mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-06-02 13:29:49 +00:00
Code Issues Projects Releases Wiki Activity

sqlite3: Fix CVE-2020-35525

Browse Source 
Add patch to fix CVE-2020-35525

Reference:
http://security.debian.org/debian-security/pool/updates/main/s/sqlite3/sqlite3_3.27.2-3+deb10u2.debian.tar.xz

(From OE-Core rev: ced472cf1d195a1a856d24240dbd6ee91140a347)

Signed-off-by: Virendra Thakur <virendrak@kpit.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Virendra Thakur
2022-09-15 18:02:41 +05:30
committed by Richard Purdie
parent 65cf3249fa
commit 8b52687223
2 changed files with 22 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta/recipes-support/sqlite/files/CVE-2020-35525.patch
+21
View File
@@ -0,0 +1,21 @@
From: drh <drh@noemail.net>
Date: Thu, 20 Feb 2020 14:08:51 +0000
Subject: [PATCH] Early-out on the INTERSECT query processing following an
error.
Upstream-Status: Backport [http://security.debian.org/debian-security/pool/updates/main/s/sqlite3/sqlite3_3.27.2-3+deb10u2.debian.tar.xz]
CVE: CVE-2020-35525
Signed-off-by: Virendra Thakur <virendrak@kpit.com>
---
Index: sqlite-autoconf-3310100/sqlite3.c
===================================================================
--- sqlite-autoconf-3310100.orig/sqlite3.c
+++ sqlite-autoconf-3310100/sqlite3.c
@@ -130767,6 +130767,7 @@ static int multiSelect(
/* Generate code to take the intersection of the two temporary
** tables.
*/
+ if( rc ) break;
assert( p->pEList );
iBreak = sqlite3VdbeMakeLabel(pParse);
iCont = sqlite3VdbeMakeLabel(pParse);
meta/recipes-support/sqlite/sqlite3_3.31.1.bb
+1
View File
@@ -14,6 +14,7 @@ SRC_URI = "http://www.sqlite.org/2020/sqlite-autoconf-${SQLITE_PV}.tar.gz \
file://CVE-2020-13631.patch \
file://CVE-2020-13632.patch \
file://CVE-2022-35737.patch \
file://CVE-2020-35525.patch \
"
SRC_URI[md5sum] = "2d0a553534c521504e3ac3ad3b90f125"
SRC_URI[sha256sum] = "62284efebc05a76f909c580ffa5c008a7d22a1287285d68b7825a2b6b51949ae"