diff --git a/6047-Fix-CVE-2019-9936.patch b/6047-Fix-CVE-2019-9936.patch new file mode 100644 index 0000000000000000000000000000000000000000..28709c589edc88fef5d7b21ab7feba7f852a3b53 --- /dev/null +++ b/6047-Fix-CVE-2019-9936.patch @@ -0,0 +1,50 @@ +From abaf16dea291800e0f450c0b60d9da9f2149d6a9 Mon Sep 17 00:00:00 2001 +From: openEuler Buildteam +Date: Mon, 30 Dec 2019 16:17:34 -0500 +Subject: [PATCH] fix CVE-2019-9936 + +--- + ext/fts5/fts5_hash.c | 3 ++- + ext/fts5/test/fts5aa.test | 12 ++++++++++++ + 2 files changed, 14 insertions(+), 1 deletion(-) + +diff --git a/ext/fts5/fts5_hash.c b/ext/fts5/fts5_hash.c +index 7e404a8..c35b5d5 100644 +--- a/ext/fts5/fts5_hash.c ++++ b/ext/fts5/fts5_hash.c +@@ -445,7 +445,8 @@ static int fts5HashEntrySort( + for(iSlot=0; iSlotnSlot; iSlot++){ + Fts5HashEntry *pIter; + for(pIter=pHash->aSlot[iSlot]; pIter; pIter=pIter->pHashNext){ +- if( pTerm==0 || 0==memcmp(fts5EntryKey(pIter), pTerm, nTerm) ){ ++ if( pTerm==0 ++ || (pIter->nKey+1>=nTerm && 0==memcmp(fts5EntryKey(pIter), pTerm, nTerm)) ){ + Fts5HashEntry *pEntry = pIter; + pEntry->pScanNext = 0; + for(i=0; ap[i]; i++){ +diff --git a/ext/fts5/test/fts5aa.test b/ext/fts5/test/fts5aa.test +index 6fa3ad8..5c9b894 100644 +--- a/ext/fts5/test/fts5aa.test ++++ b/ext/fts5/test/fts5aa.test +@@ -603,6 +603,18 @@ do_execsql_test 23.2 { + SELECT * FROM t11, t10 WHERE t10.rowid IS NULL; + } + ++#------------------------------------------------------------------------- ++do_execsql_test 25.0 { ++ CREATE VIRTUAL TABLE t13 USING fts5(x, detail=%DETAIL%); ++} ++do_execsql_test 25.1 { ++ BEGIN; ++ INSERT INTO t13 VALUES('AAAA'); ++SELECT * FROM t13('BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB*'); ++ ++ END; ++} ++ + } + + expand_all_sql db +-- +1.8.3.1 + diff --git a/6048-Fix-CVE-2019-9937.patch b/6048-Fix-CVE-2019-9937.patch new file mode 100644 index 0000000000000000000000000000000000000000..e8e32d03d97d9f4a9191da518458375b787ce047 --- /dev/null +++ b/6048-Fix-CVE-2019-9937.patch @@ -0,0 +1,410 @@ +From cc12b9c512451199cacf89a999977886ba4f183e Mon Sep 17 00:00:00 2001 +From: guiyao +Date: Tue, 31 Dec 2019 21:45:30 -0500 +Subject: [PATCH] backport-fix-CVE-2019-9937 + +--- + ext/fts5/fts5Int.h | 3 ++- + ext/fts5/fts5_hash.c | 55 ++++++++++++++++++++++++++++++++--------------- + ext/fts5/fts5_index.c | 25 ++++++++++++++------- + ext/fts5/test/fts5aa.test | 21 +++++++++++++++++- + 4 files changed, 77 insertions(+), 27 deletions(-) + +diff --git a/ext/fts5/fts5Int.h b/ext/fts5/fts5Int.h +index 1f8a297..984d625 100644 +--- a/ext/fts5/fts5Int.h ++++ b/ext/fts5/fts5Int.h +@@ -565,8 +565,9 @@ void