!34 [sync] PR-31: [Resolving] CVE-2021-20227

From: @openeuler-sync-bot
Reviewed-by: @bzhaoop
Signed-off-by: @bzhaoop

0003-CVE-2021-36690.patch

@@ -1,44 +0,0 @@
-diff -rNu a/ext/expert/sqlite3expert.c b/ext/expert/sqlite3expert.c
---- a/ext/expert/sqlite3expert.c	2021-11-25 09:00:19.267831518 +0800
-+++ b/ext/expert/sqlite3expert.c	2021-11-25 09:07:38.551969861 +0800
-@@ -690,11 +690,13 @@
-   rc = idxPrintfPrepareStmt(db, &p1, pzErrmsg, "PRAGMA table_xinfo=%Q", zTab);
-   while( rc==SQLITE_OK && SQLITE_ROW==sqlite3_step(p1) ){
-     const char *zCol = (const char*)sqlite3_column_text(p1, 1);
-+    const char *zColSeq = 0;
-     nByte += 1 + STRLEN(zCol);
-     rc = sqlite3_table_column_metadata(
--        db, "main", zTab, zCol, 0, &zCol, 0, 0, 0
-+        db, "main", zTab, zCol, 0, &zColSeq, 0, 0, 0
-     );
--    nByte += 1 + STRLEN(zCol);
-+    if( zColSeq==0 ) zColSeq = "binary";
-+    nByte += 1 + STRLEN(zColSeq);
-     nCol++;
-     nPk += (sqlite3_column_int(p1, 5)>0);
-   }
-@@ -714,6 +716,7 @@
-   nCol = 0;
-   while( rc==SQLITE_OK && SQLITE_ROW==sqlite3_step(p1) ){
-     const char *zCol = (const char*)sqlite3_column_text(p1, 1);
-+    const char *zColSeq = 0;
-     int nCopy = STRLEN(zCol) + 1;
-     pNew->aCol[nCol].zName = pCsr;
-     pNew->aCol[nCol].iPk = (sqlite3_column_int(p1, 5)==1 && nPk==1);
-@@ -721,12 +724,13 @@
-     pCsr += nCopy;
- 
-     rc = sqlite3_table_column_metadata(
--        db, "main", zTab, zCol, 0, &zCol, 0, 0, 0
-+        db, "main", zTab, zCol, 0, &zColSeq, 0, 0, 0
-     );
-     if( rc==SQLITE_OK ){
--      nCopy = STRLEN(zCol) + 1;
-+      if( zColSeq==0 ) zColSeq = "binary";
-+      nCopy = STRLEN(zColSeq) + 1;
-       pNew->aCol[nCol].zColl = pCsr;
--      memcpy(pCsr, zCol, nCopy);
-+      memcpy(pCsr, zColSeq, nCopy);
-       pCsr += nCopy;
-     }
- 

CVE-2021-20227.patch

@@ -0,0 +1,69 @@
+Index: sqlite-src-3320300/src/select.c
+==================================================================
+--- sqlite-src-3320300/src/select.c
++++ sqlite-src-3320300/src/select.c
+@@ -5613,11 +5613,13 @@
+ ** within the HAVING expression with a constant "1".
+ */
+ static int havingToWhereExprCb(Walker *pWalker, Expr *pExpr){
+   if( pExpr->op!=TK_AND ){
+     Select *pS = pWalker->u.pSelect;
+-    if( sqlite3ExprIsConstantOrGroupBy(pWalker->pParse, pExpr, pS->pGroupBy) ){
++    if( sqlite3ExprIsConstantOrGroupBy(pWalker->pParse, pExpr, pS->pGroupBy) 
++     && ExprAlwaysFalse(pExpr)==0
++    ){
+       sqlite3 *db = pWalker->pParse->db;
+       Expr *pNew = sqlite3Expr(db, TK_INTEGER, "1");
+       if( pNew ){
+         Expr *pWhere = pS->pWhere;
+         SWAP(Expr, *pNew, *pExpr);
+
+Index: sqlite-src-3320300/test/having.test
+==================================================================
+--- sqlite-src-3320300/test/having.test
++++ sqlite-src-3320300/test/having.test
+@@ -63,12 +63,12 @@
+     "SELECT a, sum(b) FROM t1 WHERE a=2 GROUP BY a HAVING sum(b)>5"
+ 
+   3 "SELECT a, sum(b) FROM t1 GROUP BY a COLLATE binary HAVING a=2"
+     "SELECT a, sum(b) FROM t1 WHERE a=2 GROUP BY a COLLATE binary"
+ 
+-  5 "SELECT a, sum(b) FROM t1 GROUP BY a COLLATE binary HAVING 0"
+-    "SELECT a, sum(b) FROM t1 WHERE 0 GROUP BY a COLLATE binary"
++  5 "SELECT a, sum(b) FROM t1 GROUP BY a COLLATE binary HAVING 1"
++    "SELECT a, sum(b) FROM t1 WHERE 1 GROUP BY a COLLATE binary"
+ 
+   6 "SELECT count(*) FROM t1,t2 WHERE a=c GROUP BY b, d HAVING b=d"
+     "SELECT count(*) FROM t1,t2 WHERE a=c AND b=d GROUP BY b, d"
+ 
+   7 {
+@@ -151,8 +151,28 @@
+ #
+ set ::nondeter_ret 0
+ do_execsql_test 4.3 {
+   SELECT a, sum(b) FROM t3 WHERE nondeter(a) GROUP BY a
+ } {1 4 2 2}
++
++#-------------------------------------------------------------------------
++reset_db
++do_execsql_test 5.0 {
++  CREATE TABLE t1(a, b);
++  CREATE TABLE t2(x, y);
++  INSERT INTO t1 VALUES('a', 'b');
++}
++
++# The WHERE clause (a=2), uses an aggregate column from the outer query.
++# If the HAVING term (0) is moved into the WHERE clause in this case,
++# SQLite would at one point optimize (a=2 AND 0) to simply (0). Which
++# is logically correct, but happened to cause problems in aggregate
++# processing for the outer query. This test case verifies that those 
++# problems are no longer present.
++do_execsql_test 5.1 {
++  SELECT min(b), (
++    SELECT x FROM t2 WHERE a=2 GROUP BY y HAVING 0
++  ) FROM t1;
++} {b {}}
+ 
+ 
+ finish_test
+

