SQLite extension needs an update

[Shakil-Shahadat]

Description

The current PHP version 8.4.10 comes with SQLite version 3.46.0. The latest SQLite version is 3.50.2 according to SQLite website. Thus, the SQLite version is outdated and needs an update.

Thank you.

[iluuu1994]

PHP doesn't come with SQLite, it is provided by your distribution. Make sure to upgrade your packages, switch to a distribution that provides more up-to-date packages or alternatively provide a newer version of SQLite during the compilation of PHP yourself.

[Shakil-Shahadat]

Thanks for the reply. I don't compile PHP myself, I use the one available from https://windows.php.net/download. It indeed comes with an extension named php_sqlite3.dll. I was talking about this.

[iluuu1994]

Ah, apologies, I didn't realize you're on Windows as it wasn't mentioned in the report. /cc @cmb69 @shivammathur

[cmb69]

Well, it may or may not be a good idea to push "arbitrary" updates to stable branches, but from looking at https://www.sqlite.org/news.html, it probably makes sense to update to 3.49.2.

[shivammathur]

@cmb69 @iluuu1994 I will go ahead and update it to 3.49.2 for 8.4 and the master branch.

[cmb69]

Yeah, I think that is the best solution. 8.3 uses SQLite 3.40.0, so the 3.49.2 issue would apply, but I don't quite understand:

that if abused by an attacker with SQL injection capabilities can lead to read off the end of a static array, resulting in a segfault and possible denial of service.

I mean, if an attacker has SQL injection capabilities, DOS might not be the biggest problem.

[shivammathur]

Done, I have upgraded it to 3.49.2 for now. Tested building with 8.4.10 and master.