sqlite3Fts5HashClear(Fts5Hash*); + + int sqlite3Fts5HashQuery( + Fts5Hash*, /* Hash table to query */ ++ int nPre, + const char *pTerm, int nTerm, /* Query term */ +- const u8 **ppDoclist, /* OUT: Pointer to doclist for pTerm */ ++ void **ppObj, /* OUT: Pointer to doclist for pTerm */ + int *pnDoclist /* OUT: Size of doclist in bytes */ + ); + +diff --git a/ext/fts5/fts5_hash.c b/ext/fts5/fts5_hash.c +index c35b5d5..eae785a 100644 +--- a/ext/fts5/fts5_hash.c ++++ b/ext/fts5/fts5_hash.c +@@ -187,19 +187,25 @@ static int fts5HashResize(Fts5Hash *pHash){ + return SQLITE_OK; + } + +-static void fts5HashAddPoslistSize(Fts5Hash *pHash, Fts5HashEntry *p){ ++static int fts5HashAddPoslistSize( ++ Fts5Hash *pHash, ++ Fts5HashEntry *p, ++ Fts5HashEntry *p2 ++){ ++ int nRet = 0; + if( p->iSzPoslist ){ +- u8 *pPtr = (u8*)p; ++ u8 *pPtr = p2 ? (u8*)p2 : (u8*)p; ++ int nData = p->nData; + if( pHash->eDetail==FTS5_DETAIL_NONE ){ +- assert( p->nData==p->iSzPoslist ); ++ assert( nData==p->iSzPoslist ); + if( p->bDel ){ +- pPtr[p->nData++] = 0x00; ++ pPtr[nData++] = 0x00; + if( p->bContent ){ +- pPtr[p->nData++] = 0x00; ++ pPtr[nData++] = 0x00; + } + } + }else{ +- int nSz = (p->nData - p->iSzPoslist - 1); /* Size in bytes From cc12b9c512451199cacf89a999977886ba4f183e Mon Sep 17 00:00:00 2001 +From: guiyao +Date: Tue, 31 Dec 2019 21:45:30 -0500 +Subject: [PATCH] backport-fix-CVE-2019-9937 + +--- + ext/fts5/fts5Int.h | 3 ++- + ext/fts5/fts5_hash.c | 55 ++++++++++++++++++++++++++++++++--------------- + ext/fts5/fts5_index.c | 25 ++++++++++++++------- + ext/fts5/test/fts5aa.test | 21 +++++++++++++++++- + 4 files changed, 77 insertions(+), 27 deletions(-) + +diff --git a/ext/fts5/fts5Int.h b/ext/fts5/fts5Int.h +index 1f8a297..984d625 100644 +--- a/ext/fts5/fts5Int.h ++++ b/ext/fts5/fts5Int.h +@@ -565,8 +565,9 @@ void sqlite3Fts5HashClear(Fts5Hash*); + + int sqlite3Fts5HashQuery( + Fts5Hash*, /* Hash table to query */ ++ int nPre, + const char *pTerm, int nTerm, /* Query term */ +- const u8 **ppDoclist, /* OUT: Pointer to doclist for pTerm */ ++ void **ppObj, /* OUT: Pointer to doclist for pTerm */ + int *pnDoclist /* OUT: Size of doclist in bytes */ + ); + +diff --git a/ext/fts5/fts5_hash.c b/ext/fts5/fts5_hash.c +index c35b5d5..eae785a 100644 +--- a/ext/fts5/fts5_hash.c ++++ b/ext/fts5/fts5_hash.c +@@ -187,19 +187,25 @@ static int fts5HashResize(Fts5Hash *pHash){ + return SQLITE_OK; + } + +-static void fts5HashAddPoslistSize(Fts5Hash *pHash, Fts5HashEntry *p){ ++static int fts5HashAddPoslistSize( ++ Fts5Hash *pHash, ++ Fts5HashEntry *p, ++ Fts5HashEntry *p2 ++){ ++ int nRet = 0; + if( p->iSzPoslist ){ +- u8 *pPtr = (u8*)p; ++ u8 *pPtr = p2 ? (u8*)p2 : (u8*)p; ++ int nData = p->nData; + if( pHash->eDetail==FTS5_DETAIL_NONE ){ +- assert( p->nData==p->iSzPoslist ); ++ assert( nData==p->iSzPoslist ); + if( p->bDel ){ +- pPtr[p->nData++] = 0x00; ++ pPtr[nData++] = 0x00; + if( p->bContent ){ +- pPtr[p->nData++] = 0x00; ++ pPtr[nData++] = 0x00; + } + } + }else{ +- int nSz = (p->nData - p->iSzPoslist - 1); /* Size in bytes vFrom cc12b9c512451199cacf89a999977886ba4f183e Mon Sep 17 00:00:00 2001 +From: guiyao +Date: Tue, 31 Dec 2019 21:45:30 -0500 +Subject: [PATCH] backport-fix-CVE-2019-9937 + +--- + ext/fts5/fts5Int.h | 3 ++- + ext/fts5/fts5_hash.c | 55 ++++++++++++++++++++++++++++++++--------------- + ext/fts5/fts5_index.c | 25 ++++++++++++++------- + ext/fts5/test/fts5aa.test | 21 +++++++++++++++++- + 4 files changed, 77 insertions(+), 27 deletions(-) + +diff --git a/ext/fts5/fts5Int.h b/ext/fts5/fts5Int.h +index 1f8a297..984d625 100644 +--- a/ext/fts5/fts5Int.h ++++ b/ext/fts5/fts5Int.h +@@ -565,8 +565,9 @@ void sqlite3Fts5HashClear(Fts5Hash*); + + int sqlite3Fts5HashQuery( + Fts5Hash*, /* Hash table to query */ ++ int nPre, + const char *pTerm, int nTerm, /* Query term */ +- const u8 **ppDoclist, /* OUT: Pointer to doclist for pTerm */ ++ void **ppObj, /* OUT: Pointer to doclist for pTerm */ + int *pnDoclist /* OUT: Size of doclist in bytes */ + ); + +diff --git a/ext/fts5/fts5_hash.c b/ext/fts5/fts5_hash.c +index c35b5d5..eae785a 100644 +--- a/ext/fts5/fts5_hash.c ++++ b/ext/fts5/fts5_hash.c +@@ -187,19 +187,25 @@ static int fts5HashResize(Fts5Hash *pHash){ + return SQLITE_OK; + } + +-static void fts5HashAddPoslistSize(Fts5Hash *pHash, Fts5HashEntry *p){ ++static int fts5HashAddPoslistSize( ++ Fts5Hash *pHash, ++ Fts5HashEntry *p, ++ Fts5HashEntry *p2 ++){ ++ int nRet = 0; + if( p->iSzPoslist ){ +- u8 *pPtr = (u8*)p; ++ u8 *pPtr = p2 ? (u8*)p2 : (u8*)p; ++ int nData = p->nData; + if( pHash->eDetail==FTS5_DETAIL_NONE ){ +- assert( p->nData==p->iSzPoslist ); ++ assert( nData==p->iSzPoslist ); + if( p->bDel ){ +- pPtr[p->nData++] = 0x00; ++ pPtr[nData++] = 0x00; + if( p->bContent ){ +- pPtr[p->nData++] = 0x00; ++ pPtr[nData++] = 0x00; + } + } + }else{ +- int nSz = (p->nData - p->iSzPoslist - 1); /* Size in bytes From cc12b9c512451199cacf89a999977886ba4f183e Mon Sep 17 00:00:00 2001 +From: guiyao +Date: Tue, 31 Dec 2019 21:45:30 -0500 +Subject: [PATCH] backport-fix-CVE-2019-9937 + +--- + ext/fts5/fts5Int.h | 3 ++- + ext/fts5/fts5_hash.c | 55 ++++++++++++++++++++++++++++++++--------------- + ext/fts5/fts5_index.c | 25 ++++++++++++++------- + ext/fts5/test/fts5aa.test | 21 +++++++++++++++++- + 4 files changed, 77 insertions(+), 