sqlite.spec

@@ -1,23 +1,23 @@
 %bcond_without check
 
-%global extver 3360000
+%global extver 3320300
 %global tcl_version 8.6
 %global tcl_sitearch %{_libdir}/tcl%{tcl_version}
 
 Name:    sqlite
-Version: 3.36.0
-Release: 2
+Version: 3.32.3
+Release: 3
 Summary: Embeded SQL database
 License: Public Domain
 URL:     http://www.sqlite.org/
 
-Source0: https://www.sqlite.org/2021/sqlite-src-%{extver}.zip
-Source1: http://www.sqlite.org/2021/sqlite-doc-%{extver}.zip
-Source2: https://www.sqlite.org/2021/sqlite-autoconf-%{extver}.tar.gz
+Source0: http://www.sqlite.org/2020/sqlite-src-%{extver}.zip
+Source1: http://www.sqlite.org/2020/sqlite-doc-%{extver}.zip
+Source2: https://www.sqlite.org/2020/sqlite-autoconf-%{extver}.tar.gz
 
 Patch1: 0001-sqlite-no-malloc-usable-size.patch
 Patch2: 0002-remove-fail-testcase-in-no-free-fd-situation.patch
-Patch3: 0003-CVE-2021-36690.patch
+Patch3: CVE-2021-20227.patch
 
 BuildRequires: gcc autoconf tcl tcl-devel
 BuildRequires: ncurses-devel readline-devel glibc-devel
@@ -133,27 +133,12 @@ make test
 %{_mandir}/man*/*
 
 %changelog
-* Fri Nov 27 2021 wbq_sky <wangbingquan@huawei.com> - 3.36.0-2
-- fix the CVE-2021-36690.
+* Mon Apr 26 2021 bzhaoop<bzhaojyathousandy@gmail.com> - 3.32.3-3
+- Fix CVE-2021-20227
 
-* Fri Nov 25 2021 wbq_sky <wangbingquan@huawei.com> - 3.36.0-1
-- update to 3.36.0.
-
-* Fri Sep 3 2021 wbq_sky <wangbingquan@huawei.com> - 3.34.0-3
-- fix the null reference in the tigger statement.
-
-* Fri Sep 3 2021 wbq_sky <wangbingquan@huawei.com> - 3.34.0-2
-- fix the infinite loop problem in the trim function while the pattern is well formed.
-
-* Thu Jan 14 2021 yanglongkang <yanglongkang@huawei.com> - 3.34.0-1
-- update package to 3.34.0
-
-* Thu Sep 3 2020 lihaotian<lihaotian9@huawei.com> - 3.32.3-3
+* Thu Sep 2 2020 lihaotian<lihaotian9@huawei.com> - 3.32.3-2
 - update source0 url
 
-* Tue Jul 21 2020 jixinjie <jixinjie@huawei.com> - 3.32.3-2
-- update yaml file
-
 * Tue Jul 21 2020 jixinjie <jixinjie@huawei.com> - 3.32.3-1
 - update package to 3.32.3