Blame SOURCES/sqlite-3.26.0-CVE-2020-13434.patch

4bd5ce
Subject: [PATCH] Limit the "precision" of floating-point to text conversions
4bd5ce
 in the printf() function to 100,000,000.
4bd5ce
4bd5ce
---
4bd5ce
 src/printf.c     | 12 ++++++++++++
4bd5ce
 test/printf.test | 16 +++++++++++++---
4bd5ce
 2 files changed, 25 insertions(+), 3 deletions(-)
4bd5ce
4bd5ce
diff --git a/src/printf.c b/src/printf.c
4bd5ce
index 7bce83f..260bf79 100644
4bd5ce
--- a/src/printf.c
4bd5ce
+++ b/src/printf.c
4bd5ce
@@ -165,6 +165,13 @@ static char *getTextArg(PrintfArguments *p){
4bd5ce
 #endif
4bd5ce
 #define etBUFSIZE SQLITE_PRINT_BUF_SIZE  /* Size of the output buffer */
4bd5ce
 
4bd5ce
+/*
4bd5ce
+** Hard limit on the precision of floating-point conversions.
4bd5ce
+*/
4bd5ce
+#ifndef SQLITE_PRINTF_PRECISION_LIMIT
4bd5ce
+# define SQLITE_FP_PRECISION_LIMIT 100000000
4bd5ce
+#endif
4bd5ce
+
4bd5ce
 /*
4bd5ce
 ** Render a string given by "fmt" into the StrAccum object.
4bd5ce
 */
4bd5ce
@@ -471,6 +478,11 @@ void sqlite3_str_vappendf(
4bd5ce
         length = 0;
4bd5ce
 #else
4bd5ce
         if( precision<0 ) precision = 6;         /* Set default precision */
4bd5ce
+#ifdef SQLITE_FP_PRECISION_LIMIT
4bd5ce
+        if( precision>SQLITE_FP_PRECISION_LIMIT ){
4bd5ce
+          precision = SQLITE_FP_PRECISION_LIMIT;
4bd5ce
+        }
4bd5ce
+#endif
4bd5ce
         if( realvalue<0.0 ){
4bd5ce
           realvalue = -realvalue;
4bd5ce
           prefix = '-';
4bd5ce
diff --git a/test/printf.test b/test/printf.test
4bd5ce
index d768898..a2b5e2a 100644
4bd5ce
--- a/test/printf.test
4bd5ce
+++ b/test/printf.test
4bd5ce
@@ -538,9 +538,11 @@ do_test printf-2.1.2.8 {
4bd5ce
 do_test printf-2.1.2.9 {
4bd5ce
   sqlite3_mprintf_double {abc: %d %d (%1.1g) :xyz} 1 1 1.0e-20
4bd5ce
 } {abc: 1 1 (1e-20) :xyz}
4bd5ce
-do_test printf-2.1.2.10 {
4bd5ce
-  sqlite3_mprintf_double {abc: %*.*f}  2000000000 1000000000 1.0e-20
4bd5ce
-} {abc: }
4bd5ce
+if {$SQLITE_MAX_LENGTH<=[expr 1000*1000*1000]} {
4bd5ce
+  do_test printf-2.1.2.10 {
4bd5ce
+    sqlite3_mprintf_double {abc: %*.*f}  2000000000 1000000000 1.0e-20
4bd5ce
+  } {}
4bd5ce
+}
4bd5ce
 do_test printf-2.1.3.1 {
4bd5ce
   sqlite3_mprintf_double {abc: (%*.*f) :xyz} 1 1 1.0
4bd5ce
 } {abc: (1.0) :xyz}
4bd5ce
@@ -3777,4 +3779,12 @@ foreach ::iRepeat {0 1} {
4bd5ce
   }
4bd5ce
 }
4bd5ce
 
4bd5ce
+# 2020-05-23
4bd5ce
+# ticket 23439ea582241138
4bd5ce
+#
4bd5ce
+do_execsql_test printf-16.1 {
4bd5ce
+  SELECT printf('%.*g',2147483647,0.01);
4bd5ce
+} {0.01}
4bd5ce
+
4bd5ce
+
4bd5ce
 finish_test
4bd5ce
-- 
4bd5ce
2.24.1
4bd5ce