[Buildroot] [git commit branch/2025.05.x] package/sqlite: add patch for CVE-2025-6965
Thomas Perale
thomas.perale at mind.be
Thu Sep 11 15:13:40 UTC 2025
commit: https://git.buildroot.net/buildroot/commit/?id=d1a3c2144206a0fc9bbe387c9da0b95802570952
branch: https://git.buildroot.net/buildroot/commit/?id=refs/heads/2025.05.x
This fixes the following vulnerability:
- CVE-2025-6965:
There exists a vulnerability in SQLite versions before 3.50.2 where
the number of aggregate terms could exceed the number of columns
available. This could lead to a memory corruption issue. We recommend
upgrading to version 3.50.2 or above.
https://www.cve.org/CVERecord?id=CVE-2025-6965
Signed-off-by: Titouan Christophe <titouan.christophe at mind.be>
Signed-off-by: Peter Korsgaard <peter at korsgaard.com>
(cherry picked from commit c4c282f8ec2bec752ca41f4cfebe3c34f45ffade)
Signed-off-by: Thomas Perale <thomas.perale at mind.be>
---
...3-Raise-error-if-too-many-aggregate-terms.patch | 123 +++++++++++++++++++++
package/sqlite/sqlite.mk | 2 +
2 files changed, 125 insertions(+)
diff --git a/package/sqlite/0003-Raise-error-if-too-many-aggregate-terms.patch b/package/sqlite/0003-Raise-error-if-too-many-aggregate-terms.patch
new file mode 100644
index 0000000000..43be545b83
--- /dev/null
+++ b/package/sqlite/0003-Raise-error-if-too-many-aggregate-terms.patch
@@ -0,0 +1,123 @@
+From 1cbb088f4be95e7a02627f64de60653ef2b13ab5 Mon Sep 17 00:00:00 2001
+From: drh <>
+Date: Sun, 16 Feb 2025 10:57:25 +0000
+Subject: [PATCH] Raise an error right away if the number of aggregate terms in a query exceeds the maximum number of columns.
+
+CVE: CVE-2025-6965
+
+For more info see https://nvd.nist.gov/vuln/detail/CVE-2025-6965
+
+Upstream: https://www.sqlite.org/src/vinfo/5508b56fd24016c13981ec280ecdd833007c9d8dd595edb295b984c2b487b5c8
+
+[Titouan: adapt to sqlite3 "amalgamation" source code]
+Signed-off-by: Titouan Christophe <titouan.christophe at mind.be>
+---
+ sqlite3.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sqlite3.c b/sqlite3.c
+index 80433f6..8a43734 100644
+--- a/sqlite3.c 2025-09-03 13:04:29.799853238 +0200
++++ b/sqlite3.c 2025-09-03 13:47:54.274155427 +0200
+@@ -20,7 +20,7 @@
+ ** The content in this amalgamation comes from Fossil check-in
+ ** d2fe6b05f38d9d7cd78c5d252e99ac59f1ae with changes in files:
+ **
+-**
++**
+ */
+ #ifndef SQLITE_AMALGAMATION
+ #define SQLITE_CORE 1
+@@ -15258,6 +15258,14 @@
+ #define SMALLEST_INT64 (((i64)-1) - LARGEST_INT64)
+
+ /*
++** Macro SMXV(n) return the maximum value that can be held in variable n,
++** assuming n is a signed integer type. UMXV(n) is similar for unsigned
++** integer types.
++*/
++#define SMXV(n) ((((i64)1)<<(sizeof(n)*8-1))-1)
++#define UMXV(n) ((((i64)1)<<(sizeof(n)*8))-1)
++
++/*
+ ** Round up a number to the next larger multiple of 8. This is used
+ ** to force 8-byte alignment on 64-bit architectures.
