Skip to content

Commit 1472413

Browse files
[AUTO-CHERRYPICK] Patch sqlite for CVE-2025-6965 [High] - branch 3.0-dev (#14484)
Signed-off-by: Madhur Aggarwal <[email protected]> Co-authored-by: Madhur Aggarwal <[email protected]>
1 parent 27efc29 commit 1472413

File tree

7 files changed

+125
-51
lines changed

7 files changed

+125
-51
lines changed

SPECS/sqlite/CVE-2022-46908.patch

Lines changed: 0 additions & 35 deletions
This file was deleted.

SPECS/sqlite/CVE-2025-6965.patch

Lines changed: 105 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,105 @@
1+
From 1cc975ab5c8a066268501f98c71a54d20939f5e7 Mon Sep 17 00:00:00 2001
2+
From: Madhur Aggarwal <[email protected]>
3+
Date: Thu, 24 Jul 2025 10:43:07 +0000
4+
Subject: [PATCH] Patch CVE-2025-6965
5+
6+
Upstream Patch Reference: https://www.sqlite.org/src/vpatch?from=c9ddd15b0197e6e5&to=5508b56fd24016c1
7+
---
8+
sqlite3.c | 25 +++++++++++++++++++++----
9+
1 file changed, 21 insertions(+), 4 deletions(-)
10+
11+
diff --git a/sqlite3.c b/sqlite3.c
12+
index 8f9309a..dd0c5f4 100644
13+
--- a/sqlite3.c
14+
+++ b/sqlite3.c
15+
@@ -14867,6 +14867,9 @@ typedef INT16_TYPE LogEst;
16+
#define LARGEST_INT64 (0xffffffff|(((i64)0x7fffffff)<<32))
17+
#define LARGEST_UINT64 (0xffffffff|(((u64)0xffffffff)<<32))
18+
#define SMALLEST_INT64 (((i64)-1) - LARGEST_INT64)
19+
+#define SMXV(n) ((((i64)1)<<(sizeof(n)*8-1))-1)
20+
+#define UMXV(n) ((((i64)1)<<(sizeof(n)*8))-1)
21+
+
22+
23+
/*
24+
** Round up a number to the next larger multiple of 8. This is used
25+
@@ -18637,7 +18640,7 @@ struct AggInfo {
26+
** from source tables rather than from accumulators */
27+
u8 useSortingIdx; /* In direct mode, reference the sorting index rather
28+
** than the source table */
29+
- u16 nSortingColumn; /* Number of columns in the sorting index */
30+
+ u32 nSortingColumn; /* Number of columns in the sorting index */
31+
int sortingIdx; /* Cursor number of the sorting index */
32+
int sortingIdxPTab; /* Cursor number of pseudo-table */
33+
int iFirstReg; /* First register in range for aCol[] and aFunc[] */
34+
@@ -18646,8 +18649,8 @@ struct AggInfo {
35+
Table *pTab; /* Source table */
36+
Expr *pCExpr; /* The original expression */
37+
int iTable; /* Cursor number of the source table */
38+
- i16 iColumn; /* Column number within the source table */
39+
- i16 iSorterColumn; /* Column number in the sorting index */
40+
+ int iColumn; /* Column number within the source table */
41+
+ int iSorterColumn; /* Column number in the sorting index */
42+
} *aCol;
43+
int nColumn; /* Number of used entries in aCol[] */
44+
int nAccumulator; /* Number of columns that show through to the output.
45+
@@ -114514,7 +114517,9 @@ static void findOrCreateAggInfoColumn(
46+
){
47+
struct AggInfo_col *pCol;
48+
int k;
49+
+ int mxTerm = pParse->db->aLimit[SQLITE_LIMIT_COLUMN];
50+
51+
+ assert( mxTerm <= SMXV(i16) );
52+
assert( pAggInfo->iFirstReg==0 );
53+
pCol = pAggInfo->aCol;
54+
for(k=0; k<pAggInfo->nColumn; k++, pCol++){
55+
@@ -114532,6 +114537,10 @@ static void findOrCreateAggInfoColumn(
56+
assert( pParse->db->mallocFailed );
57+
return;
58+
}
59+
+ if( k>mxTerm ){
60+
+ sqlite3ErrorMsg(pParse, "more than %d aggregate terms", mxTerm);
61+
+ k = mxTerm;
62+
+ }
63+
pCol = &pAggInfo->aCol[k];
64+
assert( ExprUseYTab(pExpr) );
65+
pCol->pTab = pExpr->y.pTab;
66+
@@ -114565,6 +114574,7 @@ fix_up_expr:
67+
if( pExpr->op==TK_COLUMN ){
68+
pExpr->op = TK_AGG_COLUMN;
69+
}
70+
+ assert( k <= SMXV(pExpr->iAgg) );
71+
pExpr->iAgg = (i16)k;
72+
}
73+
74+
@@ -114648,13 +114658,19 @@ static int analyzeAggregate(Walker *pWalker, Expr *pExpr){
75+
** function that is already in the pAggInfo structure
76+
*/
77+
struct AggInfo_func *pItem = pAggInfo->aFunc;
78+
+ int mxTerm = pParse->db->aLimit[SQLITE_LIMIT_COLUMN];
79+
+ assert( mxTerm <= SMXV(i16) );
80+
for(i=0; i<pAggInfo->nFunc; i++, pItem++){
81+
if( pItem->pFExpr==pExpr ) break;
82+
if( sqlite3ExprCompare(0, pItem->pFExpr, pExpr, -1)==0 ){
83+
break;
84+
}
85+
}
86+
- if( i>=pAggInfo->nFunc ){
87+
+ if( i>mxTerm ){
88+
+ sqlite3ErrorMsg(pParse, "more than %d aggregate terms", mxTerm);
89+
+ i = mxTerm;
90+
+ assert( i<pAggInfo->nFunc );
91+
+ }else if( i>=pAggInfo->nFunc ){
92+
/* pExpr is original. Make a new entry in pAggInfo->aFunc[]
93+
*/
94+
u8 enc = ENC(pParse->db);
95+
@@ -114706,6 +114722,7 @@ static int analyzeAggregate(Walker *pWalker, Expr *pExpr){
96+
*/
97+
assert( !ExprHasProperty(pExpr, EP_TokenOnly|EP_Reduced) );
98+
ExprSetVVAProperty(pExpr, EP_NoReduce);
99+
+ assert( i <= SMXV(pExpr->iAgg) );
100+
pExpr->iAgg = (i16)i;
101+
pExpr->pAggInfo = pAggInfo;
102+
return WRC_Prune;
103+
--
104+
2.45.4
105+

SPECS/sqlite/sqlite.spec

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
Summary: A portable, high level programming interface to various calling conventions
33
Name: sqlite
44
Version: 3.44.0
5-
Release: 1%{?dist}
5+
Release: 2%{?dist}
66
License: Public Domain
77
Vendor: Microsoft Corporation
88
Distribution: Azure Linux
@@ -11,7 +11,7 @@ URL: https://www.sqlite.org
1111
Source0: https://www.sqlite.org/2023/%{name}-autoconf-%{sourcever}.tar.gz
1212
# CVE-2015-3717 applies to versions shipped in iOS and OS X
1313
Patch0: CVE-2015-3717.nopatch
14-
#Patch1: CVE-2022-46908.patch
14+
Patch1: CVE-2025-6965.patch
1515
Requires: sqlite-libs = %{version}-%{release}
1616
Provides: sqlite3
1717

@@ -82,6 +82,10 @@ make %{?_smp_mflags} check
8282
%{_libdir}/libsqlite3.so.0.8.6
8383

8484
%changelog
85+
* Thu Jul 24 2025 Madhur Aggarwal <[email protected]> - 3.44.0-2
86+
- Patch CVE-2025-6965
87+
- remove unused patch file from SPEC folder.
88+
8589
* Fri Nov 10 2023 Andrew Phelps <[email protected]> - 3.44.0-1
8690
- Upgrade to version 3.44.0
8791

