As per https://groups.google.com/g/sqlite-dev/c/U7OjAbZO6LA this issue
is believed to be either iOS specific, or fixed in 3.8.9.
(From OE-Core rev: b781058267bd86bd979c50f4dfe8168c58dfa5a9)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
CVE-2020-11655.patch
CVE-2020-11656.patch
CVE-2020-9327.patch
removed since they are included in 3.32.1
(From OE-Core rev: 7ee8501146ceccdbd07104903694a435b75c0606)
Signed-off-by: Wang Mingyu <wangmy@cn.fujitsu.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Unless SQLITE_BYTEORDER is predefined, the code falls back to build
time huristics - which are not always correct (e.g. in sqlite 3.28.0
big-endian ARM is mis-detected).
(From OE-Core rev: c0fc43c228acd44499d9a1c257ec5e4cf42ed050)
Signed-off-by: Andre McCurdy <armccurdy@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The previous simplification:
https://git.openembedded.org/openembedded-core/commit/?id=604777acfc54d285f315b622bd147ed02d55d6fd
looked OK but didn't actually work as expected. The native and
nativesdk classes re-set CFLAGS after the += has been applied and
so any modifications made via += are lost. Use _append instead.
(From OE-Core rev: b02d83f7ffc72b96799a7964a90709eef02aa29d)
Signed-off-by: Andre McCurdy <armccurdy@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
sqlite3-native in particular was finding zlib from the host if zlib-devel
was installed. This could lead to races where pseudo-native may or may not
fail to build.
We don't need/use compressed page support with sqlite so disable the dependency
(it doesn't have a configure option so use a autoconf cache variable).
The target binaries were not previously building with zlib, so we will
leave the default being zlib turned off, while the host binaries were
building with it "occasionally", but not for anything at runtime.
(From OE-Core rev: 0af2c6af0d5c060666f7ee6f2ef428c1a414cb86)
Signed-off-by: Jason Wessel <jason.wessel@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Update SQLite3 from 3.25.2 to 3.25.3 to fix following issues:
* Disallow the use of window functions in the recursive part of a CTE.
* Fix the behavior of typeof() and length() on virtual tables.
* Strengthen defenses against deliberately corrupted database files.
* Fix a problem in the query planner that results when a row-value
expression is used with a PRIMARY KEY with redundant columns.
* Fix the query planner so that it works correctly for IS NOT NULL
operators in the ON clause of a LEFT JOIN with the
SQLITE_ENABLE_STAT4 compile-time option.
Also introduce PACKAGECONFIG tunables to enable/disable e.g. index
and search functions to allow shrinking the library for very small
targets.
(From OE-Core rev: d533ad9b93383a8d721b72b4030b112a3799d559)
Signed-off-by: Jens Rehsack <sno@netbsd.org>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Update SQLite3 from 3.23.1 to 3.25.2 for UPSERT, window
functions and improved ALTER TABLE support.
For a detailed list of changes since 3.23.1, see
* https://www.sqlite.org/releaselog/3_25_2.html
* https://www.sqlite.org/releaselog/3_24_0.html
(From OE-Core rev: eea7b16e762ab971d2ccea728e0019304325aed7)
Signed-off-by: Jens Rehsack <sno@netbsd.org>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
An earlier version of a change was merged from S. Lockwood-Childs
<sjl@vctlabs.com> which made the CFLAGS consistent across native,
nativesdk and target cases. This syncs with a later verison of the
patch to remove duplicate CFLAGS settings and simplify the recipe.
(From OE-Core rev: 604777acfc54d285f315b622bd147ed02d55d6fd)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Enable use of pread() and enable column metadata API for nativesdk builds.
This brings nativesdk in line with target and native builds.
(From OE-Core rev: 7c8b85e1c3d852975cd5961a297aa939bf4c7fe7)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(From OE-Core rev: 6a90852e7e8fd6d17308d78966e700f17f567898)
Signed-off-by: Marko Peter <peter.marko@siemens.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
3.22.0 -> 3.23.0
Includes optimizations and fixes for issues detected by OSSFuzz
(From OE-Core rev: b478af4cd9c1cb0cab35b0160f7df3f31ca7358b)
Signed-off-by: Maxin B. John <maxin.john@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Update SRC_URI for releases in 2018.
(From OE-Core rev: fff2409587e8a253c1f79a3d3c78907440402188)
Signed-off-by: Maxin B. John <maxin.john@intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The dump_callback function in SQLite 3.20.0 allows remote attackers to
cause a denial of service (EXC_BAD_ACCESS and application crash) via a
crafted file.
