From e6fe342abbbe6cb9d659742f11ebb54b6117095d Mon Sep 17 00:00:00 2001 From: Andy Shaw Date: Mon, 9 Oct 2017 11:27:24 +0200 Subject: Fix CVE-2017-10989 in sqlite Change-Id: I556a453f386e887abee77a4dc147eae45970a61c Reviewed-by: Thiago Macieira Reviewed-by: Lars Knoll --- .../patches/0001-Fix-CVE-2017-10989-in-sqlite.patch | 15 +++++++++++++++ src/3rdparty/sqlite/sqlite3.c | 4 ++++ 2 files changed, 19 insertions(+) create mode 100644 src/3rdparty/sqlite/patches/0001-Fix-CVE-2017-10989-in-sqlite.patch diff --git a/src/3rdparty/sqlite/patches/0001-Fix-CVE-2017-10989-in-sqlite.patch b/src/3rdparty/sqlite/patches/0001-Fix-CVE-2017-10989-in-sqlite.patch new file mode 100644 index 0000000000..26d022f6c6 --- /dev/null +++ b/src/3rdparty/sqlite/patches/0001-Fix-CVE-2017-10989-in-sqlite.patch @@ -0,0 +1,15 @@ +diff --git a/src/3rdparty/sqlite/sqlite3.c b/src/3rdparty/sqlite/sqlite3.c +index 7f5e75921f..f5c6180a03 100644 +--- a/src/3rdparty/sqlite/sqlite3.c ++++ b/src/3rdparty/sqlite/sqlite3.c +@@ -165733,6 +165733,10 @@ static int getNodeSize( + rc = getIntFromStmt(db, zSql, &pRtree->iNodeSize); + if( rc!=SQLITE_OK ){ + *pzErr = sqlite3_mprintf("%s", sqlite3_errmsg(db)); ++ }else if( pRtree->iNodeSize<(512-64) ){ ++ rc = SQLITE_CORRUPT; ++ *pzErr = sqlite3_mprintf("undersize RTree blobs in \"%q_node\"", ++ pRtree->zName); + } + } + diff --git a/src/3rdparty/sqlite/sqlite3.c b/src/3rdparty/sqlite/sqlite3.c index 7f5e75921f..f5c6180a03 100644 --- a/src/3rdparty/sqlite/sqlite3.c +++ b/src/3rdparty/sqlite/sqlite3.c @@ -165733,6 +165733,10 @@ static int getNodeSize( rc = getIntFromStmt(db, zSql, &pRtree->iNodeSize); if( rc!=SQLITE_OK ){ *pzErr = sqlite3_mprintf("%s", sqlite3_errmsg(db)); + }else if( pRtree->iNodeSize<(512-64) ){ + rc = SQLITE_CORRUPT; + *pzErr = sqlite3_mprintf("undersize RTree blobs in \"%q_node\"", + pRtree->zName); } } -- cgit v1.2.3