[Buildroot] [PATCH 1/1] package/sqlite: add patch for CVE-2025-6965

Thomas Perale thomas.perale at mind.be
Thu Sep 11 19:24:16 UTC 2025


In reply of:
> This fixes the following vulnerability:
> - CVE-2025-6965:
>     There exists a vulnerability in SQLite versions before 3.50.2 where
>     the number of aggregate terms could exceed the number of columns
>     available. This could lead to a memory corruption issue. We recommend
>     upgrading to version 3.50.2 or above.
>     https://www.cve.org/CVERecord?id=CVE-2025-6965
> 
> Signed-off-by: Titouan Christophe <titouan.christophe at mind.be>

Applied to 2025.02.x & 2025.05.x. Thanks

> ---
>  ...se-error-if-too-many-aggregate-terms.patch | 123 ++++++++++++++++++
>  package/sqlite/sqlite.mk                      |   2 +
>  2 files changed, 125 insertions(+)
>  create mode 100644 package/sqlite/0003-Raise-error-if-too-many-aggregate-terms.patch
> 
> diff --git a/package/sqlite/0003-Raise-error-if-too-many-aggregate-terms.patch b/package/sqlite/0003-Raise-error-if-too-many-aggregate-terms.patch
> new file mode 100644
> index 0000000000..43be545b83
> --- /dev/null
> +++ b/package/sqlite/0003-Raise-error-if-too-many-aggregate-terms.patch
> @@ -0,0 +1,123 @@
> +From 1cbb088f4be95e7a02627f64de60653ef2b13ab5 Mon Sep 17 00:00:00 2001
> +From: drh <>
> +Date: Sun, 16 Feb 2025 10:57:25 +0000
> +Subject: [PATCH] Raise an error right away if the number of aggregate terms in a query exceeds the maximum number of columns. 
> +
> +CVE: CVE-2025-6965
> +
> +For more info see https://nvd.nist.gov/vuln/detail/CVE-2025-6965
> +
> +Upstream: https://www.sqlite.org/src/vinfo/5508b56fd24016c13981ec280ecdd833007c9d8dd595edb295b984c2b487b5c8
> +
> +[Titouan: adapt to sqlite3 "amalgamation" source code]
> +Signed-off-by: Titouan Christophe <titouan.christophe at mind.be>
> +---
> + sqlite3.c | 2 +-
> + 1 file changed, 1 insertion(+), 1 deletion(-)
> +
> +diff --git a/sqlite3.c b/sqlite3.c
> +index 80433f6..8a43734 100644
> +--- a/sqlite3.c	2025-09-03 13:04:29.799853238 +0200
> ++++ b/sqlite3.c	2025-09-03 13:47:54.274155427 +0200
> +@@ -20,7 +20,7 @@
> + ** The content in this amalgamation comes from Fossil check-in
> + ** d2fe6b05f38d9d7cd78c5d252e99ac59f1ae with changes in files:
> + **
> +-**    
> ++**
> + */
> + #ifndef SQLITE_AMALGAMATION
> + #define SQLITE_CORE 1
> +@@ -15258,6 +15258,14 @@
> + #define SMALLEST_INT64 (((i64)-1) - LARGEST_INT64)
> + 
> + /*
> ++** Macro SMXV(n) return the maximum value that can be held in variable n,
> ++** assuming n is a signed integer type.  UMXV(n) is similar for unsigned
> ++** integer types.
> ++*/
> ++#define SMXV(n) ((((i64)1)<<(sizeof(n)*8-1))-1)
> ++#define UMXV(n) ((((i64)1)<<(sizeof(n)*8))-1)
> ++
> ++/*
> + ** Round up a number to the next larger multiple of 8.  This is used
> + ** to force 8-byte alignment on 64-bit architectures.
> + **
> +@@ -19046,7 +19054,7 @@
> +                           ** from source tables rather than from accumulators */
> +   u8 useSortingIdx;       /* In direct mode, reference the sorting index rather
> +                           ** than the source table */
> +-  u16 nSortingColumn;     /* Number of columns in the sorting index */
> ++  u32 nSortingColumn;     /* Number of columns in the sorting index */
> +   int sortingIdx;         /* Cursor number of the sorting index */
> +   int sortingIdxPTab;     /* Cursor number of pseudo-table */
> +   int iFirstReg;          /* First register in range for aCol[] and aFunc[] */
