diff --git a/0005-Fix-CVE-2020-13631.patch b/0005-Fix-CVE-2020-13631.patch new file mode 100644 index 0000000..781ec6a --- /dev/null +++ b/0005-Fix-CVE-2020-13631.patch @@ -0,0 +1,82 @@ +diff -Naur 1/src/alter.c 2/src/alter.c +--- 1/src/alter.c 2020-06-02 16:02:38.294309518 -0400 ++++ 2/src/alter.c 2020-06-02 16:05:27.248309518 -0400 +@@ -123,7 +123,10 @@ + /* Check that a table or index named 'zName' does not already exist + ** in database iDb. If so, this is an error. + */ +- if( sqlite3FindTable(db, zName, zDb) || sqlite3FindIndex(db, zName, zDb) ){ ++ if( sqlite3FindTable(db, zName, zDb) ++ || sqlite3FindIndex(db, zName, zDb) ++ || sqlite3IsShadowTableOf(db, pTab, zName) ++ ){ + sqlite3ErrorMsg(pParse, + "there is already another table or index with this name: %s", zName); + goto exit_rename_table; +diff -Naur 1/src/build.c 2/src/build.c +--- 1/src/build.c 2020-06-02 16:02:38.325309518 -0400 ++++ 2/src/build.c 2020-06-02 16:11:12.023309518 -0400 +@@ -2129,6 +2129,28 @@ + recomputeColumnsNotIndexed(pPk); + } + ++ ++#ifndef SQLITE_OMIT_VIRTUALTABLE ++/* ++ * ** Return true if pTab is a virtual table and zName is a shadow table name ++ * ** for that virtual table. ++ * */ ++int sqlite3IsShadowTableOf(sqlite3 *db, Table *pTab, const char *zName){ ++ int nName; /* Length of zName */ ++ Module *pMod; /* Module for the virtual table */ ++ ++ if( !IsVirtual(pTab) ) return 0; ++ nName = sqlite3Strlen30(pTab->zName); ++ if( sqlite3_strnicmp(zName, pTab->zName, nName)!=0 ) return 0; ++ if( zName[nName]!='_' ) return 0; ++ pMod = (Module*)sqlite3HashFind(&db->aModule, pTab->azModuleArg[0]); ++ if( pMod==0 ) return 0; ++ if( pMod->pModule->iVersion<3 ) return 0; ++ if( pMod->pModule->xShadowName==0 ) return 0; ++ return pMod->pModule->xShadowName(zName+nName+1); ++} ++#endif /* ifndef SQLITE_OMIT_VIRTUALTABLE */ ++ + #ifndef SQLITE_OMIT_VIRTUALTABLE + /* + ** Return true if zName is a shadow table name in the current database +@@ -2140,7 +2162,6 @@ + int sqlite3ShadowTableName(sqlite3 *db, const char *zName){ + char *zTail; /* Pointer to the last "_" in zName */ + Table *pTab; /* Table that zName is a shadow of */ +- Module *pMod; /* Module for the virtual table */ + + zTail = strrchr(zName, '_'); + if( zTail==0 ) return 0; +@@ -2149,11 +2170,7 @@ + *zTail = '_'; + if( pTab==0 ) return 0; + if( !IsVirtual(pTab) ) return 0; +- pMod = (Module*)sqlite3HashFind(&db->aModule, pTab->azModuleArg[0]); +- if( pMod==0 ) return 0; +- if( pMod->pModule->iVersion<3 ) return 0; +- if( pMod->pModule->xShadowName==0 ) return 0; +- return pMod->pModule->xShadowName(zTail+1); ++ return sqlite3IsShadowTableOf(db, pTab, zName); + } + #endif /* ifndef SQLITE_OMIT_VIRTUALTABLE */ + +diff -Naur 1/src/sqliteInt.h 2/src/sqliteInt.h +--- 1/src/sqliteInt.h 2020-06-02 16:02:38.291309518 -0400 ++++ 2/src/sqliteInt.h 2020-06-02 16:14:49.356309518 -0400 +@@ -4673,8 +4673,10 @@ + int sqlite3ReadOnlyShadowTables(sqlite3 *db); + #ifndef SQLITE_OMIT_VIRTUALTABLE + int sqlite3ShadowTableName(sqlite3 *db, const char *zName); ++ int sqlite3IsShadowTableOf(sqlite3*,Table*,const char*); + #else + # define sqlite3ShadowTableName(A,B) 0 ++# define sqlite3IsShadowTableOf(A,B,C) 0 + #endif + int sqlite3VtabEponymousTableInit(Parse*,Module*); + void sqlite3VtabEponymousTableClear(sqlite3*,Module*);