aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorLeonardo Arena <rnalrd@alpinelinux.org>2020-05-07 12:39:09 +0000
committerLeonardo Arena <rnalrd@alpinelinux.org>2020-05-07 12:46:24 +0000
commitbc642570e0a6187ba125ae75709a929f82d6774f (patch)
tree00a26b10538ec9e3a3ae0abe33fe205ac247d430
parent1e7e09895fd7887b6fba58b013e2f31f14e7afea (diff)
downloadaports-bc642570e0a6187ba125ae75709a929f82d6774f.tar.gz
aports-bc642570e0a6187ba125ae75709a929f82d6774f.tar.bz2
aports-bc642570e0a6187ba125ae75709a929f82d6774f.tar.xz
main/sqlite: security fix (CVE-2020-11655)
ref #11508
-rw-r--r--main/sqlite/APKBUILD8
-rw-r--r--main/sqlite/CVE-2020-11655.patch24
2 files changed, 30 insertions, 2 deletions
diff --git a/main/sqlite/APKBUILD b/main/sqlite/APKBUILD
index 7beca97288..769d40f3c9 100644
--- a/main/sqlite/APKBUILD
+++ b/main/sqlite/APKBUILD
@@ -2,7 +2,7 @@
# Contributor: Ɓukasz Jendrysik <scadu@yandex.com>
pkgname=sqlite
pkgver=3.30.1
-pkgrel=1
+pkgrel=2
pkgdesc="C library that implements an SQL database engine"
url="https://www.sqlite.org/"
arch="all"
@@ -31,9 +31,12 @@ source="https://www.sqlite.org/2019/$pkgname-autoconf-$_ver.tar.gz
license.txt
CVE-2019-19242.patch
CVE-2019-19244.patch
+ CVE-2020-11655.patch
"
# secfixes:
+# 3.30.1-r2:
+# - CVE-2020-11655
# 3.30.1-r1:
# - CVE-2019-19242
# - CVE-2019-19242
@@ -110,4 +113,5 @@ static() {
sha512sums="9ec0283c417fb0323b0e43550af2a49e9a63988e4212c27ea62cc9da3534caa6faf5bdc7e051b6772c4ce61560a433b3d3288b68e05e9ba8495f61a3bcebda3e sqlite-autoconf-3300100.tar.gz
5bde14bec5bf18cc686b8b90a8b2324c8c6600bca1ae56431a795bb34b8b5ae85527143f3b5f0c845c776bce60eaa537624104cefc3a47b3820d43083f40c6e9 license.txt
c4e8123da7d85d59c9d2d1d07e443185cbc82102805361f2dd24da0482b683da57b7032f2c27273b46e6ed1b12f3714590cfc1258720bcb4e8405f67da214fe6 CVE-2019-19242.patch
-e7982014a62b4fa465918fd65384cec406ea09598f3e0511eb2b68f618983b2f29a932267397aff9b88b97367dc8e05c4074fa8e276e3f4294ac019df498a724 CVE-2019-19244.patch"
+e7982014a62b4fa465918fd65384cec406ea09598f3e0511eb2b68f618983b2f29a932267397aff9b88b97367dc8e05c4074fa8e276e3f4294ac019df498a724 CVE-2019-19244.patch
+c9d9f440543fa59fb4cb75d069b69adcccfdeb1c31bc9bd8d2f27b178013ea72934f6301d3df28e37a67cb6dbc38b2fc7bf87bacd93d756a62f3bf59a52ab3f2 CVE-2020-11655.patch"
diff --git a/main/sqlite/CVE-2020-11655.patch b/main/sqlite/CVE-2020-11655.patch
new file mode 100644
index 0000000000..ee58cf62e8
--- /dev/null
+++ b/main/sqlite/CVE-2020-11655.patch
@@ -0,0 +1,24 @@
+From 660733d19a17c9927275dbcde537d12531a8d121 Mon Sep 17 00:00:00 2001
+From: Leonardo Arena <rnalrd@alpinelinux.org>
+Date: Thu, 7 May 2020 12:37:05 +0000
+Subject: [PATCH] CVE-2020-11655
+
+---
+ sqlite3.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sqlite3.c b/sqlite3.c
+index 55dc686..f0ccb2d 100644
+--- a/sqlite3.c
++++ b/sqlite3.c
+@@ -133217,6 +133217,7 @@ static void resetAccumulator(Parse *pParse, AggInfo *pAggInfo){
+ struct AggInfo_func *pFunc;
+ int nReg = pAggInfo->nFunc + pAggInfo->nColumn;
+ if( nReg==0 ) return;
++ if( pParse->nErr ) return;
+ #ifdef SQLITE_DEBUG
+ /* Verify that all AggInfo registers are within the range specified by
+ ** AggInfo.mnReg..AggInfo.mxReg */
+--
+2.26.0
+