From 5909c3024da2439a990c8108541461a52570d22f Mon Sep 17 00:00:00 2001 From: eulerstorage Date: Tue, 10 Mar 2020 17:39:01 +0800 Subject: [PATCH] fix cves --- 6055-Fix-CVE-2018-20505.patch | 41 +++++++++++++++ 6056-Fix-CVE-2020-9327.patch | 97 +++++++++++++++++++++++++++++++++++ sqlite.spec | 12 ++++- 3 files changed, 149 insertions(+), 1 deletion(-) create mode 100644 6055-Fix-CVE-2018-20505.patch create mode 100644 6056-Fix-CVE-2020-9327.patch diff --git a/6055-Fix-CVE-2018-20505.patch b/6055-Fix-CVE-2018-20505.patch new file mode 100644 index 0000000..0a34d68 --- /dev/null +++ b/6055-Fix-CVE-2018-20505.patch @@ -0,0 +1,41 @@ +Index: src/wherecode.c +================================================================== +--- a/src/wherecode.c ++++ b/src/wherecode.c +@@ -424,11 +424,11 @@ + Select *pSelect; /* Pointer to the SELECT on the RHS */ + + for(i=iEq; inLTerm; i++){ + if( pLoop->aLTerm[i]->pExpr==pX ){ + int iField = pLoop->aLTerm[i]->iField - 1; +- assert( pOrigRhs->a[iField].pExpr!=0 ); ++ if( pOrigRhs->a[iField].pExpr==0 ) continue; /* Duplicate PK column */ + pRhs = sqlite3ExprListAppend(pParse, pRhs, pOrigRhs->a[iField].pExpr); + pOrigRhs->a[iField].pExpr = 0; + assert( pOrigLhs->a[iField].pExpr!=0 ); + pLhs = sqlite3ExprListAppend(pParse, pLhs, pOrigLhs->a[iField].pExpr); + pOrigLhs->a[iField].pExpr = 0; + +Index: test/rowvalue.test +================================================================== +--- a/test/rowvalue.test ++++ b/test/rowvalue.test +@@ -543,7 +543,18 @@ + # 2018-02-18: Memory leak nexted row-value. Detected by OSSFuzz. + # + do_catchsql_test 20.1 { + SELECT 1 WHERE (2,(2,0)) IS (2,(2,0)); + } {0 1} ++ ++# 2018-11-03: Ticket https://www.sqlite.org/src/info/1a84668dcfdebaf1 ++# Assertion fault when doing row-value operations on a primary key ++# containing duplicate columns. ++# ++do_execsql_test 21.0 { ++ DROP TABLE IF EXISTS t1; ++ CREATE TABLE t1(a,b,PRIMARY KEY(b,b)); ++ INSERT INTO t1 VALUES(1,2),(3,4),(5,6); ++ SELECT * FROM t1 WHERE (a,b) IN (VALUES(1,2)); ++} {1 2} + + finish_test diff --git a/6056-Fix-CVE-2020-9327.patch b/6056-Fix-CVE-2020-9327.patch new file mode 100644 index 0000000..ec216c6 --- /dev/null +++ b/6056-Fix-CVE-2020-9327.patch @@ -0,0 +1,97 @@ +From 6db07ba0e6e7e7ea4a8c3de9734437a87c2fd8c0 Mon Sep 17 00:00:00 2001 +From: guiyao +Date: Thu, 8 Apr 2021 14:19:51 -0400 +Subject: [PATCH] fix CVE-2020-9327 + +Description: this patch is used to fix CVE-2020-9327, and it was rewritten base on + commit 78d1d225d87af40f5bdca57fa72f00b6ffaffa21 and bf48ce49f7c25e5d4524de9fdc5c0d505218d06d + to fit the current version. + +--- + src/expr.c | 15 +++++++++++---- + src/sqliteInt.h | 3 +++ + src/whereexpr.c | 9 ++++++--- + 3 files changed, 20 insertions(+), 7 deletions(-) + +diff --git a/src/expr.c b/src/expr.c +index 8fd8af9..73a8187 100644 +--- a/src/expr.c ++++ b/src/expr.c +@@ -5055,18 +5055,25 @@ static int impliesNotNullRow(Walker *pWalker, Expr *pExpr){ + case TK_LT: + case TK_LE: + case TK_GT: +- case TK_GE: ++ case TK_GE: { ++ Expr *pLeft = pExpr->pLeft; ++ Expr *pRight = pExpr->pRight; + testcase( pExpr->op==TK_EQ ); + testcase( pExpr->op==TK_NE ); + testcase( pExpr->op==TK_LT ); + testcase( pExpr->op==TK_LE ); + testcase( pExpr->op==TK_GT ); + testcase( pExpr->op==TK_GE ); +- if( (pExpr->pLeft->op==TK_COLUMN && IsVirtual(pExpr->pLeft->pTab)) +- || (pExpr->pRight->op==TK_COLUMN && IsVirtual(pExpr->pRight->pTab)) ++ /* The pTab=0 assignment in wherecode.c always happens after the ++ ** impliesNotNullRow() test */ ++ if( (pLeft->op==TK_COLUMN && ALWAYS(pLeft->pTab!