已开启
fix CVE-2026-39113 #287
hanjinpeng创建于 8月26日
fix CVE-2026-39113 #287
已开启
共 2 个文件变更+31-1
| @@ -0,0 +1,26 @@ | |||
| 1 | +From 513fb6bac7fe62ff566eb589762c8801c74e74dc Mon Sep 17 00:00:00 2001 | ||
| 2 | +From: hanjinpeng <hanjinpeng@kylinos.cn> | ||
| 3 | +Date: Wed, 26 Aug 2026 10:12:07 +0800 | ||
| 4 | +Subject: [PATCH] fix: CVE-2026-39113 sqlar_uncompress buffer overflow | ||
| 5 | + | ||
| 6 | +Backport of upstream fix https://github.com/sqlite/sqlite/commit/169f68ed88b34cb68f720191c64c058f2ccec508 (Fossil 8bdc0d485e3ad0c7a1e818da66f106951d496b05cbe61d12c2c448f2f24b6d5d) fixing CVE-2026-39113. | ||
| 7 | +--- | ||
| 8 | + ext/misc/sqlar.c | 2 +- | ||
| 9 | + 1 file changed, 1 insertion(+), 1 deletion(-) | ||
| 10 | + | ||
| 11 | +diff --git a/ext/misc/sqlar.c b/ext/misc/sqlar.c | ||
| 12 | +index 47cb68f..b63c85e 100644 | ||
| 13 | +--- a/ext/misc/sqlar.c | ||
| 14 | ++++ b/ext/misc/sqlar.c | ||
| 15 | +@@ -84,7 +84,7 @@ static void sqlarUncompressFunc( | ||
| 16 | + uLongf sz; | ||
| 17 | + | ||
| 18 | + assert( argc==2 ); | ||
| 19 | +- sz = sqlite3_value_int(argv[1]); | ||
| 20 | ++ sz = sqlite3_value_int64(argv[1]); | ||
| 21 | + | ||
| 22 | + if( sz<=0 || sz==(nData = sqlite3_value_bytes(argv[0])) ){ | ||
| 23 | + sqlite3_result_value(context, argv[0]); | ||
| 24 | +-- | ||
| 25 | +2.53.0.windows.1 | ||
| 26 | + | ||
| @@ -6,7 +6,7 @@ | |||
| 6 | 6 | ||
| 7 | Name: sqlite | 7 | Name: sqlite |
| 8 | Version: 3.37.2 | 8 | Version: 3.37.2 |
| 9 | -Release: 11 | 9 | +Release: 12 |
| 10 | Summary: Embeded SQL database | 10 | Summary: Embeded SQL database |
| 11 | License: Public Domain | 11 | License: Public Domain |
| 12 | URL: http://www.sqlite.org/ | 12 | URL: http://www.sqlite.org/ |
| @@ -28,6 +28,7 @@ Patch10: 0010-CVE-2025-6965.patch | |||
| 28 | Patch11: backport-CVE-2026-11824.patch | 28 | Patch11: backport-CVE-2026-11824.patch |
| 29 | Patch12: backport-CVE-2026-50813.patch | 29 | Patch12: backport-CVE-2026-50813.patch |
| 30 | Patch13: backport-CVE-2026-50812.patch | 30 | Patch13: backport-CVE-2026-50812.patch |
| 31 | +Patch14: backport-CVE-2026-39113.patch | ||
| 31 | 32 | ||
| 32 | BuildRequires: gcc autoconf tcl tcl-devel | 33 | BuildRequires: gcc autoconf tcl tcl-devel |
| 33 | BuildRequires: ncurses-devel readline-devel glibc-devel | 34 | BuildRequires: ncurses-devel readline-devel glibc-devel |
| @@ -145,6 +146,9 @@ make test | |||
| 145 | %{_mandir}/man*/* | 146 | %{_mandir}/man*/* |
| 146 | 147 | ||
| 147 | %changelog | 148 | %changelog |
| 149 | +* Wed Aug 26 2026 hanjinpeng <hanjinpeng@kylinos.cn> - 3.37.2-12 | ||
| 150 | +- fix CVE-2026-39113 | ||
| 151 | + | ||
| 148 | * Thu Aug 13 2026 Yan Zhicong <mryanzhicong@163.com> - 3.37.2-11 | 152 | * Thu Aug 13 2026 Yan Zhicong <mryanzhicong@163.com> - 3.37.2-11 |
| 149 | - fix CVE-2026-50812: NULL pointer dereference in session extension | 153 | - fix CVE-2026-50812: NULL pointer dereference in session extension |
| 150 | 154 | ||