已开启
fix CVE-2026-39113 #286
hanjinpeng创建于 14 天前
fix CVE-2026-39113 #286
已开启
共 2 个文件变更+31-1
| @@ -0,0 +1,26 @@ | |||
| 1 | +From 2fdfee1cd62798825961395836c33cb7934f0bf0 Mon Sep 17 00:00:00 2001 | ||
| 2 | +From: hanjinpeng <hanjinpeng@kylinos.cn> | ||
| 3 | +Date: Wed, 26 Aug 2026 10:11:24 +0800 | ||
| 4 | +Subject: [PATCH] fix: CVE-2026-39113 sqlar_uncompress buffer overflow | ||
| 5 | + | ||
| 6 | +Backport of upstream fix https://github.com/sqlite/sqlite/commit/169f68ed88b34cb68f720191c64c058f2ccec508 (Fossil 8bdc0d485e3ad0c7a1e818da66f106951d496b05cbe61d12c2c448f2f24b6d5d) fixing CVE-2026-39113. | ||
| 7 | +--- | ||
| 8 | + ext/misc/sqlar.c | 2 +- | ||
| 9 | + 1 file changed, 1 insertion(+), 1 deletion(-) | ||
| 10 | + | ||
| 11 | +diff --git a/ext/misc/sqlar.c b/ext/misc/sqlar.c | ||
| 12 | +index be079a5..f0f49d1 100644 | ||
| 13 | +--- a/ext/misc/sqlar.c | ||
| 14 | ++++ b/ext/misc/sqlar.c | ||
| 15 | + static void sqlarUncompressFunc( | ||
| 16 | + uLongf sz; | ||
| 17 | + | ||
| 18 | + assert( argc==2 ); | ||
| 19 | +- sz = sqlite3_value_int(argv[1]); | ||
| 20 | ++ sz = sqlite3_value_int64(argv[1]); | ||
| 21 | + | ||
| 22 | + if( sz<=0 || sz==(nData = sqlite3_value_bytes(argv[0])) ){ | ||
| 23 | + sqlite3_result_value(context, argv[0]); | ||
| 24 | +-- | ||
| 25 | +2.53.0.windows.1 | ||
| 26 | + | ||
| @@ -6,7 +6,7 @@ | |||
| 6 | 6 | ||
| 7 | Name: sqlite | 7 | Name: sqlite |
| 8 | Version: 3.42.0 | 8 | Version: 3.42.0 |
| 9 | -Release: 8 | 9 | +Release: 9 |
| 10 | Summary: Embeded SQL database | 10 | Summary: Embeded SQL database |
| 11 | License: Public Domain | 11 | License: Public Domain |
| 12 | URL: http://www.sqlite.org/ | 12 | URL: http://www.sqlite.org/ |
| @@ -25,6 +25,7 @@ Patch6006: backport-CVE-2025-70873.patch | |||
| 25 | Patch6007: backport-CVE-2026-11824.patch | 25 | Patch6007: backport-CVE-2026-11824.patch |
| 26 | Patch6008: backport-CVE-2026-50813.patch | 26 | Patch6008: backport-CVE-2026-50813.patch |
| 27 | Patch6009: backport-CVE-2026-50812.patch | 27 | Patch6009: backport-CVE-2026-50812.patch |
| 28 | +Patch6010: backport-CVE-2026-39113.patch | ||
| 28 | 29 | ||
| 29 | BuildRequires: gcc autoconf tcl tcl-devel | 30 | BuildRequires: gcc autoconf tcl tcl-devel |
| 30 | BuildRequires: ncurses-devel readline-devel glibc-devel | 31 | BuildRequires: ncurses-devel readline-devel glibc-devel |
| @@ -141,6 +142,9 @@ make test | |||
| 141 | %{_mandir}/man*/* | 142 | %{_mandir}/man*/* |
| 142 | 143 | ||
| 143 | %changelog | 144 | %changelog |
| 145 | +* Wed Aug 26 2026 hanjinpeng <hanjinpeng@kylinos.cn> - 3.42.0-9 | ||
| 146 | +- fix CVE-2026-39113 | ||
| 147 | + | ||
| 144 | * Tue Jul 14 2026 Han Jinpeng <hanjinpeng@kylinos.cn> - 3.42.0-8 | 148 | * Tue Jul 14 2026 Han Jinpeng <hanjinpeng@kylinos.cn> - 3.42.0-8 |
| 145 | - fix CVE-2026-50812: NULL pointer dereference in session extension | 149 | - fix CVE-2026-50812: NULL pointer dereference in session extension |
| 146 | 150 | ||