=0) ++ && IsVirtual(pLeft->pTab)) ++ || (pRight->op==TK_COLUMN && ALWAYS(pRight->pTab!=0) ++ && IsVirtual(pRight->pTab)) + ){ +- return WRC_Prune; ++ return WRC_Prune; + } ++ } + default: + return WRC_Continue; + } +diff --git a/src/sqliteInt.h b/src/sqliteInt.h +index 91fde72..d79ab28 100644 +--- a/src/sqliteInt.h ++++ b/src/sqliteInt.h +@@ -1955,8 +1955,11 @@ struct Table { + */ + #ifndef SQLITE_OMIT_VIRTUALTABLE + # define IsVirtual(X) ((X)->nModuleArg) ++# define ExprIsVtab(X) \ ++ ((X)->op==TK_COLUMN && (X)->pTab!=0 && (X)->pTab->nModuleArg) + #else + # define IsVirtual(X) 0 ++# define ExprIsVtab(X) 0 + #endif + + /* +diff --git a/src/whereexpr.c b/src/whereexpr.c +index 2975008..e61dfff 100644 +--- a/src/whereexpr.c ++++ b/src/whereexpr.c +@@ -362,7 +362,8 @@ static int isAuxiliaryVtabOperator( + return 0; + } + pCol = pList->a[1].pExpr; +- if( pCol->op!=TK_COLUMN || !IsVirtual(pCol->pTab) ){ ++ testcase( pCol->op==TK_COLUMN && pCol->pTab==0 ); ++ if( !ExprIsVtab(pCol) ){ + return 0; + } + for(i=0; ipLeft; + Expr *pRight = pExpr->pRight; +- if( pLeft->op==TK_COLUMN && IsVirtual(pLeft->pTab) ){ ++ testcase( pLeft->op==TK_COLUMN && pLeft->pTab==0 ); ++ if( ExprIsVtab(pLeft) ){ + res++; + } +- if( pRight && pRight->op==TK_COLUMN && IsVirtual(pRight->pTab) ){ ++ testcase( pRight && pRight->op==TK_COLUMN && pRight->pTab==0 ); ++ if( pRight && ExprIsVtab(pRight) ){ + res++; + SWAP(Expr*, pLeft, pRight); + } +-- +1.8.3.1 + diff --git a/sqlite.spec b/sqlite.spec index 732064f..fe7fb4a 100644 --- a/sqlite.spec +++ b/sqlite.spec @@ -6,7 +6,7 @@ Name: sqlite Version: 3.24.0 -Release: 8 +Release: 9 Summary: Embeded SQL database License: Public Domain URL: http://www.sqlite.org/ @@ -74,6 +74,8 @@ Patch6051: 6051-Fix-CVE-2019-19925-Fix-the-zipfile-extension-so-that-INSERT-work Patch6052: 6052-Fix-CVE-2019-19926-Continuation-of-e2bddcd4c55ba3cb-Add-another-spot-wh.patch Patch6053: 6053-Fix-CVE-2019-20218-Do-not-attempt-to-unwind-the-WITH-stack-in-the-Parse.patch Patch6054: 6054-Fix-the-zipfile-function-in-the-zipfile-extension-so.patch +Patch6055: 6055-Fix-CVE-2018-20505.patch +Patch6056: 6056-Fix-CVE-2020-9327.patch BuildRequires: gcc autoconf tcl tcl-devel BuildRequires: ncurses-devel readline-devel glibc-devel @@ -174,6 +176,8 @@ This contains man files and HTML files for the using of sqlite. %patch6052 -p1 %patch6053 -p1 %patch6054 -p1 +%patch6055 -p1 +%patch6056 -p1 rm -f %{name}-doc-%{extver}/sqlite.css~ || : @@ -244,6 +248,12 @@ make test %{_mandir}/man*/* %changelog +* Tue Mar 10 2020 steven - 3.24.0-9 +- Type:enhancement +- ID:NA +- SUG:NA +- DESC:CVE-2018-20505, CVE-2020-9327 fixed + * Wed Jan 11 2020 openEuler Buildteam - 3.24.0-8 - Type:enhancement - ID:NA -- Gitee