER, "1");
-       if( pNew ){
-         Expr *pWhere = pS->pWhere;
-         SWAP(Expr, *pNew, *pExpr);
-
-Index: sqlite-src-3320300/test/having.test
-==================================================================
---- sqlite-src-3320300/test/having.test
-+++ sqlite-src-3320300/test/having.test
-@@ -63,12 +63,12 @@
-     "SELECT a, sum(b) FROM t1 WHERE a=2 GROUP BY a HAVING sum(b)>5"
- 
-   3 "SELECT a, sum(b) FROM t1 GROUP BY a COLLATE binary HAVING a=2"
-     "SELECT a, sum(b) FROM t1 WHERE a=2 GROUP BY a COLLATE binary"
- 
--  5 "SELECT a, sum(b) FROM t1 GROUP BY a COLLATE binary HAVING 0"
--    "SELECT a, sum(b) FROM t1 WHERE 0 GROUP BY a COLLATE binary"
-+  5 "SELECT a, sum(b) FROM t1 GROUP BY a COLLATE binary HAVING 1"
-+    "SELECT a, sum(b) FROM t1 WHERE 1 GROUP BY a COLLATE binary"
- 
-   6 "SELECT count(*) FROM t1,t2 WHERE a=c GROUP BY b, d HAVING b=d"
-     "SELECT count(*) FROM t1,t2 WHERE a=c AND b=d GROUP BY b, d"
- 
-   7 {
-@@ -151,8 +151,28 @@
- #
- set ::nondeter_ret 0
- do_execsql_test 4.3 {
-   SELECT a, sum(b) FROM t3 WHERE nondeter(a) GROUP BY a
- } {1 4 2 2}
-+
-+#-------------------------------------------------------------------------
-+reset_db
-+do_execsql_test 5.0 {
-+  CREATE TABLE t1(a, b);
-+  CREATE TABLE t2(x, y);
-+  INSERT INTO t1 VALUES('a', 'b');
-+}
-+
-+# The WHERE clause (a=2), uses an aggregate column from the outer query.
-+# If the HAVING term (0) is moved into the WHERE clause in this case,
-+# SQLite would at one point optimize (a=2 AND 0) to simply (0). Which
-+# is logically correct, but happened to cause problems in aggregate
-+# processing for the outer query. This test case verifies that those 
-+# problems are no longer present.
-+do_execsql_test 5.1 {
-+  SELECT min(b), (
-+    SELECT x FROM t2 WHERE a=2 GROUP BY y HAVING 0
-+  ) FROM t1;
-+} {b {}}
- 
- 
- finish_test
-

sqlite.spec

@@ -1,24 +1,24 @@
 %bcond_without check
 
-%global extver 3320300
+%global extver 3360000
 %global tcl_version 8.6
 %global tcl_sitearch %{_libdir}/tcl%{tcl_version}
-%global year 2020
 
 Name:    sqlite
-Version: 3.32.3
+Version: 3.36.0
 Release: 3
 Summary: Embeded SQL database
 License: Public Domain
 URL:     http://www.sqlite.org/
 
-Source0: https://www.sqlite.org/%{year}/sqlite-src-%{extver}.zip
-Source1: http://www.sqlite.org/%{year}/sqlite-doc-%{extver}.zip
-Source2: https://www.sqlite.org/%{year}/sqlite-autoconf-%{extver}.tar.gz
+Source0: https://www.sqlite.org/2021/sqlite-src-%{extver}.zip
+Source1: http://www.sqlite.org/2021/sqlite-doc-%{extver}.zip
+Source2: https://www.sqlite.org/2021/sqlite-autoconf-%{extver}.tar.gz
 
 Patch1: 0001-sqlite-no-malloc-usable-size.patch
 Patch2: 0002-remove-fail-testcase-in-no-free-fd-situation.patch
-Patch3: CVE-2021-20227.patch
+Patch3: 0003-CVE-2021-36690.patch
+Patch4: 0004-CVE-2022-35737.patch
 
 BuildRequires: gcc autoconf tcl tcl-devel
 BuildRequires: ncurses-devel readline-devel glibc-devel
@@ -64,7 +64,7 @@ This contains man files and HTML files for the using of sqlite.
 %patch1 -p1
 %patch2 -p1
 %patch3 -p1
-
+%patch4 -p1
 
 rm -f %{name}-doc-%{extver}/sqlite.css~ || :
 
@@ -106,8 +106,6 @@ chmod 755 %{buildroot}/%{tcl_sitearch}/sqlite3/*.so
 %check
 export LD_LIBRARY_PATH=`pwd`/.libs
 export MALLOC_CHECK_=3
-#bypass zipfile.test
-rm test/zipfile.test
 
 %ifarch x86_64 %{ix86}
 %else
@@ -137,50 +135,59 @@ make test
 %{_mandir}/man*/*
 
 %changelog
-* Mon Apr 26 2021 bzhaoop<bzhaojyathousandy@gmail.com> - 3.32.3-3
-- Fix CVE-2021-20227
+* Tue Aug 16 2022 liusirui <liusirui@huawei.com> - 3.36.0-3
+- fix the CVE-2022-35737.
 
