* [thud][PATCH] sqlite3: CVE-2019-8457.patch fix Backport from 3.28.0 Sign off: Shubham Agrawal<shuagr@microsoft.com>
@ 2019-10-01 18:12 shuagr97
2019-10-01 18:32 ` ✗ patchtest: failure for " Patchwork
2019-10-06 22:25 ` [thud][PATCH] " akuster808
0 siblings, 2 replies; 3+ messages in thread
From: shuagr97 @ 2019-10-01 18:12 UTC (permalink / raw
To: openembedded-core
From: Shubham Agrawal <shuagr@microsoft.com>
---
.../sqlite/files/CVE-2019-8457.patch | 124 +++++++++++++++++++++
meta/recipes-support/sqlite/sqlite3_3.23.1.bb | 1 +
2 files changed, 125 insertions(+)
create mode 100644 meta/recipes-support/sqlite/files/CVE-2019-8457.patch
diff --git a/meta/recipes-support/sqlite/files/CVE-2019-8457.patch b/meta/recipes-support/sqlite/files/CVE-2019-8457.patch
new file mode 100644
index 0000000..a103dd8
--- /dev/null
+++ b/meta/recipes-support/sqlite/files/CVE-2019-8457.patch
@@ -0,0 +1,124 @@
+From fbf2392644f0ae4282fa4583c9bb67260995d983 Mon Sep 17 00:00:00 2001
+From: Shubham Agrawal <shuagr@microsoft.com>
+Date: Mon, 23 Sep 2019 20:58:47 +0000
+Subject: [PATCH] CVE: CVE-2019-8457 Upstream-Status: Backport
+
+Sign off: Shubham Agrawal <shuagr@microsoft.com>
+---
+ sqlite3.c | 50 +++++++++++++++++++++++++++++++-------------------
+ 1 file changed, 31 insertions(+), 19 deletions(-)
+
+diff --git a/sqlite3.c b/sqlite3.c
+index 00513d4..5c8c7f4 100644
+--- a/sqlite3.c
++++ b/sqlite3.c
+@@ -172325,6 +172325,33 @@
+ }
+
+
++/* Allocate and initialize a new dynamic string object */
++StrAccum *sqlite3_str_new(sqlite3 *db){
++ StrAccum *p = sqlite3DbMallocRaw(db, sizeof(*p));
++ if( p ){
++ sqlite3StrAccumInit(p, db, 0, 0, SQLITE_MAX_LENGTH);
++ }
++ return p;
++}
++
++/* Finalize a string created using sqlite3_str_new().
++*/
++
++char *sqlite3_str_finish(StrAccum *p){
++ char *z;
++ if( p ){
++ z = sqlite3StrAccumFinish(p);
++ sqlite3DbFree(p->db, p);
++ }else{
++ z = 0;
++ }
++ return z;
++}
++/* Return any error code associated with p */
++int sqlite3_str_errcode(StrAccum *p){
++ return p ? p->accError : SQLITE_NOMEM;
++}
++
+ /*
+ ** Implementation of a scalar function that decodes r-tree nodes to
+ ** human readable strings. This can be used for debugging and analysis.
+@@ -172342,49 +172369,53 @@
+ ** <num-dimension>*2 coordinates.
+ */
+ static void rtreenode(sqlite3_context *ctx, int nArg, sqlite3_value **apArg){
+- char *zText = 0;
++
+ RtreeNode node;
+ Rtree tree;
+ int ii;
++ int nData;
++ int errCode;
++ StrAccum *pOut;
+
+ UNUSED_PARAMETER(nArg);
+ memset(&node, 0, sizeof(RtreeNode));
+ memset(&tree, 0, sizeof(Rtree));
+ tree.nDim = (u8)sqlite3_value_int(apArg[0]);
++ if( tree.nDim<1 || tree.nDim>5 ) return;
+ tree.nDim2 = tree.nDim*2;
+ tree.nBytesPerCell = 8 + 8 * tree.nDim;
+ node.zData = (u8 *)sqlite3_value_blob(apArg[1]);
++ nData = sqlite3_value_bytes(apArg[1]);
++ if( nData<4 ) return;
++ if( nData<NCELL(&node)*tree.nBytesPerCell ) return;
+
++ pOut = sqlite3_str_new(0);
+ for(ii=0; ii<NCELL(&node); ii++){
+- char zCell[512];
+- int nCell = 0;
++
++
+ RtreeCell cell;
+ int jj;
+
+ nodeGetCell(&tree, &node, ii, &cell);
+- sqlite3_snprintf(512-nCell,&zCell[nCell],"%lld", cell.iRowid);
+- nCell = (int)strlen(zCell);
++ if( ii>0 ) sqlite3StrAccumAppend(pOut, " ", 1);
++ sqlite3XPrintf(pOut, "{%lld", cell.iRowid);
++
+ for(jj=0; jj<tree.nDim2; jj++){
+ #ifndef SQLITE_RTREE_INT_ONLY
+- sqlite3_snprintf(512-nCell,&zCell[nCell], " %g",
+- (double)cell.aCoord[jj].f);
++
++ sqlite3XPrintf(pOut, " %g", (double)cell.aCoord[jj].f);
+ #else
+- sqlite3_snprintf(512-nCell,&zCell[nCell], " %d",
+- cell.aCoord[jj].i);
++
++ sqlite3XPrintf(pOut, " %d", cell.aCoord[jj].i);
+ #endif
+- nCell = (int)strlen(zCell);
