diff options
Diffstat (limited to 'meta/recipes-support/sqlite/sqlite3/CVE-2019-9937.patch')
-rw-r--r-- | meta/recipes-support/sqlite/sqlite3/CVE-2019-9937.patch | 187 |
1 files changed, 0 insertions, 187 deletions
diff --git a/meta/recipes-support/sqlite/sqlite3/CVE-2019-9937.patch b/meta/recipes-support/sqlite/sqlite3/CVE-2019-9937.patch deleted file mode 100644 index baa5666dda..0000000000 --- a/meta/recipes-support/sqlite/sqlite3/CVE-2019-9937.patch +++ /dev/null @@ -1,187 +0,0 @@ -Interleaving reads and writes in a single transaction with an fts5 virtual table -will lead to a NULL Pointer Dereference in fts5ChunkIterate in sqlite3.c. - -CVE: CVE-2019-9937 -Upstream-Status: Backport [https://sqlite.org/src/vpatch?from=c2f50aa4e7bad882&to=45c73deb440496e8] -Signed-off-by: Ross Burton <ross.burton@intel.com> - ---- - sqlite3.c | 83 ++++++++++++++++++++++++++++++++++++++----------------- - 1 file changed, 57 insertions(+), 26 deletions(-) - -diff --git a/sqlite3.c b/sqlite3.c -index 65527d8..b1a8799 100644 ---- a/sqlite3.c -+++ b/sqlite3.c -@@ -200668,8 +200668,9 @@ static void sqlite3Fts5HashClear(Fts5Hash*); - - static int sqlite3Fts5HashQuery( - Fts5Hash*, /* Hash table to query */ -+ int nPre, - const char *pTerm, int nTerm, /* Query term */ -- const u8 **ppDoclist, /* OUT: Pointer to doclist for pTerm */ -+ void **ppObj, /* OUT: Pointer to doclist for pTerm */ - int *pnDoclist /* OUT: Size of doclist in bytes */ - ); - -@@ -207501,19 +207502,25 @@ static int fts5HashResize(Fts5Hash *pHash){ - return SQLITE_OK; - } - --static void fts5HashAddPoslistSize(Fts5Hash *pHash, Fts5HashEntry *p){ -+static int fts5HashAddPoslistSize( -+ Fts5Hash *pHash, -+ Fts5HashEntry *p, -+ Fts5HashEntry *p2 -+){ -+ int nRet = 0; - if( p->iSzPoslist ){ -- u8 *pPtr = (u8*)p; -+ u8 *pPtr = p2 ? (u8*)p2 : (u8*)p; -+ int nData = p->nData; - if( pHash->eDetail==FTS5_DETAIL_NONE ){ -- assert( p->nData==p->iSzPoslist ); -+ assert( nData==p->iSzPosList ); - if( p->bDel ){ -- pPtr[p->nData++] = 0x00; -+ pPtr[nData++] = 0x00; - if( p->bContent ){ -- pPtr[p->nData++] = 0x00; -+ pPtr[nData++] = 0x00; - } - } - }else{ -- int nSz = (p->nData - p->iSzPoslist - 1); /* Size in bytes */ -+ int nSz = (nData - p->iSzPoslist - 1); /* Size in bytes */ - int nPos = nSz*2 + p->bDel; /* Value of nPos field */ - - assert( p->bDel==0 || p->bDel==1 ); -@@ -207523,14 +207530,19 @@ static void fts5HashAddPoslistSize(Fts5Hash *pHash, Fts5HashEntry *p){ - int nByte = sqlite3Fts5GetVarintLen((u32)nPos); - memmove(&pPtr[p->iSzPoslist + nByte], &pPtr[p->iSzPoslist + 1], nSz); - sqlite3Fts5PutVarint(&pPtr[p->iSzPoslist], nPos); -- p->nData += (nByte-1); -+ nData += (nByte-1); - } - } - -- p->iSzPoslist = 0; -- p->bDel = 0; -- p->bContent = 0; -+ nRet = nData - p->nData; -+ if( p2 == 0 ){ -+ p->iSzPoslist = 0; -+ p->bDel = 0; -+ p->bContent = 0; -+ p->nData = nData; -+ } - } -+ return nRet; - } - - /* -@@ -207642,7 +207654,7 @@ static int sqlite3Fts5HashWrite( - /* If this is a new rowid, append the 4-byte size field for the previous - ** entry, and the new rowid for this entry. */ - if( iRowid!