Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package sqlite3 for openSUSE:Factory checked in at 2026-11-08 19:21:00 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/sqlite3 (Old) and /work/SRC/openSUSE:Factory/.sqlite3.new.3759290 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "sqlite3" Sun Nov 8 19:21:00 2026 rev:179 rq:1395605 version:3.54.1 Changes: -------- --- /work/SRC/openSUSE:Factory/sqlite3/sqlite3.changes 2026-10-21 20:51:59.758150739 +0200 +++ /work/SRC/openSUSE:Factory/.sqlite3.new.3759290/sqlite3.changes 2026-11-08 19:21:03.160564967 +0100 @@ -1,0 +2,13 @@ +Thu Nov 5 13:24:17 UTC 2026 - Reinhard Max <[email protected]> + +- Add sqlite-3.54.1-fix-waliter-test-64k-pages.patch to fix a test + failure in %check on systems with 64KB pages (ppc64le, aarch64). +- Add sqlite-3.54.1-fix-fts3corrupt4-test-big-endian.patch to fix a + test failure in %check on big-endian platforms (s390x). Upstream + check-in 1a888ea60be20a80 made the test's big-endian special case + obsolete. +- Add sqlite-3.54.1-fix-shell-import-line-count.patch to fix a test + failure in %check on 32-bit big-endian platforms (s390): the line + count shown by ".import" was printed from a 64-bit value with %d. + +------------------------------------------------------------------- @@ -8,0 +22,26 @@ +- Security fixes in 3.54.0 and 3.54.1: + * CVE-2026-119371, bsc#1289191: stack exhaustion because common + table expressions were not counted against the + SQLITE_LIMIT_EXPR_DEPTH limit. + * CVE-2026-119372, bsc#1289187: use-after-free in fts3BestSnippet() + via dangling cached position-list pointers (FTS3/FTS4 built + with SQLITE_ENABLE_FTS3_PARENTHESIS). + * CVE-2026-119373, bsc#1289183: denial of service via a heap + buffer overflow in FTS5. + * CVE-2026-119374, bsc#1289180: heap buffer overflow in + fts5DoSecureDelete() via crafted footer key offsets. + * CVE-2026-119375, bsc#1289179: disclosure of uninitialized + page-cache memory via a WAL file with an undersized page size. + * CVE-2026-119376, bsc#1289177: stack exhaustion by bypassing the + SQLITE_LIMIT_EXPR_DEPTH limit with chained COLLATE operators. + * CVE-2026-119377, bsc#1289175: authorization bypass in + lookupName(), which invoked the authorizer only for the first + joined table's USING column. + * CVE-2026-119378, bsc#1289162: denial of service via a + use-after-free in the R-Tree extension. + * CVE-2026-119379, bsc#1289127: heap buffer overflow in + sqlite3changeset_apply() via crafted changesets (session + extension). + * CVE-2026-119591, bsc#1289198: denial of service via stack + exhaustion in countOfViewOptimization() on count(*) over a + large multi-row VALUES clause. New: ---- sqlite-3.54.1-fix-fts3corrupt4-test-big-endian.patch sqlite-3.54.1-fix-shell-import-line-count.patch sqlite-3.54.1-fix-waliter-test-64k-pages.patch ----------(New B)---------- New: failure in %check on systems with 64KB pages (ppc64le, aarch64). - Add sqlite-3.54.1-fix-fts3corrupt4-test-big-endian.patch to fix a test failure in %check on big-endian platforms (s390x). Upstream New: obsolete. - Add sqlite-3.54.1-fix-shell-import-line-count.patch to fix a test failure in %check on 32-bit big-endian platforms (s390): the line New: - Add sqlite-3.54.1-fix-waliter-test-64k-pages.patch to fix a test failure in %check on systems with 64KB pages (ppc64le, aarch64). ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ sqlite3.spec ++++++ --- /var/tmp/diff_new_pack.BcACID/_old 2026-11-08 19:21:04.726629751 +0100 +++ /var/tmp/diff_new_pack.BcACID/_new 2026-11-08 19:21:04.729629875 +0100 @@ -40,6 +40,12 @@ Source99: %{name}-rpmlintrc Patch0: sqlite-3.6.23-lemon-system-template.patch Patch1: sqlite-3.49.0-fix-lemon-missing-cflags.patch +# PATCH-FIX-UPSTREAM sqlite-3.54.1-fix-waliter-test-64k-pages.patch -- waliter.test assumes 4KB pages +Patch2: sqlite-3.54.1-fix-waliter-test-64k-pages.patch +# PATCH-FIX-UPSTREAM sqlite-3.54.1-fix-fts3corrupt4-test-big-endian.patch -- obsolete big-endian special case since 1a888ea60be20a80 +Patch3: sqlite-3.54.1-fix-fts3corrupt4-test-big-endian.patch +# PATCH-FIX-UPSTREAM sqlite-3.54.1-fix-shell-import-line-count.patch -- 64 bit argument printed with %d, wrong on 32 bit big-endian +Patch4: sqlite-3.54.1-fix-shell-import-line-count.patch BuildRequires: automake BuildRequires: libtool