+- }
+
+- if( zText ){
+- char *zTextNew = sqlite3_mprintf("%s {%s}", zText, zCell);
+- sqlite3_free(zText);
+- zText = zTextNew;
+- }else{
+- zText = sqlite3_mprintf("{%s}", zCell);
+ }
++ sqlite3StrAccumAppend(pOut, "}", 1);
+ }
+-
+- sqlite3_result_text(ctx, zText, -1, sqlite3_free);
++
++ errCode = sqlite3_str_errcode(pOut);
++ sqlite3_result_text(ctx, sqlite3_str_finish(pOut), -1, sqlite3_free);
++ sqlite3_result_error_code(ctx, errCode);
+ }
+
+ /* This routine implements an SQL function that returns the "depth" parameter
+--
+2.7.4
+
diff --git a/meta/recipes-support/sqlite/sqlite3_3.23.1.bb b/meta/recipes-support/sqlite/sqlite3_3.23.1.bb
index d214ea1..7df61cd 100644
--- a/meta/recipes-support/sqlite/sqlite3_3.23.1.bb
+++ b/meta/recipes-support/sqlite/sqlite3_3.23.1.bb
@@ -7,6 +7,7 @@ SRC_URI = "\
http://www.sqlite.org/2018/sqlite-autoconf-${SQLITE_PV}.tar.gz \
file://CVE-2018-20505.patch \
file://CVE-2018-20506.patch \
+ file://CVE-2019-8457.patch \
"
SRC_URI[md5sum] = "99a51b40a66872872a91c92f6d0134fa"
SRC_URI[sha256sum] = "92842b283e5e744eff5da29ed3c69391de7368fccc4d0ee6bf62490ce555ef25"
--
2.7.4
^ permalink raw reply related [flat|nested] 3+ messages in thread
* ✗ patchtest: failure for sqlite3: CVE-2019-8457.patch fix Backport from 3.28.0 Sign off: Shubham Agrawal<shuagr@microsoft.com>
2019-10-01 18:12 [thud][PATCH] sqlite3: CVE-2019-8457.patch fix Backport from 3.28.0 Sign off: Shubham Agrawal<shuagr@microsoft.com> shuagr97
@ 2019-10-01 18:32 ` Patchwork
2019-10-06 22:25 ` [thud][PATCH] " akuster808
1 sibling, 0 replies; 3+ messages in thread
From: Patchwork @ 2019-10-01 18:32 UTC (permalink / raw
To: shuagr97; +Cc: openembedded-core
== Series Details ==
Series: sqlite3: CVE-2019-8457.patch fix Backport from 3.28.0 Sign off: Shubham Agrawal<shuagr@microsoft.com>
Revision: 1
URL : https://patchwork.openembedded.org/series/20258/
State : failure
== Summary ==
Thank you for submitting this patch series to OpenEmbedded Core. This is
an automated response. Several tests have been executed on the proposed
series by patchtest resulting in the following failures:
* Patch [thud] sqlite3: CVE-2019-8457.patch fix Backport from 3.28.0 Sign off: Shubham Agrawal<shuagr@microsoft.com>
Issue Commit shortlog is too long [test_shortlog_length]
Suggested fix Edit shortlog so that it is 90 characters or less (currently 101 characters)
* Patch [thud] sqlite3: CVE-2019-8457.patch fix Backport from 3.28.0 Sign off: Shubham Agrawal<shuagr@microsoft.com>
Issue Patch is missing Signed-off-by [test_signed_off_by_presence]
Suggested fix Sign off the patch (either manually or with "git commit --amend -s")
* Patch [thud] sqlite3: CVE-2019-8457.patch fix Backport from 3.28.0 Sign off: Shubham Agrawal<shuagr@microsoft.com>
Issue Missing or incorrectly formatted CVE tag in included patch file [test_cve_tag_format]
Suggested fix Correct or include the CVE tag on cve patch with format: "CVE: CVE-YYYY-XXXX"
* Issue A patch file has been added, but does not have a Signed-off-by tag [test_signed_off_by_presence]
Suggested fix Sign off the added patch file (meta/recipes-support/sqlite/files/CVE-2019-8457.patch)
* Issue Added patch file is missing Upstream-Status in the header [test_upstream_status_presence_format]
Suggested fix Add Upstream-Status: <Valid status> to the header of meta/recipes-support/sqlite/files/CVE-2019-8457.patch
Standard format Upstream-Status: <Valid status>
Valid status Pending, Accepted, Backport, Denied, Inappropriate [reason], Submitted [where]
If you believe any of these test results are incorrect, please reply to the
mailing list (openembedded-core@lists.openembedded.org) raising your concerns.
