!107 修复漏洞CVE-2023-7104

From: @Jeremyzz 
Reviewed-by: @dillon_chen 
Signed-off-by: @dillon_chen

0007-CVE-2023-7104.patch

@@ -0,0 +1,45 @@
+it From a756d158b3e55831975feb45b753ba499d2adeda Mon Sep 17 00:00:00 2001
+From: mazhao <mazhao12@huawei.com>
+Date: Wed, 3 Jan 2024 12:00:45 +0800
+Subject: [PATCH] Fix a buffer overread in the sessions extension that could
+ occur when processing a corrupt changeset.
+
+Signed-off-by: mazhao <mazhao12@huawei.com>
+---
+ ext/session/sqlite3session.c | 18 +++++++++++-------
+ 1 file changed, 11 insertions(+), 7 deletions(-)
+
+diff --git a/ext/session/sqlite3session.c b/ext/session/sqlite3session.c
+index a892804..72ad427 100644
+--- a/ext/session/sqlite3session.c
++++ b/ext/session/sqlite3session.c
+@@ -3050,15 +3050,19 @@ static int sessionReadRecord(
+         }
+       }
+       if( eType==SQLITE_INTEGER || eType==SQLITE_FLOAT ){
+-        sqlite3_int64 v = sessionGetI64(aVal);
+-        if( eType==SQLITE_INTEGER ){
+-          sqlite3VdbeMemSetInt64(apOut[i], v);
++        if( (pIn->nData-pIn->iNext)<8 ){
++          rc = SQLITE_CORRUPT_BKPT;
+         }else{
+-          double d;
+-          memcpy(&d, &v, 8);
+-          sqlite3VdbeMemSetDouble(apOut[i], d);
++          sqlite3_int64 v = sessionGetI64(aVal);
++          if( eType==SQLITE_INTEGER ){
++            sqlite3VdbeMemSetInt64(apOut[i], v);
++          }else{
++            double d;
++            memcpy(&d, &v, 8);
++            sqlite3VdbeMemSetDouble(apOut[i], d);
++          }
++          pIn->iNext += 8;
+         }
+-        pIn->iNext += 8;
+       }
+     }
+   }
+-- 
+2.34.1
+

sqlite.spec

@@ -21,6 +21,7 @@ Patch3: 0003-CVE-2022-35737.patch
 Patch4: 0004-fix-memory-problem-in-the-rtree-test-suite.patch
 Patch5: 0005-fix-integer-overflow-on-gigabyte-string.patch
 Patch6: 0006-CVE-2022-46908.patch
+Patch7: 0007-CVE-2023-7104.patch
 
 BuildRequires: gcc autoconf tcl tcl-devel
 BuildRequires: ncurses-devel readline-devel glibc-devel
@@ -69,6 +70,7 @@ This contains man files and HTML files for the using of sqlite.
 %patch4 -p1
 %patch5 -p1
 %patch6 -p1
+%patch7 -p1
 
 rm -f %{name}-doc-%{extver}/sqlite.css~ || :
 
@@ -115,10 +117,6 @@ export MALLOC_CHECK_=3
 %else
 rm test/csv01.test
 %endif
-%ifarch loongarch64
-rm -rf test/thread1.test
-rm -rf test/thread2.test
-%endif
 
 make test
 %endif # with check
@@ -143,8 +141,8 @@ make test
 %{_mandir}/man*/*
 
 %changelog
-* Fri Jan 13 2023 Wenlong Zhang<zhangwenlong@loongson.cn> - 3.37.2-5
-- remove fail testcase for loongarch
+* Wed Jan 3 2024 mazhao <mazhao12@huawei.com> - 3.37.2-5
+- fix the CVE-2023-7104
 
 * Wed Dec 14 2022 zhuwentao <zhuwentao5@huawei.com> - 3.37.2-4
 - fix the CVE-2022-46908
@@ -167,9 +165,6 @@ make test
 * Fri Nov 25 2021 wbq_sky <wangbingquan@huawei.com> - 3.36.0-1
 - update to 3.36.0.
 
-* Fri Sep 26 2021 wbq_sky <wangbingquan@huawei.com> - 3.34.0-4
-- fix the uninitialized value used in pattern match.
-
 * Fri Sep 3 2021 wbq_sky <wangbingquan@huawei.com> - 3.34.0-3
 - fix the null reference in the tigger statement.
 
@@ -271,4 +266,4 @@ make test
 - ID:CVE-2018-20346
 - SUG:NA
 - DESC:CVE-2018-20346
-- Package init
+- Package init