From 5dcf5dc697c9962de4d70b094e877e723d858d95 Mon Sep 17 00:00:00 2001
From: CentOS Sources <bugs@centos.org>
Date: Jan 27 2020 07:51:00 +0000
Subject: import sqlite-3.7.17-8.el7_7.1


---

diff --git a/SOURCES/sqlite-3.26.0-CVE-2019-13734.patch b/SOURCES/sqlite-3.26.0-CVE-2019-13734.patch
new file mode 100644
index 0000000..55baf70
--- /dev/null
+++ b/SOURCES/sqlite-3.26.0-CVE-2019-13734.patch
@@ -0,0 +1,103 @@
+From 959187c0035564df5b5a597a3b1ff6c59c49d8e1 Mon Sep 17 00:00:00 2001
+From: Ondrej Dubaj <odubaj@redhat.com>
+Date: Fri, 3 Jan 2020 13:13:18 +0100
+Subject: [PATCH] More improvements to shadow table corruption detection in
+ FTS3.
+
+---
+ ext/fts3/fts3.c       |  4 ++++
+ ext/fts3/fts3Int.h    | 16 ++++++++++++++++
+ ext/fts3/fts3_write.c | 12 ++++++++++--
+ 3 files changed, 30 insertions(+), 2 deletions(-)
+
+diff --git a/ext/fts3/fts3.c b/ext/fts3/fts3.c
+index c00a13f..2a61d10 100644
+--- a/ext/fts3/fts3.c
++++ b/ext/fts3/fts3.c
+@@ -1355,6 +1355,10 @@ static int fts3InitVtab(
+   fts3DatabasePageSize(&rc, p);
+   p->nNodeSize = p->nPgsz-35;
+ 
++#if defined(SQLITE_DEBUG)||defined(SQLITE_TEST)
++  p->nMergeCount = FTS3_MERGE_COUNT;
++#endif
++
+   /* Declare the table schema to SQLite. */
+   fts3DeclareVtab(&rc, p);
+ 
+diff --git a/ext/fts3/fts3Int.h b/ext/fts3/fts3Int.h
+index b19064c..bd0edfe 100644
+--- a/ext/fts3/fts3Int.h
++++ b/ext/fts3/fts3Int.h
+@@ -254,8 +254,24 @@ struct Fts3Table {
+   int inTransaction;     /* True after xBegin but before xCommit/xRollback */
+   int mxSavepoint;       /* Largest valid xSavepoint integer */
+ #endif
++
++#if defined(SQLITE_DEBUG) || defined(SQLITE_TEST)
++  /* True to disable the incremental doclist optimization. This is controled
++  ** by special insert command 'test-no-incr-doclist'.  */
++  int bNoIncrDoclist;
++
++  /* Number of segments in a level */
++  int nMergeCount;
++#endif
+ };
+ 
++/* Macro to find the number of segments to merge */
++#if defined(SQLITE_DEBUG) || defined(SQLITE_TEST)
++# define MergeCount(P) ((P)->nMergeCount)
++#else
++# define MergeCount(P) FTS3_MERGE_COUNT
++#endif
++
+ /*
+ ** When the core wants to read from the virtual table, it creates a
+ ** virtual table cursor (an instance of the following structure) using
+diff --git a/ext/fts3/fts3_write.c b/ext/fts3/fts3_write.c
+index 269d1dd..a557aba 100644
+--- a/ext/fts3/fts3_write.c
++++ b/ext/fts3/fts3_write.c
+@@ -1130,7 +1130,7 @@ static int fts3AllocateSegdirIdx(
+     ** segment and allocate (newly freed) index 0 at level iLevel. Otherwise,
+     ** if iNext is less than FTS3_MERGE_COUNT, allocate index iNext.
+     */
+-    if( iNext>=FTS3_MERGE_COUNT ){