+ **
+@@ -19046,7 +19054,7 @@
+ ** from source tables rather than from accumulators */
+ u8 useSortingIdx; /* In direct mode, reference the sorting index rather
+ ** than the source table */
+- u16 nSortingColumn; /* Number of columns in the sorting index */
++ u32 nSortingColumn; /* Number of columns in the sorting index */
+ int sortingIdx; /* Cursor number of the sorting index */
+ int sortingIdxPTab; /* Cursor number of pseudo-table */
+ int iFirstReg; /* First register in range for aCol[] and aFunc[] */
+@@ -19055,8 +19063,8 @@
+ Table *pTab; /* Source table */
+ Expr *pCExpr; /* The original expression */
+ int iTable; /* Cursor number of the source table */
+- i16 iColumn; /* Column number within the source table */
+- i16 iSorterColumn; /* Column number in the sorting index */
++ int iColumn; /* Column number within the source table */
++ int iSorterColumn; /* Column number in the sorting index */
+ } *aCol;
+ int nColumn; /* Number of used entries in aCol[] */
+ int nAccumulator; /* Number of columns that show through to the output.
+@@ -116445,7 +116453,9 @@
+ ){
+ struct AggInfo_col *pCol;
+ int k;
++ int mxTerm = pParse->db->aLimit[SQLITE_LIMIT_COLUMN];
+
++ assert( mxTerm <= SMXV(i16) );
+ assert( pAggInfo->iFirstReg==0 );
+ pCol = pAggInfo->aCol;
+ for(k=0; k<pAggInfo->nColumn; k++, pCol++){
+@@ -116463,6 +116473,10 @@
+ assert( pParse->db->mallocFailed );
+ return;
+ }
++ if( k>mxTerm ){
++ sqlite3ErrorMsg(pParse, "more than %d aggregate terms", mxTerm);
++ k = mxTerm;
++ }
+ pCol = &pAggInfo->aCol[k];
+ assert( ExprUseYTab(pExpr) );
+ pCol->pTab = pExpr->y.pTab;
+@@ -116496,6 +116510,7 @@
+ if( pExpr->op==TK_COLUMN ){
+ pExpr->op = TK_AGG_COLUMN;
+ }
++ assert( k <= SMXV(pExpr->iAgg) );
+ pExpr->iAgg = (i16)k;
+ }
+
+@@ -116580,13 +116595,19 @@
+ ** function that is already in the pAggInfo structure
+ */
+ struct AggInfo_func *pItem = pAggInfo->aFunc;
++ int mxTerm = pParse->db->aLimit[SQLITE_LIMIT_COLUMN];
++ assert( mxTerm <= SMXV(i16) );
+ for(i=0; i<pAggInfo->nFunc; i++, pItem++){
+ if( NEVER(pItem->pFExpr==pExpr) ) break;
+ if( sqlite3ExprCompare(0, pItem->pFExpr, pExpr, -1)==0 ){
+ break;
+ }
+ }
+- if( i>=pAggInfo->nFunc ){
++ if( i>mxTerm ){
++ sqlite3ErrorMsg(pParse, "more than %d aggregate terms", mxTerm);
++ i = mxTerm;
++ assert( i<pAggInfo->nFunc );
++ }else if( i>=pAggInfo->nFunc ){
+ /* pExpr is original. Make a new entry in pAggInfo->aFunc[]
+ */
+ u8 enc = ENC(pParse->db);
+@@ -116640,6 +116661,7 @@
+ */
+ assert( !ExprHasProperty(pExpr, EP_TokenOnly|EP_Reduced) );
+ ExprSetVVAProperty(pExpr, EP_NoReduce);
++ assert( i <= SMXV(pExpr->iAgg) );
+ pExpr->iAgg = (i16)i;
+ pExpr->pAggInfo = pAggInfo;
+ return WRC_Prune;
diff --git a/package/sqlite/sqlite.mk b/package/sqlite/sqlite.mk
index 4f4bc9d3af..29ebb0365d 100644
--- a/package/sqlite/sqlite.mk
+++ b/package/sqlite/sqlite.mk
@@ -15,6 +15,8 @@ SQLITE_INSTALL_STAGING = YES
# 0002-Add-a-typecast-to-avoid-32-bit-integer-overflow-in-t.patch
SQLITE_IGNORE_CVES = CVE-2025-29087 CVE-2025-3277
+# 0003-Raise-error-if-too-many-aggregate-terms.patch
+SQLITE_IGNORE_CVES += CVE-2025-6965
ifeq ($(BR2_PACKAGE_SQLITE_STAT4),y)
SQLITE_CFLAGS += -DSQLITE_ENABLE_STAT4
More information about the buildroot
mailing list