Otherwise we would appreciate you correcting the issues and submitting a new
version of the patchset if applicable. Please ensure you add/increment the
version number when sending the new version (i.e. [PATCH] -> [PATCH v2] ->
[PATCH v3] -> ...).
---
Guidelines: https://www.openembedded.org/wiki/Commit_Patch_Message_Guidelines
Test framework: http://git.yoctoproject.org/cgit/cgit.cgi/patchtest
Test suite: http://git.yoctoproject.org/cgit/cgit.cgi/patchtest-oe
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [thud][PATCH] sqlite3: CVE-2019-8457.patch fix Backport from 3.28.0 Sign off: Shubham Agrawal<shuagr@microsoft.com>
2019-10-01 18:12 [thud][PATCH] sqlite3: CVE-2019-8457.patch fix Backport from 3.28.0 Sign off: Shubham Agrawal<shuagr@microsoft.com> shuagr97
2019-10-01 18:32 ` ✗ patchtest: failure for " Patchwork
@ 2019-10-06 22:25 ` akuster808
1 sibling, 0 replies; 3+ messages in thread
From: akuster808 @ 2019-10-06 22:25 UTC (permalink / raw
To: shuagr, openembedded-core
On 10/1/19 11:12 AM, shuagr97@gmail.com wrote:
> From: Shubham Agrawal <shuagr@microsoft.com>
I cleaned up the patch to conform to the patch guide.
see
https://git.openembedded.org/openembedded-core-contrib/commit/?h=stable/thud-nmut&id=c0c66d213b4b6deb0a5e9a688810d2e9674d3ecf
as an example of what was meant.
- armin
>
> ---
> .../sqlite/files/CVE-2019-8457.patch | 124 +++++++++++++++++++++
> meta/recipes-support/sqlite/sqlite3_3.23.1.bb | 1 +
> 2 files changed, 125 insertions(+)
> create mode 100644 meta/recipes-support/sqlite/files/CVE-2019-8457.patch
>
> diff --git a/meta/recipes-support/sqlite/files/CVE-2019-8457.patch b/meta/recipes-support/sqlite/files/CVE-2019-8457.patch
> new file mode 100644
> index 0000000..a103dd8
> --- /dev/null
> +++ b/meta/recipes-support/sqlite/files/CVE-2019-8457.patch
> @@ -0,0 +1,124 @@
> +From fbf2392644f0ae4282fa4583c9bb67260995d983 Mon Sep 17 00:00:00 2001
> +From: Shubham Agrawal <shuagr@microsoft.com>
> +Date: Mon, 23 Sep 2019 20:58:47 +0000
> +Subject: [PATCH] CVE: CVE-2019-8457 Upstream-Status: Backport
> +
> +Sign off: Shubham Agrawal <shuagr@microsoft.com>
> +---
> + sqlite3.c | 50 +++++++++++++++++++++++++++++++-------------------
> + 1 file changed, 31 insertions(+), 19 deletions(-)
> +
> +diff --git a/sqlite3.c b/sqlite3.c
> +index 00513d4..5c8c7f4 100644
> +--- a/sqlite3.c
> ++++ b/sqlite3.c
> +@@ -172325,6 +172325,33 @@
> + }
> +
> +
> ++/* Allocate and initialize a new dynamic string object */
> ++StrAccum *sqlite3_str_new(sqlite3 *db){
> ++ StrAccum *p = sqlite3DbMallocRaw(db, sizeof(*p));
> ++ if( p ){
> ++ sqlite3StrAccumInit(p, db, 0, 0, SQLITE_MAX_LENGTH);
> ++ }
> ++ return p;
> ++}
> ++
> ++/* Finalize a string created using sqlite3_str_new().
> ++*/
> ++
> ++char *sqlite3_str_finish(StrAccum *p){
> ++ char *z;
> ++ if( p ){
> ++ z = sqlite3StrAccumFinish(p);
> ++ sqlite3DbFree(p->db, p);
> ++ }else{
> ++ z = 0;
> ++ }
> ++ return z;
> ++}
> ++/* Return any error code associated with p */
> ++int sqlite3_str_errcode(StrAccum *p){
> ++ return p ? p->accError : SQLITE_NOMEM;
> ++}
> ++
> + /*
> + ** Implementation of a scalar function that decodes r-tree nodes to
> + ** human readable strings. This can be used for debugging and analysis.