=p->iRowid ){ -- fts5HashAddPoslistSize(pHash, p); -+ fts5HashAddPoslistSize(pHash, p, 0); - p->nData += sqlite3Fts5PutVarint(&pPtr[p->nData], iRowid - p->iRowid); - p->iRowid = iRowid; - bNew = 1; -@@ -207789,8 +207801,9 @@ static int fts5HashEntrySort( - */ - static int sqlite3Fts5HashQuery( - Fts5Hash *pHash, /* Hash table to query */ -+ int nPre, - const char *pTerm, int nTerm, /* Query term */ -- const u8 **ppDoclist, /* OUT: Pointer to doclist for pTerm */ -+ void **ppOut, /* OUT: Pointer to new object */ - int *pnDoclist /* OUT: Size of doclist in bytes */ - ){ - unsigned int iHash = fts5HashKey(pHash->nSlot, (const u8*)pTerm, nTerm); -@@ -207804,11 +207817,20 @@ static int sqlite3Fts5HashQuery( - } - - if( p ){ -- fts5HashAddPoslistSize(pHash, p); -- *ppDoclist = (const u8*)&zKey[nTerm+1]; -- *pnDoclist = p->nData - (sizeof(Fts5HashEntry) + nTerm + 1); -+ int nHashPre = sizeof(Fts5HashEntry) + nTerm + 1; -+ int nList = p->nData - nHashPre; -+ u8 *pRet = (u8*)(*ppOut = sqlite3_malloc64(nPre + nList + 10)); -+ if ( pRet ){ -+ Fts5HashEntry *pFaux = (Fts5HashEntry*)&pRet[nPre-nHashPre]; -+ memcpy(&pRet[nPre], &((u8*)p)[nHashPre], nList); -+ nList += fts5HashAddPoslistSize(pHash, p, pFaux); -+ *pnDoclist = nList; -+ }else{ -+ *pnDoclist = 0; -+ return SQLITE_NOMEM; -+ } - }else{ -- *ppDoclist = 0; -+ *ppOut = 0; - *pnDoclist = 0; - } - -@@ -207841,7 +207863,7 @@ static void sqlite3Fts5HashScanEntry( - if( (p = pHash->pScan) ){ - char *zKey = fts5EntryKey(p); - int nTerm = (int)strlen(zKey); -- fts5HashAddPoslistSize(pHash, p); -+ fts5HashAddPoslistSize(pHash, p, 0); - *pzTerm = zKey; - *ppDoclist = (const u8*)&zKey[nTerm+1]; - *pnDoclist = p->nData - (sizeof(Fts5HashEntry) + nTerm + 1); -@@ -210311,31 +210333,40 @@ static void fts5SegIterHashInit( - int flags, /* Mask of FTS5INDEX_XXX flags */ - Fts5SegIter *pIter /* Object to populate */ - ){ -- const u8 *pList = 0; - int nList = 0; - const u8 *z = 0; - int n = 0; -+ Fts5Data *pLeaf = 0; - - assert( p->pHash ); - assert( p->rc==SQLITE_OK ); - - if( pTerm==0 || (flags & FTS5INDEX_QUERY_SCAN) ){ -+ const u8 *pList = 0; -+ - p->rc = sqlite3Fts5HashScanInit(p->pHash, (const char*)pTerm, nTerm); - sqlite3Fts5HashScanEntry(p->pHash, (const char**)&z, &pList, &nList); - n = (z ? (int)strlen((const char*)z) : 0); -+ if ( pList ){ -+ pLeaf = fts5IdxMalloc(p, sizeof(Fts5Data)); -+ if ( pLeaf ){ -+ pLeaf->p = pList; -+ } -+ } - }else{ -- pIter->flags |= FTS5_SEGITER_ONETERM; -- sqlite3Fts5HashQuery(p->pHash, (const char*)pTerm, nTerm, &pList, &nList); -+ p->rc = sqlite3Fts5HashQuery(p->pHash, sizeof(Fts5Data), -+ (const char*)pTerm, nTerm, (void**)&pLeaf, &nList -+ ); -+ if( pLeaf ){ -+ pLeaf->p = (u8*)&pLeaf[1]; -+ } - z = pTerm; - n = nTerm; -+ pIter->flags |= FTS5_SEGITER_ONETERM; - } - -- if( pList ){ -- Fts5Data *pLeaf; -+ if( pLeaf ){ - sqlite3Fts5BufferSet(&p->rc, &pIter->term, n, z); -- pLeaf = fts5IdxMalloc(p, sizeof(Fts5Data)); -- if( pLeaf==0 ) return; -- pLeaf->p = (u8*)pList; - pLeaf->nn = pLeaf->szLeaf = nList; - pIter->pLeaf = pLeaf; - pIter->iLeafOffset = fts5GetVarint(pLeaf->p, (u64*)&pIter->iRowid); --- -2.20.1 |