++    if( iNext>=MergeCount(p) ){
+       fts3LogMerge(16, getAbsoluteLevel(p, iLangid, iIndex, iLevel));
+       rc = fts3SegmentMerge(p, iLangid, iIndex, iLevel);
+       *piIdx = 0;
+@@ -4002,6 +4002,10 @@ static int fts3IncrmergeLoad(
+       int i;
+       int nHeight = (int)aRoot[0];
+       NodeWriter *pNode;
++      if( nHeight<1 || nHeight>FTS_MAX_APPENDABLE_HEIGHT ){
++        sqlite3_reset(pSelect);
++        return FTS_CORRUPT_VTAB;
++      }
+ 
+       pWriter->nLeafEst = (int)((iEnd - iStart) + 1)/FTS_MAX_APPENDABLE_HEIGHT;
+       pWriter->iStart = iStart;
+@@ -4728,7 +4732,7 @@ static int fts3DoIncrmerge(
+   const char *zParam              /* Nul-terminated string containing "A,B" */
+ ){
+   int rc;
+-  int nMin = (FTS3_MERGE_COUNT / 2);
++  int nMin = (MergeCount(p) / 2);
+   int nMerge = 0;
+   const char *z = zParam;
+ 
+@@ -5049,6 +5053,10 @@ static int fts3SpecialInsert(Fts3Table *p, sqlite3_value *pVal){
+   }else if( nVal>11 && 0==sqlite3_strnicmp(zVal, "maxpending=", 9) ){
+     p->nMaxPendingData = atoi(&zVal[11]);
+     rc = SQLITE_OK;
++  }else if( nVal>11 && 0==sqlite3_strnicmp(zVal,"mergecount=",11) ){
++    int v = atoi(&zVal[11]);
++    if( v>=4 && v<=FTS3_MERGE_COUNT && (v&1)==0 ) p->nMergeCount = v;
++    rc = SQLITE_OK;
+ #endif
+   }else{
+     rc = SQLITE_ERROR;
+-- 
+2.19.1
+
diff --git a/SPECS/sqlite.spec b/SPECS/sqlite.spec
index 1438029..49ab0a1 100644
--- a/SPECS/sqlite.spec
+++ b/SPECS/sqlite.spec
@@ -10,7 +10,7 @@
 Summary: Library that implements an embeddable SQL database engine
 Name: sqlite
 Version: %{rpmver}
-Release: 8%{?dist}
+Release: 8%{?dist}.1
 License: Public Domain
 Group: Applications/Databases
 URL: http://www.sqlite.org/
@@ -39,6 +39,8 @@ Patch7: sqlite-3.7.17-large-pages.patch
 Patch8:  sqlite-3.7.17-collation-sequence.patch
 Patch9:  sqlite-3.7.17-vdbe-free.patch
 Patch10: sqlite-3.7.14-printf-overflow.patch
+# Fixes for CVE-2019-13734
+Patch11: sqlite-3.26.0-CVE-2019-13734.patch
 
 BuildRequires: ncurses-devel readline-devel glibc-devel
 BuildRequires: autoconf
@@ -118,6 +120,7 @@ This package contains the tcl modules for %{name}.
 %patch8 -p1 -b .collation
 %patch9 -p1 -b .vdbe-free
 %patch10 -p1 -b .printf-overflow
+%patch11 -p1
 
 # Remove cgi-script erroneously included in sqlite-doc-3070500
 rm -f %{name}-doc-%{realver}/search
@@ -208,6 +211,9 @@ rm -rf $RPM_BUILD_ROOT
 %endif
 
 %changelog
+* Thu Jan 02 2020 Ondrej Dubaj <odubaj@redhat.com> 3.7.17-8.1
+- Fixes for CVE-2019-13734 (#1786505)
+
 * Thu Jul 23 2015 Jan Stanek <jstanek@redhat.com> 3.7.17-8
 - Fixes for CVE-2015-3415 CVE-2015-3414 CVE-2015-3416
   Resolves: rhbz#1244732