forked from chromium/chromium
-
Notifications
You must be signed in to change notification settings - Fork 2
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
sqlite: Backport bugfixes for clusterfuzz security bugs
- security bugs were for integer overflow and heap-buffer overflow. Bug: 925656, 932353, 925381 Change-Id: Ibda5a20302153b7ede3a5b89a7bcea622fded869 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1504333 Reviewed-by: Victor Costan <pwnall@chromium.org> Reviewed-by: Chris Mumford <cmumford@google.com> Commit-Queue: Darwin Huang <huangdarwin@chromium.org> Cr-Commit-Position: refs/heads/master@{#638485}
- Loading branch information
Darwin Huang
authored and
Commit Bot
committed
Mar 7, 2019
1 parent
852588a
commit abe5c75
Showing
13 changed files
with
145 additions
and
27 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
28 changes: 28 additions & 0 deletions
28
third_party/sqlite/patches/0008-Fix-Heap-buffer-overflow-in-vdbeRecordCompareInt.patch
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,28 @@ | ||
| From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 | ||
| From: Darwin Huang <huangdarwin@chromium.org> | ||
| Date: Tue, 5 Mar 2019 13:49:51 -0800 | ||
| Subject: [PATCH 08/10] Fix Heap-buffer-overflow in vdbeRecordCompareInt | ||
|
|
||
| This backports https://www.sqlite.org/src/info/c1ac00706bae45fe | ||
|
|
||
| Bug: 932353 | ||
| --- | ||
| third_party/sqlite/src/src/btree.c | 2 +- | ||
| 1 file changed, 1 insertion(+), 1 deletion(-) | ||
|
|
||
| diff --git a/third_party/sqlite/src/src/btree.c b/third_party/sqlite/src/src/btree.c | ||
| index 773be1646914..caa45e507da6 100644 | ||
| --- a/third_party/sqlite/src/src/btree.c | ||
| +++ b/third_party/sqlite/src/src/btree.c | ||
| @@ -5510,7 +5510,7 @@ int sqlite3BtreeMovetoUnpacked( | ||
| sqlite3_free(pCellKey); | ||
| goto moveto_finish; | ||
| } | ||
| - c = xRecordCompare(nCell, pCellKey, pIdxKey); | ||
| + c = sqlite3VdbeRecordCompare(nCell, pCellKey, pIdxKey); | ||
| sqlite3_free(pCellKey); | ||
| } | ||
| assert( | ||
| -- | ||
| 2.21.0.352.gf09ad66450-goog | ||
|
|
36 changes: 36 additions & 0 deletions
36
third_party/sqlite/patches/0009-fix-heap-buffer-overflow-in-cellsizeptr.patch
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,36 @@ | ||
| From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 | ||
| From: Darwin Huang <huangdarwin@chromium.org> | ||
| Date: Tue, 5 Mar 2019 14:13:19 -0800 | ||
| Subject: [PATCH 09/10] fix heap-buffer-overflow in cellsizeptr | ||
|
|
||
| This backports https://www.sqlite.org/src/info/e7aca0714bc475e0 | ||
|
|
||
| Bug: 925656 | ||
| --- | ||
| third_party/sqlite/src/src/pager.c | 10 ++++++++-- | ||
| 1 file changed, 8 insertions(+), 2 deletions(-) | ||
|
|
||
| diff --git a/third_party/sqlite/src/src/pager.c b/third_party/sqlite/src/src/pager.c | ||
| index 35f625d2c03a..efb9155f545d 100644 | ||
| --- a/third_party/sqlite/src/src/pager.c | ||
| +++ b/third_party/sqlite/src/src/pager.c | ||
| @@ -3786,8 +3786,14 @@ int sqlite3PagerSetPagesize(Pager *pPager, u32 *pPageSize, int nReserve){ | ||
| rc = sqlite3OsFileSize(pPager->fd, &nByte); | ||
| } | ||
| if( rc==SQLITE_OK ){ | ||
| - pNew = (char *)sqlite3PageMalloc(pageSize); | ||
| - if( !pNew ) rc = SQLITE_NOMEM_BKPT; | ||
| + /* 8 bytes of zeroed overrun space is sufficient so that the b-tree | ||
| + * cell header parser will never run off the end of the allocation */ | ||
| + pNew = (char *)sqlite3PageMalloc(pageSize+8); | ||
| + if( !pNew ){ | ||
| + rc = SQLITE_NOMEM_BKPT; | ||
| + }else{ | ||
| + memset(pNew+pageSize, 0, 8); | ||
| + } | ||
| } | ||
|
|
||
| if( rc==SQLITE_OK ){ | ||
| -- | ||
| 2.21.0.352.gf09ad66450-goog | ||
|
|
41 changes: 41 additions & 0 deletions
41
third_party/sqlite/patches/0010-fix-integer-overflow-in-checkList.patch
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,41 @@ | ||
| From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 | ||
| From: Darwin Huang <huangdarwin@chromium.org> | ||
| Date: Tue, 5 Mar 2019 14:17:05 -0800 | ||
| Subject: [PATCH 10/10] fix integer overflow in checkList | ||
|
|
||
| This backports https://www.sqlite.org/src/info/05b87e0755638d31 | ||
|
|
||
| Bug: 925381 | ||
| --- | ||
| third_party/sqlite/src/src/btree.c | 6 +++--- | ||
| 1 file changed, 3 insertions(+), 3 deletions(-) | ||
|
|
||
| diff --git a/third_party/sqlite/src/src/btree.c b/third_party/sqlite/src/src/btree.c | ||
| index caa45e507da6..33d63d7b1ce2 100644 | ||
| --- a/third_party/sqlite/src/src/btree.c | ||
| +++ b/third_party/sqlite/src/src/btree.c | ||
| @@ -9540,10 +9540,10 @@ static void checkList( | ||
| IntegrityCk *pCheck, /* Integrity checking context */ | ||
| int isFreeList, /* True for a freelist. False for overflow page list */ | ||
| int iPage, /* Page number for first page in the list */ | ||
| - int N /* Expected number of pages in the list */ | ||
| + u32 N /* Expected number of pages in the list */ | ||
| ){ | ||
| int i; | ||
| - int expected = N; | ||
| + u32 expected = N; | ||
| int nErrAtStart = pCheck->nErr; | ||
| while( iPage!=0 && pCheck->mxErr ){ | ||
| DbPage *pOvflPage; | ||
| @@ -9797,7 +9797,7 @@ static int checkTreePage( | ||
|
|
||
| /* Check the content overflow list */ | ||
| if( info.nPayload>info.nLocal ){ | ||
| - int nPage; /* Number of pages on the overflow chain */ | ||
| + u32 nPage; /* Number of pages on the overflow chain */ | ||
| Pgno pgnoOvfl; /* First page of the overflow chain */ | ||
| assert( pc + info.nSize - 4 <= usableSize ); | ||
| nPage = (info.nPayload - info.nLocal + usableSize - 5)/(usableSize - 4); | ||
| -- | ||
| 2.21.0.352.gf09ad66450-goog | ||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters