From: Sana Kazi <sana.k...@kpit.com> Fix CVE-2021-20223 for sqlite3 Link: https://github.com/sqlite/sqlite/commit/d1d43efa4fb0f2098c0e2c5bf2e807c58d5ec05b.patch
Signed-off-by: Sana Kazi <sana.k...@kpit.com> --- .../sqlite/files/CVE-2021-20223.patch | 23 +++++++++++++++++++ meta/recipes-support/sqlite/sqlite3_3.31.1.bb | 1 + 2 files changed, 24 insertions(+) create mode 100644 meta/recipes-support/sqlite/files/CVE-2021-20223.patch diff --git a/meta/recipes-support/sqlite/files/CVE-2021-20223.patch b/meta/recipes-support/sqlite/files/CVE-2021-20223.patch new file mode 100644 index 0000000000..65e914c2c6 --- /dev/null +++ b/meta/recipes-support/sqlite/files/CVE-2021-20223.patch @@ -0,0 +1,23 @@ +From d1d43efa4fb0f2098c0e2c5bf2e807c58d5ec05b Mon Sep 17 00:00:00 2001 +From: dan <d...@noemail.net> +Date: Mon, 26 Oct 2020 13:24:36 +0000 +Subject: [PATCH] Prevent fts5 tokenizer unicode61 from considering '\0' to be + a token characters, even if other characters of class "Cc" are. + +FossilOrigin-Name: b7b7bde9b7a03665e3691c6d51118965f216d2dfb1617f138b9f9e60e418ed2f + +CVE: CVE-2021-20223 +Upstream-Status: Backport [https://github.com/sqlite/sqlite/commit/d1d43efa4fb0f2098c0e2c5bf2e807c58d5ec05b.patch] +Comment: Removed manifest, manifest.uuid and fts5tok1.test as these files are not present in the amalgamated source code +Signed-Off-by: sana.k...@kpit.com +--- +--- a/sqlite3.c 2022-09-09 13:54:30.010768197 +0530 ++++ b/sqlite3.c 2022-09-09 13:56:25.458769142 +0530 +@@ -227114,6 +227114,7 @@ + } + iTbl++; + } ++ aAscii[0] = 0; /* 0x00 is never a token character */ + } + + /* diff --git a/meta/recipes-support/sqlite/sqlite3_3.31.1.bb b/meta/recipes-support/sqlite/sqlite3_3.31.1.bb index 3440bf4913..04eb3683ec 100644 --- a/meta/recipes-support/sqlite/sqlite3_3.31.1.bb +++ b/meta/recipes-support/sqlite/sqlite3_3.31.1.bb @@ -14,6 +14,7 @@ SRC_URI = "http://www.sqlite.org/2020/sqlite-autoconf-${SQLITE_PV}.tar.gz \ file://CVE-2020-13631.patch \ file://CVE-2020-13632.patch \ file://CVE-2022-35737.patch \ + file://CVE-2021-20223.patch \ " SRC_URI[md5sum] = "2d0a553534c521504e3ac3ad3b90f125" SRC_URI[sha256sum] = "62284efebc05a76f909c580ffa5c008a7d22a1287285d68b7825a2b6b51949ae" -- 2.17.1 This message contains information that may be privileged or confidential and is the property of the KPIT Technologies Ltd. It is intended only for the person to whom it is addressed. If you are not the intended recipient, you are not authorized to read, print, retain copy, disseminate, distribute, or use this message or any part thereof. If you receive this message in error, please notify the sender immediately and delete all copies of this message. KPIT Technologies Ltd. does not accept any liability for virus infected mails.
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#170945): https://lists.openembedded.org/g/openembedded-core/message/170945 Mute This Topic: https://lists.openembedded.org/mt/93823840/21656 Group Owner: openembedded-core+ow...@lists.openembedded.org Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-
