!31 [Resolving] CVE-2021-20227

From: @bzhaoop
Reviewed-by: @zhengzhenyu
Signed-off-by: @zhengzhenyu

0001-sqlite-no-malloc-usable-size.patch

@@ -1,34 +1,7 @@
-From 6a7c9be9502ea2023c4b5cf39a0d5a5a55b320f7 Mon Sep 17 00:00:00 2001
-From: Lixiaokeng <lixiaokeng@huawei.com>
-Date: Wed, 17 Jul 2024 10:31:56 +0800
-Subject: [PATCH] sqlite no malloc_usable_size
-
-Reference:https://gitee.com/src-openeuler/sqlite/blob/openEuler-22.03-LTS-SP3/0001-sqlite-no-malloc-usable-size.patch
-Conflict:NA
-
----
- configure    | 2 +-
- configure.ac | 2 +-
- 2 files changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/configure b/configure
-index 29ca76b..d67183a 100755
---- a/configure
-+++ b/configure
-@@ -10292,7 +10292,7 @@ done
- #########
- # Figure out whether or not we have these functions
- #
--for ac_func in fdatasync gmtime_r isnan localtime_r localtime_s malloc_usable_size strchrnul usleep utime pread pread64 pwrite pwrite64
-+for ac_func in fdatasync gmtime_r isnan localtime_r localtime_s strchrnul usleep utime pread pread64 pwrite pwrite64
- do :
-   as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh`
- ac_fn_c_check_func "$LINENO" "$ac_func" "$as_ac_var"
-diff --git a/configure.ac b/configure.ac
-index 53be0a6..6f9b1e1 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -108,7 +108,7 @@ AC_CHECK_HEADERS([sys/types.h stdlib.h stdint.h inttypes.h malloc.h])
+diff -up sqlite-src-3120200/configure.ac.malloc_usable_size sqlite-src-3120200/configure.ac
+--- sqlite-src-3120200/configure.ac.malloc_usable_size	2016-04-25 09:46:48.134690570 +0200
++++ sqlite-src-3120200/configure.ac	2016-04-25 09:48:41.622637181 +0200
+@@ -108,7 +108,7 @@ AC_CHECK_HEADERS([sys/types.h stdlib.h s
  #########
  # Figure out whether or not we have these functions
  #
@@ -37,5 +10,15 @@ index 53be0a6..6f9b1e1 100644
  
  #########
  # By default, we use the amalgamation (this may be changed below...)
--- 
-2.33.0
+diff -up sqlite-src-3120200/configure.malloc_usable_size sqlite-src-3120200/configure
+--- sqlite-src-3120200/configure.malloc_usable_size	2016-04-25 09:47:12.594679063 +0200
++++ sqlite-src-3120200/configure	2016-04-25 09:49:28.684615042 +0200
+@@ -10275,7 +10275,7 @@ done
+ #########
+ # Figure out whether or not we have these functions
+ #
+-for ac_func in fdatasync gmtime_r isnan localtime_r localtime_s malloc_usable_size strchrnul usleep utime pread pread64 pwrite pwrite64
++for ac_func in fdatasync gmtime_r isnan localtime_r localtime_s strchrnul usleep utime pread pread64 pwrite pwrite64
+ do :
+   as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh`
+ ac_fn_c_check_func "$LINENO" "$ac_func" "$as_ac_var"

0002-remove-fail-testcase-in-no-free-fd-situation.patch

@@ -3,9 +3,6 @@ From: eulerstorage <eulerstoragemt@huawei.com>
 Date: Sat, 11 Jan 2020 11:33:54 +0800
 Subject: [PATCH] remove fail testcase in no free fd situation
 
-Reference:https://gitee.com/src-openeuler/sqlite/blob/openEuler-22.03-LTS-SP3/0002-remove-fail-testcase-in-no-free-fd-situation.patch
-Conflict:NA
-
 Remove testcase 1.1.1, 1.1.2 and 1.1.3, since it can not success in
 some situation if there is no enough fd resource.
 ---
@@ -66,3 +63,4 @@ index a51301c..d46218f 100644
  do_test 1.2.1 {
 -- 
 1.8.3.1
+

