Compare commits
25
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
|
|
3b8ef70260 | ||
|
|
29347b1527 | ||
|
|
36052db9a0 | ||
|
|
d5bf7b294a | ||
|
|
4255fd05db | ||
|
|
8222faba44 | ||
|
|
b6baf940d4 | ||
|
|
76b8dd730a | ||
|
|
7d7e9e3d73 | ||
|
|
7cae1352c1 | ||
|
|
d8002ef402 | ||
|
|
538587881d | ||
|
|
419bd31973 | ||
|
|
c135d8d9cf | ||
|
|
a5ad049268 | ||
|
|
ae04b38c7e | ||
|
|
281ace3ce4 | ||
|
|
fa6537c498 | ||
|
|
70773bbab5 | ||
|
|
17f47bf553 | ||
|
|
c7b6d9b65f | ||
|
|
80491f4558 | ||
|
|
b5acf1da61 | ||
|
|
4cbaf5da18 | ||
|
|
d81186e427 |
@@ -1,45 +0,0 @@
|
||||
it From a756d158b3e55831975feb45b753ba499d2adeda Mon Sep 17 00:00:00 2001
|
||||
From: mazhao <mazhao12@huawei.com>
|
||||
Date: Wed, 3 Jan 2024 12:00:45 +0800
|
||||
Subject: [PATCH] Fix a buffer overread in the sessions extension that could
|
||||
occur when processing a corrupt changeset.
|
||||
|
||||
Signed-off-by: mazhao <mazhao12@huawei.com>
|
||||
---
|
||||
ext/session/sqlite3session.c | 18 +++++++++++-------
|
||||
1 file changed, 11 insertions(+), 7 deletions(-)
|
||||
|
||||
diff --git a/ext/session/sqlite3session.c b/ext/session/sqlite3session.c
|
||||
index a892804..72ad427 100644
|
||||
--- a/ext/session/sqlite3session.c
|
||||
+++ b/ext/session/sqlite3session.c
|
||||
@@ -3050,15 +3050,19 @@ static int sessionReadRecord(
|
||||
}
|
||||
}
|
||||
if( eType==SQLITE_INTEGER || eType==SQLITE_FLOAT ){
|
||||
- sqlite3_int64 v = sessionGetI64(aVal);
|
||||
- if( eType==SQLITE_INTEGER ){
|
||||
- sqlite3VdbeMemSetInt64(apOut[i], v);
|
||||
+ if( (pIn->nData-pIn->iNext)<8 ){
|
||||
+ rc = SQLITE_CORRUPT_BKPT;
|
||||
}else{
|
||||
- double d;
|
||||
- memcpy(&d, &v, 8);
|
||||
- sqlite3VdbeMemSetDouble(apOut[i], d);
|
||||
+ sqlite3_int64 v = sessionGetI64(aVal);
|
||||
+ if( eType==SQLITE_INTEGER ){
|
||||
+ sqlite3VdbeMemSetInt64(apOut[i], v);
|
||||
+ }else{
|
||||
+ double d;
|
||||
+ memcpy(&d, &v, 8);
|
||||
+ sqlite3VdbeMemSetDouble(apOut[i], d);
|
||||
+ }
|
||||
+ pIn->iNext += 8;
|
||||
}
|
||||
- pIn->iNext += 8;
|
||||
}
|
||||
}
|
||||
}
|
||||
--
|
||||
2.34.1
|
||||
|
||||
+10
-5
@@ -21,7 +21,6 @@ Patch3: 0003-CVE-2022-35737.patch
|
||||
Patch4: 0004-fix-memory-problem-in-the-rtree-test-suite.patch
|
||||
Patch5: 0005-fix-integer-overflow-on-gigabyte-string.patch
|
||||
Patch6: 0006-CVE-2022-46908.patch
|
||||
Patch7: 0007-CVE-2023-7104.patch
|
||||
|
||||
BuildRequires: gcc autoconf tcl tcl-devel
|
||||
BuildRequires: ncurses-devel readline-devel glibc-devel
|
||||
@@ -70,7 +69,6 @@ This contains man files and HTML files for the using of sqlite.
|
||||
%patch4 -p1
|
||||
%patch5 -p1
|
||||
%patch6 -p1
|
||||
%patch7 -p1
|
||||
|
||||
rm -f %{name}-doc-%{extver}/sqlite.css~ || :
|
||||
|
||||
@@ -117,6 +115,10 @@ export MALLOC_CHECK_=3
|
||||
%else
|
||||
rm test/csv01.test
|
||||
%endif
|
||||
%ifarch loongarch64
|
||||
rm -rf test/thread1.test
|
||||
rm -rf test/thread2.test
|
||||
%endif
|
||||
|
||||
make test
|
||||
%endif # with check
|
||||
@@ -141,8 +143,8 @@ make test
|
||||
%{_mandir}/man*/*
|
||||
|
||||
%changelog
|
||||
* Wed Jan 3 2024 mazhao <mazhao12@huawei.com> - 3.37.2-5
|
||||
- fix the CVE-2023-7104
|
||||
* Fri Jan 13 2023 Wenlong Zhang<zhangwenlong@loongson.cn> - 3.37.2-5
|
||||
- remove fail testcase for loongarch
|
||||
|
||||
* Wed Dec 14 2022 zhuwentao <zhuwentao5@huawei.com> - 3.37.2-4
|
||||
- fix the CVE-2022-46908
|
||||
@@ -165,6 +167,9 @@ make test
|
||||
* Fri Nov 25 2021 wbq_sky <wangbingquan@huawei.com> - 3.36.0-1
|
||||
- update to 3.36.0.
|
||||
|
||||
* Fri Sep 26 2021 wbq_sky <wangbingquan@huawei.com> - 3.34.0-4
|
||||
- fix the uninitialized value used in pattern match.
|
||||
|
||||
* Fri Sep 3 2021 wbq_sky <wangbingquan@huawei.com> - 3.34.0-3
|
||||
- fix the null reference in the tigger statement.
|
||||
|
||||
@@ -266,4 +271,4 @@ make test
|
||||
- ID:CVE-2018-20346
|
||||
- SUG:NA
|
||||
- DESC:CVE-2018-20346
|
||||
- Package init
|
||||
- Package init
|
||||
|
||||
Reference in New Issue
Block a user