blob: 91ac0e0344bf28698a196deffc66d2dd71bcc047 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
|
Running fts5 prefix queries inside a transaction could trigger a heap-based
buffer over-read in fts5HashEntrySort in sqlite3.c, which may lead to an
information leak.
CVE: CVE-2019-9936
Upstream-Status: Backport [https://sqlite.org/src/vpatch?from=45c73deb440496e8&to=b3fa58dd7403dbd4]
Signed-off-by: Ross Burton <ross.burton@intel.com>
[refreshed for Thud]
Affects < 3.27.2
Signed-off-by: Armin Kuster <akuster@mvista.com>
---
sqlite3.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
Index: sqlite-autoconf-3230100/sqlite3.c
===================================================================
--- sqlite-autoconf-3230100.orig/sqlite3.c
+++ sqlite-autoconf-3230100/sqlite3.c
@@ -196437,7 +196437,9 @@ static int fts5HashEntrySort(
for(iSlot=0; iSlot<pHash->nSlot; iSlot++){
Fts5HashEntry *pIter;
for(pIter=pHash->aSlot[iSlot]; pIter; pIter=pIter->pHashNext){
- if( pTerm==0 || 0==memcmp(fts5EntryKey(pIter), pTerm, nTerm) ){
+ if( pTerm==0
+ || (pIter->nKey+1>=nTerm && 0==memcmp(fts5EntryKey(pIter), pTerm, nTerm))
+ ){
Fts5HashEntry *pEntry = pIter;
pEntry->pScanNext = 0;
for(i=0; ap[i]; i++){
|