CVE-2021-20227.patch

@@ -0,0 +1,69 @@
+Index: sqlite-src-3320300/src/select.c
+==================================================================
+--- sqlite-src-3320300/src/select.c
++++ sqlite-src-3320300/src/select.c
+@@ -5613,11 +5613,13 @@
+ ** within the HAVING expression with a constant "1".
+ */
+ static int havingToWhereExprCb(Walker *pWalker, Expr *pExpr){
+   if( pExpr->op!=TK_AND ){
+     Select *pS = pWalker->u.pSelect;
+-    if( sqlite3ExprIsConstantOrGroupBy(pWalker->pParse, pExpr, pS->pGroupBy) ){
++    if( sqlite3ExprIsConstantOrGroupBy(pWalker->pParse, pExpr, pS->pGroupBy) 
++     && ExprAlwaysFalse(pExpr)==0
++    ){
+       sqlite3 *db = pWalker->pParse->db;
+       Expr *pNew = sqlite3Expr(db, TK_INTEGER, "1");
+       if( pNew ){
+         Expr *pWhere = pS->pWhere;
+         SWAP(Expr, *pNew, *pExpr);
+
+Index: sqlite-src-3320300/test/having.test
+==================================================================
+--- sqlite-src-3320300/test/having.test
++++ sqlite-src-3320300/test/having.test
+@@ -63,12 +63,12 @@
+     "SELECT a, sum(b) FROM t1 WHERE a=2 GROUP BY a HAVING sum(b)>5"
+ 
+   3 "SELECT a, sum(b) FROM t1 GROUP BY a COLLATE binary HAVING a=2"
+     "SELECT a, sum(b) FROM t1 WHERE a=2 GROUP BY a COLLATE binary"
+ 
+-  5 "SELECT a, sum(b) FROM t1 GROUP BY a COLLATE binary HAVING 0"
+-    "SELECT a, sum(b) FROM t1 WHERE 0 GROUP BY a COLLATE binary"
++  5 "SELECT a, sum(b) FROM t1 GROUP BY a COLLATE binary HAVING 1"
++    "SELECT a, sum(b) FROM t1 WHERE 1 GROUP BY a COLLATE binary"
+ 
+   6 "SELECT count(*) FROM t1,t2 WHERE a=c GROUP BY b, d HAVING b=d"
+     "SELECT count(*) FROM t1,t2 WHERE a=c AND b=d GROUP BY b, d"
+ 
+   7 {
+@@ -151,8 +151,28 @@
+ #
+ set ::nondeter_ret 0
+ do_execsql_test 4.3 {
+   SELECT a, sum(b) FROM t3 WHERE nondeter(a) GROUP BY a
+ } {1 4 2 2}
++
++#-------------------------------------------------------------------------
++reset_db
++do_execsql_test 5.0 {
++  CREATE TABLE t1(a, b);
++  CREATE TABLE t2(x, y);
++  INSERT INTO t1 VALUES('a', 'b');
++}
++
++# The WHERE clause (a=2), uses an aggregate column from the outer query.
++# If the HAVING term (0) is moved into the WHERE clause in this case,
++# SQLite would at one point optimize (a=2 AND 0) to simply (0). Which
++# is logically correct, but happened to cause problems in aggregate
++# processing for the outer query. This test case verifies that those 
++# problems are no longer present.
++do_execsql_test 5.1 {
++  SELECT min(b), (
++    SELECT x FROM t2 WHERE a=2 GROUP BY y HAVING 0
++  ) FROM t1;
++} {b {}}
+ 
+ 
+ finish_test
+

backport-0003-fix-memory-problem-in-the-rtree-test-suite.patch

@@ -1,26 +0,0 @@
-From 26ea25aacc1e70f4d142d8f041da2065509c0b51 Mon Sep 17 00:00:00 2001
-From: zwtmichael <zhuwentao5@huawei.com>
-Date: Tue, 30 Aug 2022 17:02:04 +0800
-Subject: [PATCH] fix memory problem in the rtree test suite
-
-Reference:https://gitee.com/src-openeuler/sqlite/blob/openEuler-22.03-LTS-SP3/0004-fix-memory-problem-in-the-rtree-test-suite.patch
-Conflict: BoxQueryCtx change to BoxGeomCtx
----
- ext/rtree/test_rtreedoc.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/ext/rtree/test_rtreedoc.c b/ext/rtree/test_rtreedoc.c
-index cdbcb2e..59a7942 100644
---- a/ext/rtree/test_rtreedoc.c
-+++ b/ext/rtree/test_rtreedoc.c
-@@ -188,7 +188,7 @@ static int SQLITE_TCLAPI register_box_geom(
-   }
-   if( getDbPointer(interp, Tcl_GetString(objv[1]), &db) ) return TCL_ERROR;
- 
--  pCtx = (BoxGeomCtx*)ckalloc(sizeof(BoxGeomCtx*));
-+  pCtx = (BoxGeomCtx*)ckalloc(sizeof(BoxGeomCtx));
-   pCtx->interp = interp;
-   pCtx->pScript = Tcl_DuplicateObj(objv[2]);
-   Tcl_IncrRefCount(pCtx->pScript);
--- 
-2.33.0