Backport patch to fix the issue. Some references:
https://sqlite.org/src/info/02f0f4c54f2819b3http://www.mail-archive.com/sqlite-users%40mailinglists.sqlite.org/msg105314.html
(From OE-Core rev: 9b9f566d2042f2b393de88506d2da964bc4d17b0)
Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* Uprev from 3.19.3 to 3.2.0 for fixing CVE-2017-10989:
The getNodeSize function in ext/rtree/rtree.c in SQLite through 3.19.3,
as used in GDAL and other products, mishandles undersized RTree blobs
in a crafted database, leading to a heap-based buffer over-read or
possibly unspecified other impact.
https://nvd.nist.gov/vuln/detail/CVE-2017-10989
* LIC_FILES_CHKSUM updated for below changes:
-** 2001 September 15
+** 2001-09-15
(From OE-Core rev: 95b802bfe74ac6a3f6dc05edb52c87ef90600f40)
Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
It is used in NVD for CVE's like:
https://nvd.nist.gov/vuln/detail/CVE-2016-6153
(From OE-Core rev: cec6f26f4d2f16c9a58fac5a6344e3d43b36ed09)
Signed-off-by: Mikko Rapeli <mikko.rapeli@bmw.de>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
3.19.2 -> 3.19.3
Fixes a bug associated with auto_vacuum that can lead to database
corruption.
(From OE-Core rev: 2635067901c932888a998ea0fbb45f5d4d3c7c24)
Signed-off-by: Maxin B. John <maxin.john@intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Bug fixes:
1. Fix a problem in REPLACE that can result in a corrupt database
containing two or more rows with the same rowid.
2. Fix a problem in PRAGMA integrity_check that was causing a subsequent
VACUUM to behave suboptimally.
3. Fix the PRAGMA foreign_key_check command so that it works correctly with
foreign keys on WITHOUT ROWID tables.
4. Disallow leading zeros in numeric constants in JSON.
5. Disallow control characters inside of strings in JSON.
6. Limit the depth of recursion for JSON objects and arrays in order to
avoid excess stack usage in the recursive descent parser.
7. Fix more bugs in the LEFT JOIN flattening optimization.
(From OE-Core rev: 3d4d025b1cc6668fd7baefa01ebb9664e805e83a)
Signed-off-by: Maxin B. John <maxin.john@intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(From OE-Core rev: 6949d865d3559fa37ff25de4b97c4460b42e0e9c)
Signed-off-by: Maxin B. John <maxin.john@intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
3.16.2 -> 3.17.0
* Approximately 25% better performance from the R-Tree extension.
* Other performance improvements. Uses about 6.5% fewer CPU cycles.
(From OE-Core rev: 2ecc3dc9cb11feb6804ec08d1b7b1470f01aadbe)
Signed-off-by: Maxin B. John <maxin.john@intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
3.15.2 -> 3.16.2
1. Updated the SRC_URI for releases in 2017
2. Removed the following revert patch as the fix is present in this release:
a) 0001-revert-ad601c7962-that-brings-2-increase-of-build-ti.patch
[YOCTO #10695]
(From OE-Core rev: 05317fe9f11565d40b84ad71300b39c990a53f6d)
Signed-off-by: Maxin B. John <maxin.john@intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(From OE-Core rev: 12b5e9943da5eece2641665cd091ef709c30214e)
Signed-off-by: Maxin B. John <maxin.john@intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
getVar() now defaults to expanding by default, thus remove the True
option from getVar() calls with a regex search and replace.
Search made with the following regex: getVar ?\(( ?[^,()]*), True\)
(From OE-Core rev: 7c552996597faaee2fbee185b250c0ee30ea3b5f)
Signed-off-by: Joshua Lock <joshua.g.lock@intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
pseudo links against this and uses PIC, so some toolchain combinations will
refuse to link against sqlite unless it is also PIC.
(From OE-Core rev: 6a58e12d19c539deac9e90679a68438497a42fa4)
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
It turns out this change between 3.12.2 and 3.13 introduces
a 2% increase of build time based on statistic data in
bz10367.
The added patch is forged by diffing the new sqlite3.c
generated from reverting the change in raw source of sqlite3
project, and then manually migrate the delta to a sqlite3.c
from the 3.14.1 tarball package because what recipes reference
is actually a generated C code (amalgamation) release package
and we cannot apply the real change to 3.14.1 cleanly due to
so many changes happened.
Fixes [YOCTO #10367]
(From OE-Core rev: dda0c80019b181a5e323a82d346f86c6fffb6756)
Signed-off-by: Jianxun Zhang <jianxun.zhang@linux.intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(From OE-Core rev: 6858df73073d32f6301b2302ae563670e32db134)
Signed-off-by: Maxin B. John <maxin.john@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
3.13.0 -> 3.14.0
(From OE-Core rev: 1d42b95d1575c909b8cd5493ee9535d7a776b07c)
Signed-off-by: Maxin B. John <maxin.john@intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