27 deletions(-) + +diff --git a/ext/fts5/fts5Int.h b/ext/fts5/fts5Int.h +index 1f8a297..984d625 100644 +--- a/ext/fts5/fts5Int.h ++++ b/ext/fts5/fts5Int.h +@@ -565,8 +565,9 @@ void sqlite3Fts5HashClear(Fts5Hash*); + + int sqlite3Fts5HashQuery( + Fts5Hash*, /* Hash table to query */ ++ int nPre, + const char *pTerm, int nTerm, /* Query term */ +- const u8 **ppDoclist, /* OUT: Pointer to doclist for pTerm */ ++ void **ppObj, /* OUT: Pointer to doclist for pTerm */ + int *pnDoclist /* OUT: Size of doclist in bytes */ + ); + +diff --git a/ext/fts5/fts5_hash.c b/ext/fts5/fts5_hash.c +index c35b5d5..eae785a 100644 +--- a/ext/fts5/fts5_hash.c ++++ b/ext/fts5/fts5_hash.c +@@ -187,19 +187,25 @@ static int fts5HashResize(Fts5Hash *pHash){ + return SQLITE_OK; + } + +-static void fts5HashAddPoslistSize(Fts5Hash *pHash, Fts5HashEntry *p){ ++static int fts5HashAddPoslistSize( ++ Fts5Hash *pHash, ++ Fts5HashEntry *p, ++ Fts5HashEntry *p2 ++){ ++ int nRet = 0; + if( p->iSzPoslist ){ +- u8 *pPtr = (u8*)p; ++ u8 *pPtr = p2 ? (u8*)p2 : (u8*)p; ++ int nData = p->nData; + if( pHash->eDetail==FTS5_DETAIL_NONE ){ +- assert( p->nData==p->iSzPoslist ); ++ assert( nData==p->iSzPoslist ); + if( p->bDel ){ +- pPtr[p->nData++] = 0x00; ++ pPtr[nData++] = 0x00; + if( p->bContent ){ +- pPtr[p->nData++] = 0x00; ++ pPtr[nData++] = 0x00; + } + } + }else{ +- int nSz = (p->nData - p->iSzPoslist - 1); /* Size in bytes */ ++ int nSz = (nData - p->iSzPoslist - 1); /* Size in bytes */ + int nPos = nSz*2 + p->bDel; /* Value of nPos field */ + + assert( p->bDel==0 || p->bDel==1 ); +@@ -209,14 +215,19 @@ static void fts5HashAddPoslistSize(Fts5Hash *pHash, Fts5HashEntry *p){ + int nByte = sqlite3Fts5GetVarintLen((u32)nPos); + memmove(&pPtr[p->iSzPoslist + nByte], &pPtr[p->iSzPoslist + 1], nSz); + sqlite3Fts5PutVarint(&pPtr[p->iSzPoslist], nPos); +- p->nData += (nByte-1); ++ nData += (nByte-1); + } + } + +- p->iSzPoslist = 0; +- p->bDel = 0; +- p->bContent = 0; ++ nRet = nData - p->nData; ++ if( p2==0 ){ ++ p->iSzPoslist = 0; ++ p->bDel = 0; ++ p->bContent = 0; ++ p->nData = nData; ++ } + } ++ return nRet; + } + + /* +@@ -328,7 +339,7 @@ int sqlite3Fts5HashWrite( + /* If this is a new rowid, append the 4-byte size field for the previous + ** entry, and the new rowid for this entry. */ + if( iRowid!