backport-0004-CVE-2023-36191.patch

@@ -1,34 +0,0 @@
-From c5c8e025ff6cf0f7400b17aec73014e9cdc00935 Mon Sep 17 00:00:00 2001
-From: zwtmichael <zhuwentao5@huawei.com>
-Date: Mon, 7 Aug 2023 15:10:32 +0800
-Subject: [PATCH] fix segmentation violation
-
-Reference:https://gitee.com/src-openeuler/sqlite/blob/openEuler-22.03-LTS-SP3/0007-CVE-2023-36191.patch
-Conflict:context adaptation
-
-Signed-off-by: zwtmichael <zhuwentao5@huawei.com>
----
- src/shell.c.in | 8 ++++++--
- 1 file changed, 6 insertions(+), 2 deletions(-)
-
-diff --git a/src/shell.c.in b/src/shell.c.in
-index 72e4498..355b4bb 100644
---- a/src/shell.c.in
-+++ b/src/shell.c.in
-@@ -12219,8 +12219,12 @@ int SQLITE_CDECL wmain(int argc, wchar_t **wargv){
-     }else if( cli_strcmp(z,"-bail")==0 ){
-       bail_on_error = 1;
-     }else if( cli_strcmp(z,"-nonce")==0 ){
--      free(data.zNonce);
--      data.zNonce = strdup(argv[++i]);
-+      if( data.zNonce ) free(data.zNonce);
-+      if( i + 1 < argc ) data.zNonce = strdup(argv[++i]);
-+      else{
-+	      data.zNonce = 0;
-+	      break;
-+      }
-     }else if( cli_strcmp(z,"-unsafe-testing")==0 ){
-       ShellSetFlag(&data,SHFLG_TestingMode);
-     }else if( cli_strcmp(z,"-safe")==0 ){
--- 
-2.33.0

backport-CVE-2023-7104.patch

@@ -1,46 +0,0 @@
-From 310e27eec4eb0e6c5cbc7bad6d3c0ad71619cb44 Mon Sep 17 00:00:00 2001
-From: dan <Dan Kennedy>
-Date: Thu, 7 Sep 2023 13:53:09 +0000
-Subject: [PATCH] Fix a buffer overread in the sessions extension that could
- occur when processing a corrupt changeset.
-
-Reference:https://sqlite.org/src/info/0e4e7a05c4204b47
-Conflict:NA
-
----
- ext/session/sqlite3session.c | 18 +++++++++++-------
- 1 file changed, 11 insertions(+), 7 deletions(-)
-
-diff --git a/ext/session/sqlite3session.c b/ext/session/sqlite3session.c
-index a892804..72ad427 100644
---- a/ext/session/sqlite3session.c
-+++ b/ext/session/sqlite3session.c
-@@ -3050,15 +3050,19 @@ static int sessionReadRecord(
-         }
-       }
-       if( eType==SQLITE_INTEGER || eType==SQLITE_FLOAT ){
--        sqlite3_int64 v = sessionGetI64(aVal);
--        if( eType==SQLITE_INTEGER ){
--          sqlite3VdbeMemSetInt64(apOut[i], v);
-+        if( (pIn->nData-pIn->iNext)<8 ){
-+          rc = SQLITE_CORRUPT_BKPT;
-         }else{
--          double d;
--          memcpy(&d, &v, 8);
--          sqlite3VdbeMemSetDouble(apOut[i], d);
-+          sqlite3_int64 v = sessionGetI64(aVal);
-+          if( eType==SQLITE_INTEGER ){
-+            sqlite3VdbeMemSetInt64(apOut[i], v);
-+          }else{
-+            double d;
-+            memcpy(&d, &v, 8);
-+            sqlite3VdbeMemSetDouble(apOut[i], d);
-+          }
-+          pIn->iNext += 8;
-         }
--        pIn->iNext += 8;
-       }
-     }
-   }
--- 
-2.33.0

sqlite.spec

@@ -1,29 +1,29 @@
 %bcond_without check
 
-%global extver 3420000
+%global extver 3320300
 %global tcl_version 8.6
 %global tcl_sitearch %{_libdir}/tcl%{tcl_version}
+%global year 2020
 
 Name:    sqlite
-Version: 3.42.0
+Version: 3.32.3
 Release: 3
 Summary: Embeded SQL database
 License: Public Domain
 URL:     http://www.sqlite.org/
 
