1234698 - Upgrade NSS's SQLite to 3.10.2

Status: RESOLVED FIXED

(NSS :: Libraries, defect)

Description

[Jed Davis [:jld] (away until 12-29)]

The SQLite version currently in NSS, 3.7.15, has at least one bug that Address Sanitizer considers a buffer overrun.

(I don't think this needs to be a security bug.  In practice it's harmless enough that SQLite's impressive test coverage didn't catch it, although if any of the uses involve heap memory and an attacker can manipulate heap layout then it might be possible to cause a non-exploitable crash via reading unmapped memory.  But it's also been public since March 2013.)

This was fixed in 3.7.16, but I assume we'd want to upgrade to the latest stable SQLite.

Further reading:
* https://crbug.com/178677 — original discovery
* https://www.sqlite.org/src/info/d73435587b — upstream fix
* http://trust-in-soft.com/memcmp-requires-pointers-to-fully-valid-buffers/ — a coincidentally timely discussion of this kind of bug and what it's capable of

Comment 1

[Franziskus Kiefer [:franziskus]]

Bug 1176293 Comment 3 should give a workaround. But we probably should simply update the sqlite version.

Comment 2

[Jed Davis [:jld] (away until 12-29)]

Attachment: WIP: SQlite 3.7.16 copied from Gecko

Work in progress: I copied Gecko's version of sqlite.[ch] from directly after its update to 3.7.16 and reapplied NSS's change to make warnings-as-errors builds work; this is probably not the right way to do this, but it gets ASan test runs to pass.

Comment 3

[NVD]

https://bugzilla.mozilla.org/show_bug.cgi?id=1237324

Would it be possible to update to SQLite 3.10.0(latest stable upstream release)?

Comment 4

[Jed Davis [:jld] (away until 12-29)]

(In reply to NVD from comment #3)
> https://bugzilla.mozilla.org/show_bug.cgi?id=1237324
> 
> Would it be possible to update to SQLite 3.10.0(latest stable upstream
> release)?

It should be.  I just need to do the import and test it (and figure out who rubber-stamps that kind of thing for NSS).

Comment 5

[Jed Davis [:jld] (away until 12-29)]

Also… if I export the commit as a patch, it's 11 MiB uncompressed.  I can get it down to 1.5 MiB with xz, but I'm not sure how useful that is.  It's just copying the sqlite3.[hc] files from the sqlite-amalgamation-3100100.zip over the ones in lib/sqlite; I didn't need to do anything else to make them build and pass the DB tests.

Comment 6

[Jed Davis [:jld] (away until 12-29)]

Attachment: Hg bundle to upgrade NSS to SQLite 3.10.2

Comment 7

[Jed Davis [:jld] (away until 12-29)]

ekr, any ideas on how to get this landed?

Comment 8

[Eric Rescorla (:ekr)]

Kai should be your man here.

Comment 9

[Eric Rescorla (:ekr)]

This shouldn't be blocking ASanization. Just have the Makefiles compile SQLite w/o ASan

Comment 10

[Jed Davis [:jld] (away until 12-29)]

If I'm going to make NSS-local changes to work around this, I'd rather just apply the minimal patch that makes SQLite stop misusing memcmp().  But updating SQLite shouldn't be that hard....

Comment 11

[Jed Davis [:jld] (away until 12-29)]

Kai, any ideas on how to get this landed?  (The attached Hg bundle doesn't need to be used, if copying the sqlite3.[hc] files directly from https://sqlite.org/2016/sqlite-amalgamation-3100200.zip would be easier.)

Comment 12

[Steve Workman [:sworkman] (INACTIVE)]

(In reply to Jed Davis [:jld] from comment #10)
> If I'm going to make NSS-local changes to work around this, I'd rather just
> apply the minimal patch that makes SQLite stop misusing memcmp().  But
> updating SQLite shouldn't be that hard....

It might not be hard, but it is a bigger change than just the minimal one. Could we do the minimal change now to unblock ASan builds, and then file a follow-up (if needed) to undo it as part of updating SQLite later?

Comment 13

[Kai Engert [:KaiE:]]

I've asked for objections.

If nobody raises objections, I could land it wednesday next week.

(keeping needinfo to help me tracking it)

Comment 14

[Kai Engert [:KaiE:]]

ok, landed already, as there was support for landing without waiting.

https://hg.mozilla.org/projects/nss/rev/49370f8de30a

Comment 15

[Kai Engert [:KaiE:]]

I've tagged NSS_3_23_BETA3 which includes this change.
I've started a try run at
  https://treeherder.mozilla.org/#/jobs?repo=try&revision=ed41f198c6f8
If it works, we can land that into mozilla-inbound as part of bug 1245053.

Comment 16

[Kai Engert [:KaiE:]]

There was an issue with the previously mentioned NSS snapshot.
Newer try run of NSS revision ccaddca3b86b running at
https://treeherder.mozilla.org/#/jobs?repo=try&revision=dbe020fb98f8

Comment 17

[Kai Engert [:KaiE:]]

FYI, successfully landed as part of NSS_3_23_BETA4 a few days ago.