[Buildroot] [PATCH 1/1] package/sqlite: add patch for CVE-2025-6965
Thomas Perale
thomas.perale at mind.be
Thu Sep 11 19:24:16 UTC 2025
In reply of:
> This fixes the following vulnerability:
> - CVE-2025-6965:
> There exists a vulnerability in SQLite versions before 3.50.2 where
> the number of aggregate terms could exceed the number of columns
> available. This could lead to a memory corruption issue. We recommend
> upgrading to version 3.50.2 or above.
> https://www.cve.org/CVERecord?id=CVE-2025-6965
>
> Signed-off-by: Titouan Christophe <titouan.christophe at mind.be>
Applied to 2025.02.x & 2025.05.x. Thanks
> ---
> ...se-error-if-too-many-aggregate-terms.patch | 123 ++++++++++++++++++
> package/sqlite/sqlite.mk | 2 +
> 2 files changed, 125 insertions(+)
> create mode 100644 package/sqlite/0003-Raise-error-if-too-many-aggregate-terms.patch
>
> diff --git a/package/sqlite/0003-Raise-error-if-too-many-aggregate-terms.patch b/package/sqlite/0003-Raise-error-if-too-many-aggregate-terms.patch
> new file mode 100644
> index 0000000000..43be545b83
> --- /dev/null
> +++ b/package/sqlite/0003-Raise-error-if-too-many-aggregate-terms.patch
> @@ -0,0 +1,123 @@
> +From 1cbb088f4be95e7a02627f64de60653ef2b13ab5 Mon Sep 17 00:00:00 2001
> +From: drh <>
> +Date: Sun, 16 Feb 2025 10:57:25 +0000
> +Subject: [PATCH] Raise an error right away if the number of aggregate terms in a query exceeds the maximum number of columns.
> +
> +CVE: CVE-2025-6965
> +
> +For more info see https://nvd.nist.gov/vuln/detail/CVE-2025-6965
> +
> +Upstream: https://www.sqlite.org/src/vinfo/5508b56fd24016c13981ec280ecdd833007c9d8dd595edb295b984c2b487b5c8
> +
> +[Titouan: adapt to sqlite3 "amalgamation" source code]
> +Signed-off-by: Titouan Christophe <titouan.christophe at mind.be>
> +---
> + sqlite3.c | 2 +-
> + 1 file changed, 1 insertion(+), 1 deletion(-)
> +
> +diff --git a/sqlite3.c b/sqlite3.c
> +index 80433f6..8a43734 100644
> +--- a/sqlite3.c 2025-09-03 13:04:29.799853238 +0200
> ++++ b/sqlite3.c 2025-09-03 13:47:54.274155427 +0200
> +@@ -20,7 +20,7 @@
> + ** The content in this amalgamation comes from Fossil check-in
> + ** d2fe6b05f38d9d7cd78c5d252e99ac59f1ae with changes in files:
> + **
> +-**
> ++**
> + */
> + #ifndef SQLITE_AMALGAMATION
> + #define SQLITE_CORE 1
> +@@ -15258,6 +15258,14 @@
> + #define SMALLEST_INT64 (((i64)-1) - LARGEST_INT64)
> +
> + /*
> ++** Macro SMXV(n) return the maximum value that can be held in variable n,
> ++** assuming n is a signed integer type. UMXV(n) is similar for unsigned
> ++** integer types.
> ++*/
> ++#define SMXV(n) ((((i64)1)<<(sizeof(n)*8-1))-1)
> ++#define UMXV(n) ((((i64)1)<<(sizeof(n)*8))-1)
> ++
> ++/*
> + ** Round up a number to the next larger multiple of 8. This is used
> + ** to force 8-byte alignment on 64-bit architectures.
> + **
> +@@ -19046,7 +19054,7 @@
> + ** from source tables rather than from accumulators */
> + u8 useSortingIdx; /* In direct mode, reference the sorting index rather
> + ** than the source table */
> +- u16 nSortingColumn; /* Number of columns in the sorting index */
> ++ u32 nSortingColumn; /* Number of columns in the sorting index */
> + int sortingIdx; /* Cursor number of the sorting index */
> + int sortingIdxPTab; /* Cursor number of pseudo-table */
> + int iFirstReg; /* First register in range for aCol[] and aFunc[] */
> +@@ -19055,8 +19063,8 @@
> + Table *pTab; /* Source table */
> + Expr *pCExpr; /* The original expression */
> + int iTable; /* Cursor number of the source table */
> +- i16 iColumn; /* Column number within the source table */
> +- i16 iSorterColumn; /* Column number in the sorting index */
> ++ int iColumn; /* Column number within the source table */
> ++ int iSorterColumn; /* Column number in the sorting index */
> + } *aCol;
> + int nColumn; /* Number of used entries in aCol[] */
> + int nAccumulator; /* Number of columns that show through to the output.
