diff -Nru sqlite3-3.8.2/debian/changelog sqlite3-3.8.2/debian/changelog --- sqlite3-3.8.2/debian/changelog 2015-07-15 11:35:34.000000000 +0000 +++ sqlite3-3.8.2/debian/changelog 2019-02-21 16:14:11.000000000 +0000 @@ -1,3 +1,15 @@ +sqlite3 (3.8.2-1ubuntu2.2) trusty-security; urgency=medium + + * SECURITY UPDATE: Avoid segmentation fault while using a corrupted file. + - d/p/0001-Fix-a-parsing-issue-associated-with-a-corrupt-sqlite.patch: + Check if parser is busy before using it and raise an error if positive. + (LP: #1814869) + - d/p/0002-Better-error-message-text-when-the-schema-is-corrupt.patch: + Better message and additional checks. + - No CVE associated. + + -- Paulo Flabiano Smorigo Thu, 21 Feb 2019 17:13:40 +0100 + sqlite3 (3.8.2-1ubuntu2.1) trusty-security; urgency=medium * SECURITY UPDATE: array overrun in the skip-scan optimization diff -Nru sqlite3-3.8.2/debian/patches/0001-Fix-a-parsing-issue-associated-with-a-corrupt-sqlite.patch sqlite3-3.8.2/debian/patches/0001-Fix-a-parsing-issue-associated-with-a-corrupt-sqlite.patch --- sqlite3-3.8.2/debian/patches/0001-Fix-a-parsing-issue-associated-with-a-corrupt-sqlite.patch 1970-01-01 00:00:00.000000000 +0000 +++ sqlite3-3.8.2/debian/patches/0001-Fix-a-parsing-issue-associated-with-a-corrupt-sqlite.patch 2019-02-21 16:14:31.000000000 +0000 @@ -0,0 +1,27 @@ +From: Joe Mistachkin +Date: Fri, 16 Mar 2018 19:10:05 +0000 +Subject: [PATCH] Fix a parsing issue associated with a corrupt sqlite_master + table. + +--- + src/parse.y | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +--- sqlite3-3.8.2.orig/src/parse.y ++++ sqlite3-3.8.2/src/parse.y +@@ -167,8 +167,13 @@ create_table_args ::= LP columnlist cons + sqlite3EndTable(pParse,&X,&E,F,0); + } + create_table_args ::= AS select(S). { +- sqlite3EndTable(pParse,0,0,0,S); +- sqlite3SelectDelete(pParse->db, S); ++ if( pParse->db->init.busy==0 ){ ++ sqlite3EndTable(pParse,0,0,0,S); ++ sqlite3SelectDelete(pParse->db, S); ++ }else{ ++ sqlite3SelectDelete(pParse->db, S); ++ sqlite3ErrorMsg(pParse, "corrupt schema"); ++ } + } + %type table_options {u8} + table_options(A) ::= . {A = 0;} diff -Nru sqlite3-3.8.2/debian/patches/0002-Better-error-message-text-when-the-schema-is-corrupt.patch sqlite3-3.8.2/debian/patches/0002-Better-error-message-text-when-the-schema-is-corrupt.patch --- sqlite3-3.8.2/debian/patches/0002-Better-error-message-text-when-the-schema-is-corrupt.patch 1970-01-01 00:00:00.000000000 +0000 +++ sqlite3-3.8.2/debian/patches/0002-Better-error-message-text-when-the-schema-is-corrupt.patch 2019-02-21 16:14:45.000000000 +0000 @@ -0,0 +1,62 @@ +From: "D. Richard Hipp" +Date: Fri, 16 Mar 2018 20:15:58 +0000 +Subject: [PATCH] Better error message text when the schema is corrupted by a + CREATE TABLE AS entry. + +--- + src/build.c | 6 ++++-- + src/parse.y | 9 ++------- + src/prepare.c | 2 +- + 3 files changed, 7 insertions(+), 10 deletions(-) + +--- sqlite3-3.8.2.orig/src/build.c ++++ sqlite3-3.8.2/src/build.c +@@ -1758,8 +1758,6 @@ void sqlite3EndTable( + p = pParse->pNewTable; + if( p==0 ) return; + +- assert( !db->init.busy || !pSelect ); +- + /* If the db->init.busy is 1 it means we are reading the SQL off the + ** "sqlite_master" or "sqlite_temp_master" table on the disk. + ** So do not write to the disk again. Extract the root page number +@@ -1767,6 +1765,10 @@ void sqlite3EndTable( + ** should have been put there by the sqliteOpenCb routine.) + */ + if( db->init.busy ){ ++ if( pSelect ){ ++ sqlite3ErrorMsg(pParse, ""); ++ return; ++ } + p->tnum = db->init.newTnum; + } + +--- sqlite3-3.8.2.orig/src/parse.y ++++ sqlite3-3.8.2/src/parse.y +@@ -167,13 +167,8 @@ create_table_args ::= LP columnlist cons + sqlite3EndTable(pParse,&X,&E,F,0); + } + create_table_args ::= AS select(S). { +- if( pParse->db->init.busy==0 ){ +- sqlite3EndTable(pParse,0,0,0,S); +- sqlite3SelectDelete(pParse->db, S); +- }else{ +- sqlite3SelectDelete(pParse->db, S); +- sqlite3ErrorMsg(pParse, "corrupt schema"); +- } ++ sqlite3EndTable(pParse,0,0,0,S); ++ sqlite3SelectDelete(pParse->db, S); + } + %type table_options {u8} + table_options(A) ::= . {A = 0;} +--- sqlite3-3.8.2.orig/src/prepare.c ++++ sqlite3-3.8.2/src/prepare.c +@@ -29,7 +29,7 @@ static void corruptSchema( + if( zObj==0 ) zObj = "?"; + sqlite3SetString(pData->pzErrMsg, db, + "malformed database schema (%s)", zObj); +- if( zExtra ){ ++ if( zExtra && zExtra[0] ) { + *pData->pzErrMsg = sqlite3MAppendf(db, *pData->pzErrMsg, + "%s - %s", *pData->pzErrMsg, zExtra); + } diff -Nru sqlite3-3.8.2/debian/patches/series sqlite3-3.8.2/debian/patches/series --- sqlite3-3.8.2/debian/patches/series 2015-07-15 11:35:05.000000000 +0000 +++ sqlite3-3.8.2/debian/patches/series 2019-02-21 16:14:45.000000000 +0000 @@ -9,3 +9,5 @@ CVE-2013-7443.patch CVE-2015-3414.patch CVE-2015-3416.patch +0001-Fix-a-parsing-issue-associated-with-a-corrupt-sqlite.patch +0002-Better-error-message-text-when-the-schema-is-corrupt.patch