BuildRequires: pkgconfig @@ -231,7 +237,15 @@ # Allow ASan tests ulimit -d unlimited -%make_build devtest +%if 0%{?suse_version} < 1500 +# gcc 4.8 does not support -fsanitize=undefined +%define tstrnnr_opts TSTRNNR_OPTS="~ubsan" +%endif +%make_build devtest %{?tstrnnr_opts} || { + # Show the details of the failed tests in the build log + awk '/^### /{p=/\(failed\)/} p' testrunner.log + exit 1 +} %endif %install ++++++ sqlite-3.54.1-fix-fts3corrupt4-test-big-endian.patch ++++++ Remove obsolete big-endian special case from fts3corrupt4.test Since check-in 1a888ea60be20a80 ("Improved detection of corrupt freelist chains on btree pages", released in 3.53.3) page 1 of the test database, which has a freeblock of size 0, is rejected by btreeComputeFreeSpace(). The CREATE TABLE of the t1_stat table done by "merge=1" therefore fails on all platforms, independent of the PRNG byte sequence, so tests 25.6a and 25.6b expect the same result on big-endian as on little-endian platforms. See https://sqlite.org/forum/forumpost/af4461a71d0f935cdefb807a0ca0af9742a714200090ebf64b0de5b760574505 --- a/test/fts3corrupt4.test +++ b/test/fts3corrupt4.test @@ -4403,31 +4403,12 @@ INSERT INTO t1( a ) SELECT randomblob(3000) FROM t2 ; } {0 {}} -if {$tcl_platform(byteOrder)=="littleEndian"} { - # The SQLITE_CORRUPT error depends on the specific random byte - # sequence generated by SQLite's PRNG. But the SQLite PRNG - # uses ChaCha20, which generates a different byte sequence on - # big-endian and little-endian platforms. The SQLITE_CORRUPT - # error only comes up when the pseudo-random byte sequence is - # the one generated on little-endian platforms. - # - # See Forum thread: - # https://sqlite.org/forum/forumpost/b5f89d813babfd88 - # - do_catchsql_test 25.6a { - INSERT INTO t1(t1) SELECT x FROM t2; - } {1 {database disk image is malformed}} - do_catchsql_test 25.6b { - INSERT INTO t1(t1) SELECT x FROM t2; - } {1 {database disk image is malformed}} -} else { - do_catchsql_test 25.6a { - INSERT INTO t1(t1) SELECT x FROM t2; - } {0 {}} - do_catchsql_test 25.6b { - INSERT INTO t1(t1) SELECT x FROM t2; - } {0 {}} -} +do_catchsql_test 25.6a { + INSERT INTO t1(t1) SELECT x FROM t2; +} {1 {database disk image is malformed}} +do_catchsql_test 25.6b { + INSERT INTO t1(t1) SELECT x FROM t2; +} {1 {database disk image is malformed}} #------------------------------------------------------------------------- ++++++ sqlite-3.54.1-fix-shell-import-line-count.patch ++++++ Fix the line count shown by ".import" on 32-bit big-endian platforms The number of lines of input in the summary printed by ".import" is computed as "sCtx.nLine-1-iLineOffset". Because iLineOffset is an i64 this is a 64-bit value, but it was formatted with %d, which reads a 32-bit int. On 32-bit big-endian platforms (s390) the high word of the 64-bit value is read, which is always 0, so test/import01.sql fails there. Use %lld. --- a/src/shell.c.in +++ b/src/shell.c.in @@ -8731,7 +8731,7 @@ if( needCommit ) sqlite3_exec(p->db, "COMMIT", 0, 0, 0); if( eVerbose>0 ){ cli_printf(p->out, - "Added %d rows with %d errors using %d lines of input\n", + "Added %d rows with %d errors using %lld lines of input\n", sCtx.nRow, sCtx.nErr, sCtx.nLine-1-iLineOffset); } return sCtx.nErr ? 1 : 0; ++++++ sqlite-3.54.1-fix-waliter-test-64k-pages.patch ++++++ Fix waliter.test on systems with 64KB pages Each shm mapping covers a whole number of system pages (see unixShmRegionPerMap() in os_unix.c), so with 64KB pages the shm file of the 10000 frame WAL in test 1.2 is rounded up from three to four 32KB regions. Derive the expected file size from the system page size instead of hard-coding three regions. --- a/test/waliter.test +++ b/test/waliter.test @@ -65,9 +65,16 @@ UPDATE t1 SET b = randomblob(900); } {0} +# Each shm mapping covers a whole number of system pages, so the number of +# 32KB shm regions is rounded up to a multiple of the number of regions per +# page. This matters with 64KB pages, where it is two. +if {[catch {exec getconf PAGESIZE} pgsz]} { set pgsz 4096 } +set nShmPerMap [expr {$pgsz>32768 ? $pgsz/32768 : 1}] +set nShmRegion [expr {(3 + $nShmPerMap - 1) / $nShmPerMap * $nShmPerMap}] + do_test 1.2 { file size test.db-shm -} [expr 32768 * 3] +} [expr 32768 * $nShmRegion] do_execsql_test 1.3 { PRAGMA wal_checkpoint
