From: Deepak Rathore <[email protected]> This patch applies the upstream fix [1], which addresses memory corruption vulnerabilities in the SQLite FTS5 full-text search extension. The GitHub mirror commit [1] corresponds to the SQLite Fossil check-in shown in [2].
[1] https://github.com/sqlite/sqlite/commit/e0b995b2a62b78979eb65bb8dadfa912eaa8e62f [2] https://sqlite.org/src/info/061febcf41ca Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-11822 https://nvd.nist.gov/vuln/detail/CVE-2026-11824 Signed-off-by: Deepak Rathore <[email protected]> --- .../CVE-2026-11822_CVE-2026-11824.patch | 41 +++++++++++++++++++ meta/recipes-support/sqlite/sqlite3_3.45.3.bb | 1 + 2 files changed, 42 insertions(+) create mode 100644 meta/recipes-support/sqlite/sqlite3/CVE-2026-11822_CVE-2026-11824.patch diff --git a/meta/recipes-support/sqlite/sqlite3/CVE-2026-11822_CVE-2026-11824.patch b/meta/recipes-support/sqlite/sqlite3/CVE-2026-11822_CVE-2026-11824.patch new file mode 100644 index 0000000000..1764d5c6e2 --- /dev/null +++ b/meta/recipes-support/sqlite/sqlite3/CVE-2026-11822_CVE-2026-11824.patch @@ -0,0 +1,41 @@ +From ceece94b0040125a12192f6f23b1ec413871b04c Mon Sep 17 00:00:00 2001 +From: drh <> +Date: Mon, 11 May 2026 12:00:19 +0000 +Subject: [PATCH] Fix potential buffer overwrite that could occur in fts5 when + processing corrupt records. + +FossilOrigin-Name: 061febcf41ca4872a0f407951e1507209daca7895122b909a7806c60b6e200c4 + +CVE: CVE-2026-11822 CVE-2026-11824 +Upstream-Status: Backport [https://github.com/sqlite/sqlite/commit/e0b995b2a62b78979eb65bb8dadfa912eaa8e62f] + +Backport Changes: +- Applied the upstream fts5LeafRead() fix from ext/fts5/fts5_index.c + to sqlite3.c because the Yocto sqlite-autoconf source uses the + amalgamated SQLite layout. +- Omitted ext/fts5/test/fts5corruptA.test because this extracted + recipe source contains the SQLite autoconf/amalgamation layout and + does not carry the upstream Tcl test tree. +- Omitted Git mirror metadata files manifest and manifest.uuid because + they are not required for the security fix in this source layout. + +Signed-off-by: Deepak Rathore <[email protected]> +--- + sqlite3.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sqlite3.c b/sqlite3.c +index fb42adcd7..6acf46a5b 100644 +--- a/sqlite3.c ++++ b/sqlite3.c +@@ -239694,7 +239694,7 @@ static void fts5DataRelease(Fts5Data *pData){ + static Fts5Data *fts5LeafRead(Fts5Index *p, i64 iRowid){ + Fts5Data *pRet = fts5DataRead(p, iRowid); + if( pRet ){ +- if( pRet->nn<4 || pRet->szLeaf>pRet->nn ){ ++ if( pRet->szLeaf<4 || pRet->szLeaf>pRet->nn ){ + p->rc = FTS5_CORRUPT; + fts5DataRelease(pRet); + pRet = 0; +-- +2.51.0 diff --git a/meta/recipes-support/sqlite/sqlite3_3.45.3.bb b/meta/recipes-support/sqlite/sqlite3_3.45.3.bb index 1b3ac83b58..975f3bdab8 100644 --- a/meta/recipes-support/sqlite/sqlite3_3.45.3.bb +++ b/meta/recipes-support/sqlite/sqlite3_3.45.3.bb @@ -9,6 +9,7 @@ SRC_URI = "http://www.sqlite.org/2024/sqlite-autoconf-${SQLITE_PV}.tar.gz \ file://CVE-2025-6965.patch \ file://CVE-2025-7709.patch \ file://CVE-2025-70873.patch \ + file://CVE-2026-11822_CVE-2026-11824.patch \ " SRC_URI[sha256sum] = "b2809ca53124c19c60f42bf627736eae011afdcc205bb48270a5ee9a38191531" -- 2.35.6
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#241843): https://lists.openembedded.org/g/openembedded-core/message/241843 Mute This Topic: https://lists.openembedded.org/mt/120410540/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