=p->iRowid ){ +- fts5HashAddPoslistSize(pHash, p); ++ fts5HashAddPoslistSize(pHash, p, 0); + p->nData += sqlite3Fts5PutVarint(&pPtr[p->nData], iRowid - p->iRowid); + p->iRowid = iRowid; + bNew = 1; +@@ -474,8 +485,9 @@ static int fts5HashEntrySort( + */ + int sqlite3Fts5HashQuery( + Fts5Hash *pHash, /* Hash table to query */ ++ int nPre, + const char *pTerm, int nTerm, /* Query term */ +- const u8 **ppDoclist, /* OUT: Pointer to doclist for pTerm */ ++ void **ppOut, /* OUT: Pointer to new object */ + int *pnDoclist /* OUT: Size of doclist in bytes */ + ){ + unsigned int iHash = fts5HashKey(pHash->nSlot, (const u8*)pTerm, nTerm); +@@ -489,11 +501,20 @@ int sqlite3Fts5HashQuery( + } + + if( p ){ +- fts5HashAddPoslistSize(pHash, p); +- *ppDoclist = (const u8*)&zKey[nTerm+1]; +- *pnDoclist = p->nData - (sizeof(Fts5HashEntry) + nTerm + 1); ++ int nHashPre = sizeof(Fts5HashEntry) + nTerm + 1; ++ int nList = p->nData - nHashPre; ++ u8 *pRet = (u8*)(*ppOut = sqlite3_malloc64(nPre + nList + 10)); ++ if( pRet ){ ++ Fts5HashEntry *pFaux = (Fts5HashEntry*)&pRet[nPre-nHashPre]; ++ memcpy(&pRet[nPre], &((u8*)p)[nHashPre], nList); ++ nList += fts5HashAddPoslistSize(pHash, p, pFaux); ++ *pnDoclist = nList; ++ }else{ ++ *pnDoclist = 0; ++ return SQLITE_NOMEM; ++ } + }else{ +- *ppDoclist = 0; ++ *ppOut = 0; + *pnDoclist = 0; + } + +@@ -526,7 +547,7 @@ void sqlite3Fts5HashScanEntry( + if( (p = pHash->pScan) ){ + char *zKey = fts5EntryKey(p); + int nTerm = (int)strlen(zKey); +- fts5HashAddPoslistSize(pHash, p); ++ fts5HashAddPoslistSize(pHash, p, 0); + *pzTerm = zKey; + *ppDoclist = (const u8*)&zKey[nTerm+1]; + *pnDoclist = p->nData - (sizeof(Fts5HashEntry) + nTerm + 1); +diff --git a/ext/fts5/fts5_index.c b/ext/fts5/fts5_index.c +index ddad6c8..37ef61d 100644 +--- a/ext/fts5/fts5_index.c ++++ b/ext/fts5/fts5_index.c +@@ -2452,31 +2452,40 @@ static void fts5SegIterHashInit( + int flags, /* Mask of FTS5INDEX_XXX flags */ + Fts5SegIter *pIter /* Object to populate */ + ){ +- const u8 *pList = 0; + int nList = 0; + const u8 *z = 0; + int n = 0; ++ Fts5Data *pLeaf = 0; + + assert( p->pHash ); + assert( p->rc==SQLITE_OK ); + + if( pTerm==0 || (flags & FTS5INDEX_QUERY_SCAN) ){ ++ const u8 *pList = 0; ++ + p->rc = sqlite3Fts5HashScanInit(p->pHash, (const char*)pTerm, nTerm); + sqlite3Fts5HashScanEntry(p->pHash, (const char**)&z, &pList, &nList); + n = (z ? (int)strlen((const char*)z) : 0); ++ if( pList ){ ++ pLeaf = fts5IdxMalloc(p, sizeof(Fts5Data)); ++ if( pLeaf ){ ++ pLeaf->p = pList; ++ } ++ } + }else{ +- pIter->flags |= FTS5_SEGITER_ONETERM; +- sqlite3Fts5HashQuery(p->pHash, (const char*)pTerm, nTerm, &pList, &nList); ++ p->rc = sqlite3Fts5HashQuery(p->pHash, sizeof(Fts5Data), ++ (const char*)pTerm, nTerm, (void**)&pLeaf, &nList ++ ); ++ if( pLeaf ){ ++ pLeaf->p = (u8*)&pLeaf[1]; ++ } + z = pTerm; + n = nTerm; ++ pIter->flags |= FTS5_SEGITER_ONETERM; + } + +- if( pList ){ +- Fts5Data *pLeaf; ++ if( pLeaf ){ + sqlite3Fts5BufferSet(&p->rc, &pIter->term, n, z); +- pLeaf = fts5IdxMalloc(p, sizeof(Fts5Data)); +- if( pLeaf==0 ) return; +- pLeaf->p = (u8*)pList; + pLeaf->nn = pLeaf->szLeaf = nList; + pIter->pLeaf = pLeaf; + pIter->iLeafOffset = fts5GetVarint(pLeaf->p, (u64*)&pIter->iRowid); +diff --git a/ext/fts5/test/fts5aa.test b/ext/fts5/test/fts5aa.test +index 5c9b894..b76a7f6 100644 +--- a/ext/fts5/test/fts5aa.test ++++ b/ext/fts5/test/fts5aa.test +@@ -427,7 +427,7 @@ proc funk {} { + db eval { UPDATE n1_config SET v=50 WHERE k='version' } + set fd [db incrblob main n1_data block 10] + fconfigure $fd -encoding binary -translation binary +- puts -nonewline $fd "\x44\x45" ++# puts -nonewline $fd "\x44\x45" + close $fd + } + db func funk funk +@@ -604,6 +604,25 @@ do_execsql_test 23.2 { + } + + #------------------------------------------------------------------------- ++do_execsql_test 24.0 { ++ CREATE VIRTUAL TABLE t12 USING fts5(x, detail=%DETAIL%); ++ INSERT INTO t12 VALUES('aaaa'); ++} ++do_execsql_test 24.1 { ++ BEGIN; ++ DELETE FROM t12 WHERE rowid=1; ++ SELECT * FROM t12('aaaa'); ++ INSERT INTO t12 VALUES('aaaa'); ++ END; ++} ++do_execsql_test 24.2 { ++ INSERT INTO t12(t12) VALUES('integrity-check'); ++} ++do_execsql_test 24.3 { ++ SELECT * FROM t12('aaaa'); ++} {aaaa} ++ ++#------------------------------------------------------------------------- + do_execsql_test 25.0 { + CREATE VIRTUAL TABLE t13 USING fts5(x, detail=%DETAIL%); + } +-- +1.8.3.1 + diff --git a/sqlite.spec b/sqlite.spec index 5f449435adab19286dc91fbeb8eb4ef4af43d76d..4003ca2b14eae5998b61b12301cef127ea571040 100644 --- a/sqlite.spec +++ b/sqlite.spec @@ -6,7 +6,7 @@ Name: sqlite Version: 3.24.0 -Release: 5 +Release: 6 Summary: Embeded SQL database License: Public Domain URL: http://www.sqlite.org/ @@ -71,6 +71,8 @@ Patch6043: 6043-Fix-a-potential-32-bit-integer-overflow-in-the-showd.patch Patch6044: 6044-sqlite-CVE-2019-8457-out-of-bounds-read.patch Patch6045: 6045-sqlite-CVE-2019-16168.patch Patch6046: 6046-Fix-CVE-2019-19646.patch +Patch6047: 6047-Fix-CVE-2019-9936.patch +Patch6048: 6048-Fix-CVE-2019-9937.patch BuildRequires: gcc autoconf tcl tcl-devel BuildRequires: ncurses-devel readline-devel glibc-devel @@ -171,6 +173,8 @@ This contains man files and HTML files for the using of sqlite. %patch6044 -p1 %patch6045 -p1 %patch6046 -p1 +%patch6047 -p1 +%patch6048 -p1 rm -f %{name}-doc-%{extver}/sqlite.css~ || : @@ -241,6 +245,12 @@ make test %{_mandir}/man*/* %changelog +* Fri Jan 3 2019 openEuler Buildteam - 3.24.0-6 +- Type:cves +- ID:CVE-2019-9936,CVE-2019-9937 +- SUG:NA +- DESC:fix cve + * Sat Dec 21 2019 openEuler Buildteam - 3.24.0-5 - Type:bugfix - ID:NA