-Source0: https://www.sqlite.org/2023/sqlite-src-%{extver}.zip
-Source1: http://www.sqlite.org/2023/sqlite-doc-%{extver}.zip
-Source2: https://www.sqlite.org/2023/sqlite-autoconf-%{extver}.tar.gz
+Source0: https://www.sqlite.org/%{year}/sqlite-src-%{extver}.zip
+Source1: http://www.sqlite.org/%{year}/sqlite-doc-%{extver}.zip
+Source2: https://www.sqlite.org/%{year}/sqlite-autoconf-%{extver}.tar.gz
 
-Patch6000: backport-0001-sqlite-no-malloc-usable-size.patch
-Patch6001: backport-0002-remove-fail-testcase-in-no-free-fd-situation.patch 
-Patch6002: backport-0003-fix-memory-problem-in-the-rtree-test-suite.patch
-Patch6003: backport-0004-CVE-2023-36191.patch
-Patch6004: backport-CVE-2023-7104.patch
+Patch1: 0001-sqlite-no-malloc-usable-size.patch
+Patch2: 0002-remove-fail-testcase-in-no-free-fd-situation.patch
+Patch3: CVE-2021-20227.patch
 
 BuildRequires: gcc autoconf tcl tcl-devel
 BuildRequires: ncurses-devel readline-devel glibc-devel
 
+
 Provides:  %{name}-libs
 Obsoletes: %{name}-libs
 Provides:  lemon
@@ -61,17 +61,16 @@ This contains man files and HTML files for the using of sqlite.
 %prep
 #autosetup will fail because of 2 zip files
 %setup -q -a1 -n %{name}-src-%{extver}
-%patch6000 -p1
-%patch6001 -p1
-%patch6002 -p1
-%patch6003 -p1
-%patch6004 -p1
+%patch1 -p1
+%patch2 -p1
+%patch3 -p1
+
 
 rm -f %{name}-doc-%{extver}/sqlite.css~ || :
 
-%build
-
 autoconf
+
+%build
 export CFLAGS="$RPM_OPT_FLAGS $RPM_LD_FLAGS -DSQLITE_ENABLE_COLUMN_METADATA=1 \
                -DSQLITE_DISABLE_DIRSYNC=1 -DSQLITE_ENABLE_FTS3=3 \
                -DSQLITE_ENABLE_RTREE=1 -DSQLITE_SECURE_DELETE=1 \
@@ -107,15 +106,13 @@ chmod 755 %{buildroot}/%{tcl_sitearch}/sqlite3/*.so
 %check
 export LD_LIBRARY_PATH=`pwd`/.libs
 export MALLOC_CHECK_=3
+#bypass zipfile.test
+rm test/zipfile.test
 
 %ifarch x86_64 %{ix86}
 %else
 rm test/csv01.test
 %endif
-%ifarch loongarch64
-rm -rf test/thread1.test
-rm -rf test/thread2.test
-%endif
 
 make test
 %endif # with check
@@ -140,89 +137,50 @@ make test
 %{_mandir}/man*/*
 
 %changelog
-* Mon Nov 11 2024 wangmian <wangmian19@h-partners.com> - 3.42.0-3
-- sync the patch from 2203
+* Mon Apr 26 2021 bzhaoop<bzhaojyathousandy@gmail.com> - 3.32.3-3
+- Fix CVE-2021-20227
 
