已开启
fix CVE-2026-39113 #288
hanjinpeng创建于 14 天前
fix CVE-2026-39113 #288
已开启
共 2 个文件变更+31-1
| @@ -0,0 +1,26 @@ | |||
| 1 | +From 77178b558e3b850e8c1eefc2233ddf417b61177b Mon Sep 17 00:00:00 2001 | ||
| 2 | +From: hanjinpeng <hanjinpeng@kylinos.cn> | ||
| 3 | +Date: Wed, 26 Aug 2026 10:12:48 +0800 | ||
| 4 | +Subject: [PATCH] fix: CVE-2026-39113 sqlar_uncompress buffer overflow | ||
| 5 | + | ||
| 6 | +Backport of upstream fix https://github.com/sqlite/sqlite/commit/169f68ed88b34cb68f720191c64c058f2ccec508 (Fossil 8bdc0d485e3ad0c7a1e818da66f106951d496b05cbe61d12c2c448f2f24b6d5d) fixing CVE-2026-39113. | ||
| 7 | +--- | ||
| 8 | + ext/misc/sqlar.c | 2 +- | ||
| 9 | + 1 file changed, 1 insertion(+), 1 deletion(-) | ||
| 10 | + | ||
| 11 | +diff --git a/ext/misc/sqlar.c b/ext/misc/sqlar.c | ||
| 12 | +index 47cb68f..b63c85e 100644 | ||
| 13 | +--- a/ext/misc/sqlar.c | ||
| 14 | ++++ b/ext/misc/sqlar.c | ||
| 15 | + static void sqlarUncompressFunc( | ||
| 16 | + uLongf sz; | ||
| 17 | + | ||
| 18 | + assert( argc==2 ); | ||
| 19 | +- sz = sqlite3_value_int(argv[1]); | ||
| 20 | ++ sz = sqlite3_value_int64(argv[1]); | ||
| 21 | + | ||
| 22 | + if( sz<=0 || sz==(nData = sqlite3_value_bytes(argv[0])) ){ | ||
| 23 | + sqlite3_result_value(context, argv[0]); | ||
| 24 | +-- | ||
| 25 | +2.53.0.windows.1 | ||
| 26 | + | ||
| @@ -7,7 +7,7 @@ | |||
| 7 | 7 | ||
| 8 | Name: sqlite | 8 | Name: sqlite |
| 9 | Version: 3.32.3 | 9 | Version: 3.32.3 |
| 10 | -Release: 10 | 10 | +Release: 11 |
| 11 | Summary: Embeded SQL database | 11 | Summary: Embeded SQL database |
| 12 | License: Public Domain | 12 | License: Public Domain |
| 13 | URL: http://www.sqlite.org/ | 13 | URL: http://www.sqlite.org/ |
| @@ -27,6 +27,7 @@ Patch8: backport-CVE-2025-70873.patch | |||
| 27 | Patch9: sqlite-3.34.1-CVE-2025-6965.patch | 27 | Patch9: sqlite-3.34.1-CVE-2025-6965.patch |
| 28 | Patch10: backport-CVE-2026-11824.patch | 28 | Patch10: backport-CVE-2026-11824.patch |
| 29 | Patch11: backport-CVE-2026-50813.patch | 29 | Patch11: backport-CVE-2026-50813.patch |
| 30 | +Patch12: backport-CVE-2026-39113.patch | ||
| 30 | 31 | ||
| 31 | BuildRequires: gcc autoconf tcl tcl-devel | 32 | BuildRequires: gcc autoconf tcl tcl-devel |
| 32 | BuildRequires: ncurses-devel readline-devel glibc-devel | 33 | BuildRequires: ncurses-devel readline-devel glibc-devel |
| @@ -142,6 +143,9 @@ make test | |||
| 142 | %{_mandir}/man*/* | 143 | %{_mandir}/man*/* |
| 143 | 144 | ||
| 144 | %changelog | 145 | %changelog |
| 146 | +* Wed Aug 26 2026 hanjinpeng <hanjinpeng@kylinos.cn> - 3.32.3-11 | ||
| 147 | +- fix CVE-2026-39113 | ||
| 148 | + | ||
| 145 | * Tue Jul 14 2026 Qin Fandong <qinfandong@kylinos.cn> - 3.32.3-10 | 149 | * Tue Jul 14 2026 Qin Fandong <qinfandong@kylinos.cn> - 3.32.3-10 |
| 146 | - fix CVE-2026-50813 | 150 | - fix CVE-2026-50813 |
| 147 | 151 | ||