> +@@ -172342,49 +172369,53 @@
> + ** <num-dimension>*2 coordinates.
> + */
> + static void rtreenode(sqlite3_context *ctx, int nArg, sqlite3_value **apArg){
> +- char *zText = 0;
> ++
> + RtreeNode node;
> + Rtree tree;
> + int ii;
> ++ int nData;
> ++ int errCode;
> ++ StrAccum *pOut;
> +
> + UNUSED_PARAMETER(nArg);
> + memset(&node, 0, sizeof(RtreeNode));
> + memset(&tree, 0, sizeof(Rtree));
> + tree.nDim = (u8)sqlite3_value_int(apArg[0]);
> ++ if( tree.nDim<1 || tree.nDim>5 ) return;
> + tree.nDim2 = tree.nDim*2;
> + tree.nBytesPerCell = 8 + 8 * tree.nDim;
> + node.zData = (u8 *)sqlite3_value_blob(apArg[1]);
> ++ nData = sqlite3_value_bytes(apArg[1]);
> ++ if( nData<4 ) return;
> ++ if( nData<NCELL(&node)*tree.nBytesPerCell ) return;
> +
> ++ pOut = sqlite3_str_new(0);
> + for(ii=0; ii<NCELL(&node); ii++){
> +- char zCell[512];
> +- int nCell = 0;
> ++
> ++
> + RtreeCell cell;
> + int jj;
> +
> + nodeGetCell(&tree, &node, ii, &cell);
> +- sqlite3_snprintf(512-nCell,&zCell[nCell],"%lld", cell.iRowid);
> +- nCell = (int)strlen(zCell);
> ++ if( ii>0 ) sqlite3StrAccumAppend(pOut, " ", 1);
> ++ sqlite3XPrintf(pOut, "{%lld", cell.iRowid);
> ++
> + for(jj=0; jj<tree.nDim2; jj++){
> + #ifndef SQLITE_RTREE_INT_ONLY
> +- sqlite3_snprintf(512-nCell,&zCell[nCell], " %g",
> +- (double)cell.aCoord[jj].f);
> ++
> ++ sqlite3XPrintf(pOut, " %g", (double)cell.aCoord[jj].f);
> + #else
> +- sqlite3_snprintf(512-nCell,&zCell[nCell], " %d",
> +- cell.aCoord[jj].i);
> ++
> ++ sqlite3XPrintf(pOut, " %d", cell.aCoord[jj].i);
> + #endif
> +- nCell = (int)strlen(zCell);
> +- }
> +
> +- if( zText ){
> +- char *zTextNew = sqlite3_mprintf("%s {%s}", zText, zCell);
> +- sqlite3_free(zText);
> +- zText = zTextNew;
> +- }else{
> +- zText = sqlite3_mprintf("{%s}", zCell);
> + }
> ++ sqlite3StrAccumAppend(pOut, "}", 1);
> + }
> +-
> +- sqlite3_result_text(ctx, zText, -1, sqlite3_free);
> ++
> ++ errCode = sqlite3_str_errcode(pOut);
> ++ sqlite3_result_text(ctx, sqlite3_str_finish(pOut), -1, sqlite3_free);
> ++ sqlite3_result_error_code(ctx, errCode);
> + }
> +
> + /* This routine implements an SQL function that returns the "depth" parameter
> +--
> +2.7.4
> +
> diff --git a/meta/recipes-support/sqlite/sqlite3_3.23.1.bb b/meta/recipes-support/sqlite/sqlite3_3.23.1.bb
> index d214ea1..7df61cd 100644
> --- a/meta/recipes-support/sqlite/sqlite3_3.23.1.bb
> +++ b/meta/recipes-support/sqlite/sqlite3_3.23.1.bb
> @@ -7,6 +7,7 @@ SRC_URI = "\
> http://www.sqlite.org/2018/sqlite-autoconf-${SQLITE_PV}.tar.gz \
> file://CVE-2018-20505.patch \
> file://CVE-2018-20506.patch \
> + file://CVE-2019-8457.patch \
> "
> SRC_URI[md5sum] = "99a51b40a66872872a91c92f6d0134fa"
> SRC_URI[sha256sum] = "92842b283e5e744eff5da29ed3c69391de7368fccc4d0ee6bf62490ce555ef25"
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2019-10-06 22:25 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2019-10-01 18:12 [thud][PATCH] sqlite3: CVE-2019-8457.patch fix Backport from 3.28.0 Sign off: Shubham Agrawal<shuagr@microsoft.com> shuagr97
2019-10-01 18:32 ` ✗ patchtest: failure for " Patchwork
2019-10-06 22:25 ` [thud][PATCH] " akuster808
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.