mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-04-23 00:32:12 +02:00
Code Issues Packages Projects Releases Wiki Activity

sqlite: fix CVE-2022-35737

Browse Source 
Increase the size of loop variables in the printf() implementation to avoid integer overflow on multi-gigabyte string arguments. CVE-2022-35737.

This bug fix refers to: CVE-2022-35737 and it's a backport of a fix added in sqlite 3.39.2 (2022-07-21).

(From OE-Core rev: fdc82b2314b580c0135c16b7278ebf8786311dec)

Signed-off-by: Ghassane Ben El Aattar <ghassaneb.aattar@huawei.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
ghassaneben
2022-08-29 16:57:20 +02:00
committed by Richard Purdie
parent a6fe1dab21
commit 51fa770857
1 changed files with 26 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
meta/recipes-support/sqlite/files/0001-sqlite-Increased-the-size-of-loop-variables-in-the-printf-implementation.patch Normal file
View File

@@ -0,0 +1,26 @@
From ec75530b8d8268cb07d8e476d79e1b0e59492fa2 Mon Sep 17 00:00:00 2001
From: drh
Date: Thu, 18 Aug 2022 15:10:46 +0200
Subject: [PATCH] sqlite: Increase the size of loop variables in the printf() implementation
Increase the size of loop variables in the printf() implementation to avoid integer overflow on multi-gigabyte string arguments. CVE-2022-35737.
This bug fix refers to: CVE-2022-35737 and it's a backport of a fix added in sqlite 3.39.2 (2022-07-21).
Signed-off-by: Ghassane Ben El Aattar ghassaneb.aattar@huawei.com
CVE: CVE-2022-35737
Upstream-Status: Backport [https://www.sqlite.org/src/info/aab790a16e1bdff7]
---
sqlite3.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/sqlite3.c b/sqlite3.c
index f867d62..490199a 100644
--- a/sqlite3.c
+++ b/sqlite3.c
@@ -30234,1 +30234,2 @@ static int vxprintf(
- int i, j, k, n, isnull;
+ i64 i, j, k, n;
+ int isnull;