> +@@ -116445,7 +116453,9 @@
> + ){
> + struct AggInfo_col *pCol;
> + int k;
> ++ int mxTerm = pParse->db->aLimit[SQLITE_LIMIT_COLUMN];
> +
> ++ assert( mxTerm <= SMXV(i16) );
> + assert( pAggInfo->iFirstReg==0 );
> + pCol = pAggInfo->aCol;
> + for(k=0; k<pAggInfo->nColumn; k++, pCol++){
> +@@ -116463,6 +116473,10 @@
> + assert( pParse->db->mallocFailed );
> + return;
> + }
> ++ if( k>mxTerm ){
> ++ sqlite3ErrorMsg(pParse, "more than %d aggregate terms", mxTerm);
> ++ k = mxTerm;
> ++ }
> + pCol = &pAggInfo->aCol[k];
> + assert( ExprUseYTab(pExpr) );
> + pCol->pTab = pExpr->y.pTab;
> +@@ -116496,6 +116510,7 @@
> + if( pExpr->op==TK_COLUMN ){
> + pExpr->op = TK_AGG_COLUMN;
> + }
> ++ assert( k <= SMXV(pExpr->iAgg) );
> + pExpr->iAgg = (i16)k;
> + }
> +
> +@@ -116580,13 +116595,19 @@
> + ** function that is already in the pAggInfo structure
> + */
> + struct AggInfo_func *pItem = pAggInfo->aFunc;
> ++ int mxTerm = pParse->db->aLimit[SQLITE_LIMIT_COLUMN];
> ++ assert( mxTerm <= SMXV(i16) );
> + for(i=0; i<pAggInfo->nFunc; i++, pItem++){
> + if( NEVER(pItem->pFExpr==pExpr) ) break;
> + if( sqlite3ExprCompare(0, pItem->pFExpr, pExpr, -1)==0 ){
> + break;
> + }
> + }
> +- if( i>=pAggInfo->nFunc ){
> ++ if( i>mxTerm ){
> ++ sqlite3ErrorMsg(pParse, "more than %d aggregate terms", mxTerm);
> ++ i = mxTerm;
> ++ assert( i<pAggInfo->nFunc );
> ++ }else if( i>=pAggInfo->nFunc ){
> + /* pExpr is original. Make a new entry in pAggInfo->aFunc[]
> + */
> + u8 enc = ENC(pParse->db);
> +@@ -116640,6 +116661,7 @@
> + */
> + assert( !ExprHasProperty(pExpr, EP_TokenOnly|EP_Reduced) );
> + ExprSetVVAProperty(pExpr, EP_NoReduce);
> ++ assert( i <= SMXV(pExpr->iAgg) );
> + pExpr->iAgg = (i16)i;
> + pExpr->pAggInfo = pAggInfo;
> + return WRC_Prune;
> diff --git a/package/sqlite/sqlite.mk b/package/sqlite/sqlite.mk
> index 4f4bc9d3af..29ebb0365d 100644
> --- a/package/sqlite/sqlite.mk
> +++ b/package/sqlite/sqlite.mk
> @@ -15,6 +15,8 @@ SQLITE_INSTALL_STAGING = YES
>
> # 0002-Add-a-typecast-to-avoid-32-bit-integer-overflow-in-t.patch
> SQLITE_IGNORE_CVES = CVE-2025-29087 CVE-2025-3277
> +# 0003-Raise-error-if-too-many-aggregate-terms.patch
> +SQLITE_IGNORE_CVES += CVE-2025-6965
>
> ifeq ($(BR2_PACKAGE_SQLITE_STAT4),y)
> SQLITE_CFLAGS += -DSQLITE_ENABLE_STAT4
> --
> 2.51.0
>
> _______________________________________________
> buildroot mailing list
> buildroot at buildroot.org
> https://lists.buildroot.org/mailman/listinfo/buildroot
More information about the buildroot
mailing list