-* Thu Sep 2 2020 lihaotian<lihaotian9@huawei.com> - 3.32.3-2
+* Sat Nov 27 2021 wbq_sky <wangbingquan@huawei.com> - 3.36.0-2
+- fix the CVE-2021-36690.
+
+* Fri Nov 25 2021 wbq_sky <wangbingquan@huawei.com> - 3.36.0-1
+- update to 3.36.0.
+
+* Fri Sep 26 2021 wbq_sky <wangbingquan@huawei.com> - 3.34.0-4
+- fix the uninitialized value used in pattern match.
+
+* Fri Sep 3 2021 wbq_sky <wangbingquan@huawei.com> - 3.34.0-3
+- fix the null reference in the tigger statement.
+
+* Fri Sep 3 2021 wbq_sky <wangbingquan@huawei.com> - 3.34.0-2
+- fix the infinite loop problem in the trim function while the pattern is well formed.
+
+* Thu Jan 14 2021 yanglongkang <yanglongkang@huawei.com> - 3.34.0-1
+- update package to 3.34.0
+
+* Thu Sep 3 2020 lihaotian<lihaotian9@huawei.com> - 3.32.3-3
 - update source0 url
 
-* Tue Aug 25 2020 yanglongkang <yanglongkang@huawei.com> - 3.32.3-1
+* Tue Jul 21 2020 jixinjie <jixinjie@huawei.com> - 3.32.3-2
+- update yaml file
+
+* Tue Jul 21 2020 jixinjie <jixinjie@huawei.com> - 3.32.3-1
 - update package to 3.32.3
 
-* Tue Aug 4 2020 yanglongkang <yanglongkang@huawei.com> - 3.31.1-2
-- Type:cves
-- ID:CVE-2020-13871
-- SUG: NA
-- DESC: fix cve
-
-* Mon Aug 3 2020 yanglongkang <yanglongkang@huawei.com> - 3.31.1-1
-- Type:cves
-- ID:CVE-2020-15358 CVE-2020-13631
-- SUG: NA
-- DESC: fix cve
-
-* Fri Apr 17 2020 luoshijie <luoshijie1@huawei.com> - 3.31.1-0
+* Tue Jun 30 2020 volcanodragon <linfeilong@huawei.com> - 3.24.0-12
 - Type:enhancement
 - ID:NA
-- SUG:restart
-- DESC:update sqlite to 3.31.1.
-
-* Tue Mar 10 2020 guiyao <guiyao@huawei.com> - 3.24.0-11
-- Type:cves
-- ID:CVE-2020-9327
-- SUG: NA
-- DESC: fix cve
-
-* Fri Feb 28 2020 sunshihao <sunshihao@huawei.com> - 3.24.0-10
-- Type:enhancement
-- ID:
-- SUG: NA
-- DESC: remove suffix information
-
-* Wed Feb 26 2020 guiyao <guiyao@huawei.com> - 3.24.0-9
-- Type:cves
-- ID:CVE-2018-20505
 - SUG:NA
-- DESC:fix cves
+- DESC:rename patches
+
+* Tue Jun 23 2020 yanglongkang <yanglongkang@huawei.com> - 3.24.0-11
+- Type:cves
+- ID:CVE-2020-13434 CVE-2020-13435 CVE-2020-13630 CVE-2020-13632
+- SUG:NA
+- DESC:fix CVE-2020-13434 CVE-2020-13435 CVE-2020-13630 CVE-2020-13632
+
+* Sun Apr 19 2020 ethan848 <mingfangsen@huawei.com>
+- Type:enhancement
+- ID:NA
+- SUG:NA
+- DESC:CVE-2020-11655 fixed
+
+* Tue Mar 10 2020 steven <steven_ygui@163.com> - 3.24.0-9
+- Type:enhancement
+- ID:NA
+- SUG:NA
+- DESC:CVE-2018-20505, CVE-2020-9327 fixed
 
 * Wed Jan 11 2020 openEuler Buildteam <buildteam@openeuler.org> - 3.24.0-8
 - Type:enhancement

sqlite.yaml

@@ -0,0 +1,4 @@
+version_control: fossil
+src_repo: https://www.sqlite.org/src
+tag_prefix: "version-"
+seperator: "."