> +@@ -19055,8 +19063,8 @@
> +     Table *pTab;             /* Source table */
> +     Expr *pCExpr;            /* The original expression */
> +     int iTable;              /* Cursor number of the source table */
> +-    i16 iColumn;             /* Column number within the source table */
> +-    i16 iSorterColumn;       /* Column number in the sorting index */
> ++    int iColumn;             /* Column number within the source table */
> ++    int iSorterColumn;       /* Column number in the sorting index */
> +   } *aCol;
> +   int nColumn;            /* Number of used entries in aCol[] */
> +   int nAccumulator;       /* Number of columns that show through to the output.
> +@@ -116445,7 +116453,9 @@
> + ){
> +   struct AggInfo_col *pCol;
> +   int k;
> ++  int mxTerm = pParse->db->aLimit[SQLITE_LIMIT_COLUMN];
> + 
> ++  assert( mxTerm <= SMXV(i16) );
> +   assert( pAggInfo->iFirstReg==0 );
> +   pCol = pAggInfo->aCol;
> +   for(k=0; k<pAggInfo->nColumn; k++, pCol++){
> +@@ -116463,6 +116473,10 @@
> +     assert( pParse->db->mallocFailed );
> +     return;
> +   }
> ++  if( k>mxTerm ){
> ++    sqlite3ErrorMsg(pParse, "more than %d aggregate terms", mxTerm);
> ++    k = mxTerm;
> ++  }
> +   pCol = &pAggInfo->aCol[k];
> +   assert( ExprUseYTab(pExpr) );
> +   pCol->pTab = pExpr->y.pTab;
> +@@ -116496,6 +116510,7 @@
> +   if( pExpr->op==TK_COLUMN ){
> +     pExpr->op = TK_AGG_COLUMN;
> +   }
> ++  assert( k <= SMXV(pExpr->iAgg) );
> +   pExpr->iAgg = (i16)k;
> + }
> + 
> +@@ -116580,13 +116595,19 @@
> +         ** function that is already in the pAggInfo structure
> +         */
> +         struct AggInfo_func *pItem = pAggInfo->aFunc;
> ++        int mxTerm = pParse->db->aLimit[SQLITE_LIMIT_COLUMN];
> ++        assert( mxTerm <= SMXV(i16) );
> +         for(i=0; i<pAggInfo->nFunc; i++, pItem++){
> +           if( NEVER(pItem->pFExpr==pExpr) ) break;
> +           if( sqlite3ExprCompare(0, pItem->pFExpr, pExpr, -1)==0 ){
> +             break;
> +           }
> +         }
> +-        if( i>=pAggInfo->nFunc ){
> ++        if( i>mxTerm ){
> ++          sqlite3ErrorMsg(pParse, "more than %d aggregate terms", mxTerm);
> ++          i = mxTerm;
> ++          assert( i<pAggInfo->nFunc );
> ++        }else if( i>=pAggInfo->nFunc ){
> +           /* pExpr is original.  Make a new entry in pAggInfo->aFunc[]
> +           */
> +           u8 enc = ENC(pParse->db);
> +@@ -116640,6 +116661,7 @@
> +         */
> +         assert( !ExprHasProperty(pExpr, EP_TokenOnly|EP_Reduced) );
> +         ExprSetVVAProperty(pExpr, EP_NoReduce);
> ++        assert( i <= SMXV(pExpr->iAgg) );
> +         pExpr->iAgg = (i16)i;
> +         pExpr->pAggInfo = pAggInfo;
> +         return WRC_Prune;
> diff --git a/package/sqlite/sqlite.mk b/package/sqlite/sqlite.mk
> index 4f4bc9d3af..29ebb0365d 100644
> --- a/package/sqlite/sqlite.mk
> +++ b/package/sqlite/sqlite.mk
> @@ -15,6 +15,8 @@ SQLITE_INSTALL_STAGING = YES
>  
>  # 0002-Add-a-typecast-to-avoid-32-bit-integer-overflow-in-t.patch
>  SQLITE_IGNORE_CVES = CVE-2025-29087 CVE-2025-3277
> +# 0003-Raise-error-if-too-many-aggregate-terms.patch
> +SQLITE_IGNORE_CVES += CVE-2025-6965
>  
>  ifeq ($(BR2_PACKAGE_SQLITE_STAT4),y)
>  SQLITE_CFLAGS += -DSQLITE_ENABLE_STAT4
> -- 
> 2.51.0
> 
> _______________________________________________
> buildroot mailing list
> buildroot at buildroot.org
> https://lists.buildroot.org/mailman/listinfo/buildroot


More information about the buildroot mailing list