From: Deepak Rathore <[email protected]> This patch applies the upstream fix [1], which addresses memory corruption vulnerabilities in the SQLite FTS5 full-text search extension. The GitHub mirror commit [1] corresponds to the SQLite Fossil check-in shown in [2].
[1] https://github.com/sqlite/sqlite/commit/e0b995b2a62b78979eb65bb8dadfa912eaa8e62f [2] https://sqlite.org/src/info/061febcf41ca Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-11822 https://nvd.nist.gov/vuln/detail/CVE-2026-11824 Signed-off-by: Deepak Rathore <[email protected]> Signed-off-by: Yoann Congal <[email protected]> --- .../CVE-2026-11822_CVE-2026-11824.patch | 41 +++++++++++++++++++ meta/recipes-support/sqlite/sqlite3_3.51.3.bb | 5 ++- 2 files changed, 45 insertions(+), 1 deletion(-) create mode 100644 meta/recipes-support/sqlite/sqlite3/CVE-2026-11822_CVE-2026-11824.patch diff --git a/meta/recipes-support/sqlite/sqlite3/CVE-2026-11822_CVE-2026-11824.patch b/meta/recipes-support/sqlite/sqlite3/CVE-2026-11822_CVE-2026-11824.patch new file mode 100644 index 00000000000..0bac4412b18 --- /dev/null +++ b/meta/recipes-support/sqlite/sqlite3/CVE-2026-11822_CVE-2026-11824.patch @@ -0,0 +1,41 @@ +From d38b8fb5636c6d77f76dbeb5291f49ab594dcad4 Mon Sep 17 00:00:00 2001 +From: drh <> +Date: Mon, 11 May 2026 12:00:19 +0000 +Subject: [PATCH] Fix potential buffer overwrite that could occur in fts5 when + processing corrupt records. + +FossilOrigin-Name: 061febcf41ca4872a0f407951e1507209daca7895122b909a7806c60b6e200c4 + +CVE: CVE-2026-11822 CVE-2026-11824 +Upstream-Status: Backport [https://github.com/sqlite/sqlite/commit/e0b995b2a62b78979eb65bb8dadfa912eaa8e62f] + +Backport Changes: +- Applied the upstream fts5LeafRead() fix from ext/fts5/fts5_index.c + to sqlite3.c because the Yocto sqlite-autoconf source uses the + amalgamated SQLite layout. +- Omitted ext/fts5/test/fts5corruptA.test because this extracted + recipe source contains the SQLite autoconf/amalgamation layout and + does not carry the upstream Tcl test tree. +- Omitted Git mirror metadata files manifest and manifest.uuid because + they are not required for the security fix in this source layout. + +Signed-off-by: Deepak Rathore <[email protected]> +--- + sqlite3.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sqlite3.c b/sqlite3.c +index 851a2504c..2f4b77429 100644 +--- a/sqlite3.c ++++ b/sqlite3.c +@@ -248157,7 +248157,7 @@ static void fts5DataRelease(Fts5Data *pData){ + static Fts5Data *fts5LeafRead(Fts5Index *p, i64 iRowid){ + Fts5Data *pRet = fts5DataRead(p, iRowid); + if( pRet ){ +- if( pRet->nn<4 || pRet->szLeaf>pRet->nn ){ ++ if( pRet->szLeaf<4 || pRet->szLeaf>pRet->nn ){ + FTS5_CORRUPT_ROWID(p, iRowid); + fts5DataRelease(pRet); + pRet = 0; +-- +2.51.0 diff --git a/meta/recipes-support/sqlite/sqlite3_3.51.3.bb b/meta/recipes-support/sqlite/sqlite3_3.51.3.bb index 0a8727e4f2c..2b0a9c0e4d7 100644 --- a/meta/recipes-support/sqlite/sqlite3_3.51.3.bb +++ b/meta/recipes-support/sqlite/sqlite3_3.51.3.bb @@ -6,4 +6,7 @@ LIC_FILES_CHKSUM = "file://sqlite3.h;endline=11;md5=786d3dc581eff03f4fd9e4a77ed0 SRC_URI = "http://www.sqlite.org/2026/sqlite-autoconf-${SQLITE_PV}.tar.gz"; SRC_URI[sha256sum] = "81f5be397049b0cae1b167f2225af7646fc0f82e4a9b3c48c9ea3a533e21d77a" -SRC_URI += "file://0001-Add-option-to-disable-zlib.patch" +SRC_URI += "\ + file://0001-Add-option-to-disable-zlib.patch \ + file://CVE-2026-11822_CVE-2026-11824.patch \ +"
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#242138): https://lists.openembedded.org/g/openembedded-core/message/242138 Mute This Topic: https://lists.openembedded.org/mt/120476102/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