toolkit/resources/manifests/package/pkggen_core_aarch64.txt

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -88,9 +88,9 @@ bison-3.8.2-1.azl3.aarch64.rpm
8888
popt-1.19-1.azl3.aarch64.rpm
8989
popt-devel-1.19-1.azl3.aarch64.rpm
9090
popt-lang-1.19-1.azl3.aarch64.rpm
91-
sqlite-3.44.0-1.azl3.aarch64.rpm
92-
sqlite-devel-3.44.0-1.azl3.aarch64.rpm
93-
sqlite-libs-3.44.0-1.azl3.aarch64.rpm
91+
sqlite-3.44.0-2.azl3.aarch64.rpm
92+
sqlite-devel-3.44.0-2.azl3.aarch64.rpm
93+
sqlite-libs-3.44.0-2.azl3.aarch64.rpm
9494
elfutils-0.189-5.azl3.aarch64.rpm
9595
elfutils-default-yama-scope-0.189-5.azl3.noarch.rpm
9696
elfutils-devel-0.189-5.azl3.aarch64.rpm

toolkit/resources/manifests/package/pkggen_core_x86_64.txt

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -88,9 +88,9 @@ bison-3.8.2-1.azl3.x86_64.rpm
8888
popt-1.19-1.azl3.x86_64.rpm
8989
popt-devel-1.19-1.azl3.x86_64.rpm
9090
popt-lang-1.19-1.azl3.x86_64.rpm
91-
sqlite-3.44.0-1.azl3.x86_64.rpm
92-
sqlite-devel-3.44.0-1.azl3.x86_64.rpm
93-
sqlite-libs-3.44.0-1.azl3.x86_64.rpm
91+
sqlite-3.44.0-2.azl3.x86_64.rpm
92+
sqlite-devel-3.44.0-2.azl3.x86_64.rpm
93+
sqlite-libs-3.44.0-2.azl3.x86_64.rpm
9494
elfutils-0.189-5.azl3.x86_64.rpm
9595
elfutils-default-yama-scope-0.189-5.azl3.noarch.rpm
9696
elfutils-devel-0.189-5.azl3.x86_64.rpm

toolkit/resources/manifests/package/toolchain_aarch64.txt

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -573,10 +573,10 @@ sed-lang-4.9-1.azl3.aarch64.rpm
573573
slang-2.3.3-1.azl3.aarch64.rpm
574574
slang-debuginfo-2.3.3-1.azl3.aarch64.rpm
575575
slang-devel-2.3.3-1.azl3.aarch64.rpm
576-
sqlite-3.44.0-1.azl3.aarch64.rpm
577-
sqlite-debuginfo-3.44.0-1.azl3.aarch64.rpm
578-
sqlite-devel-3.44.0-1.azl3.aarch64.rpm
579-
sqlite-libs-3.44.0-1.azl3.aarch64.rpm
576+
sqlite-3.44.0-2.azl3.aarch64.rpm
577+
sqlite-debuginfo-3.44.0-2.azl3.aarch64.rpm
578+
sqlite-devel-3.44.0-2.azl3.aarch64.rpm
579+
sqlite-libs-3.44.0-2.azl3.aarch64.rpm
580580
swig-4.2.1-1.azl3.aarch64.rpm
581581
swig-debuginfo-4.2.1-1.azl3.aarch64.rpm
582582
systemd-bootstrap-250.3-18.azl3.aarch64.rpm

toolkit/resources/manifests/package/toolchain_x86_64.txt

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -581,10 +581,10 @@ sed-lang-4.9-1.azl3.x86_64.rpm
581581
slang-2.3.3-1.azl3.x86_64.rpm
582582
slang-debuginfo-2.3.3-1.azl3.x86_64.rpm
583583
slang-devel-2.3.3-1.azl3.x86_64.rpm
584-
sqlite-3.44.0-1.azl3.x86_64.rpm
585-
sqlite-debuginfo-3.44.0-1.azl3.x86_64.rpm
586-
sqlite-devel-3.44.0-1.azl3.x86_64.rpm
587-
sqlite-libs-3.44.0-1.azl3.x86_64.rpm
584+
sqlite-3.44.0-2.azl3.x86_64.rpm
585+
sqlite-debuginfo-3.44.0-2.azl3.x86_64.rpm
586+
sqlite-devel-3.44.0-2.azl3.x86_64.rpm
587+
sqlite-libs-3.44.0-2.azl3.x86_64.rpm
588588
swig-4.2.1-1.azl3.x86_64.rpm
589589
swig-debuginfo-4.2.1-1.azl3.x86_64.rpm
590590
systemd-bootstrap-250.3-18.azl3.x86_64.rpm

0 commit comments

Comments
 (0)