-* Wed Sep 4 2024 wangmian <wangmian19@h-partners.com> - 3.42.0-2
-- sync the CVE-2023-7104 from 2203
-
-* Tue Feb 27 2024 Zheng Zhenyu <zheng.zhenyu@outlook.com> - 3.42.0-1
-- Bump version to fix CVE-2024-0232
-
-* Wed Jan 3 2024 mazhao <mazhao12@huawei.com> - 3.37.2-7
-- fix the CVE-2023-7104
-
-* Mon Aug 7 2023 zhuwentao <zhuwentao5@huawei.com> - 3.37.2-6
-- fix the CVE-2023-36191
-
-* Fri Jan 13 2023 Wenlong Zhang<zhangwenlong@loongson.cn> - 3.37.2-5
-- remove fail testcase for loongarch
-
-* Wed Dec 14 2022 zhuwentao <zhuwentao5@huawei.com> - 3.37.2-4
-- fix the CVE-2022-46908
-
-* Wed Sep 14 2022 zhuwentao <zhuwentao5@huawei.com> - 3.37.2-3
-- fix build problem
-
-* Mon Sep 5 2022 zhuwentao <zhuwentao5@huawei.com> - 3.37.2-2
-- fix integer overflow on gigabyte string
-
-* Mon Aug 29 2022 zhuwentao <zhuwentao5@huawei.com> - 3.37.2-1
-- update to 3.37.2
-
-* Tue Aug 16 2022 liusirui <liusirui@huawei.com> - 3.36.0-3
-- fix the CVE-2022-35737.
-
-* Sat Nov 27 2021 wbq_sky <wangbingquan@huawei.com> - 3.36.0-2
-- fix the CVE-2021-36690.
-
-* Fri Nov 25 2021 wbq_sky <wangbingquan@huawei.com> - 3.36.0-1
-- update to 3.36.0.
-
-* Fri Sep 26 2021 wbq_sky <wangbingquan@huawei.com> - 3.34.0-4
-- fix the uninitialized value used in pattern match.
-
-* Fri Sep 3 2021 wbq_sky <wangbingquan@huawei.com> - 3.34.0-3
-- fix the null reference in the tigger statement.
-
-* Fri Sep 3 2021 wbq_sky <wangbingquan@huawei.com> - 3.34.0-2
-- fix the infinite loop problem in the trim function while the pattern is well formed.
-
-* Thu Jan 14 2021 yanglongkang <yanglongkang@huawei.com> - 3.34.0-1
-- update package to 3.34.0
-
-* Thu Sep 3 2020 lihaotian<lihaotian9@huawei.com> - 3.32.3-3
+* Thu Sep 2 2020 lihaotian<lihaotian9@huawei.com> - 3.32.3-2
 - update source0 url
 
-* Tue Jul 21 2020 jixinjie <jixinjie@huawei.com> - 3.32.3-2
-- update yaml file
-
-* Tue Jul 21 2020 jixinjie <jixinjie@huawei.com> - 3.32.3-1
+* Tue Aug 25 2020 yanglongkang <yanglongkang@huawei.com> - 3.32.3-1
 - update package to 3.32.3
 
-* Tue Jun 30 2020 volcanodragon <linfeilong@huawei.com> - 3.24.0-12
-- Type:enhancement
-- ID:NA
-- SUG:NA
-- DESC:rename patches
-
-* Tue Jun 23 2020 yanglongkang <yanglongkang@huawei.com> - 3.24.0-11
+* Tue Aug 4 2020 yanglongkang <yanglongkang@huawei.com> - 3.31.1-2
 - Type:cves
-- ID:CVE-2020-13434 CVE-2020-13435 CVE-2020-13630 CVE-2020-13632
-- SUG:NA
-- DESC:fix CVE-2020-13434 CVE-2020-13435 CVE-2020-13630 CVE-2020-13632
+- ID:CVE-2020-13871
+- SUG: NA
+- DESC: fix cve
 
-* Sun Apr 19 2020 ethan848 <mingfangsen@huawei.com>
+* Mon Aug 3 2020 yanglongkang <yanglongkang@huawei.com> - 3.31.1-1
+- Type:cves
+- ID:CVE-2020-15358 CVE-2020-13631
+- SUG: NA
+- DESC: fix cve
+
+* Fri Apr 17 2020 luoshijie <luoshijie1@huawei.com> - 3.31.1-0
 - Type:enhancement
 - ID:NA
-- SUG:NA
-- DESC:CVE-2020-11655 fixed
+- SUG:restart
+- DESC:update sqlite to 3.31.1.
 
-* Tue Mar 10 2020 steven <steven_ygui@163.com> - 3.24.0-9
+* Tue Mar 10 2020 guiyao <guiyao@huawei.com> - 3.24.0-11
+- Type:cves
+- ID:CVE-2020-9327
+- SUG: NA
+- DESC: fix cve
+
+* Fri Feb 28 2020 sunshihao <sunshihao@huawei.com> - 3.24.0-10
 - Type:enhancement
-- ID:NA
+- ID:
+- SUG: NA
+- DESC: remove suffix information
+
+* Wed Feb 26 2020 guiyao <guiyao@huawei.com> - 3.24.0-9
+- Type:cves
+- ID:CVE-2018-20505
 - SUG:NA
-- DESC:CVE-2018-20505, CVE-2020-9327 fixed
+- DESC:fix cves
 
 * Wed Jan 11 2020 openEuler Buildteam <buildteam@openeuler.org> - 3.24.0-8
 - Type:enhancement

sqlite.yaml

@@ -1,4 +0,0 @@
-version_control: fossil
-src_repo: https://www.sqlite.org/src
-tag_prefix: "version-"
-seperator: "."