From afe2adcc97e8b5ff1c92d10e1e8664d24abbb366 Mon Sep 17 00:00:00 2001
From: Robert Scott <code@humanleg.org.uk>
Date: Tue, 13 Dec 2022 20:48:02 +0000
Subject: [PATCH] sqlite: add patch for CVE-2022-46908

(cherry picked from commit a7a2489afd1a5d30a33d5673bcc46d700b224f32)
---
 .../3.39.4-autoconf-CVE-2022-46908.patch      | 25 +++++++++++++++++++
 pkgs/development/libraries/sqlite/default.nix |  5 +++-
 2 files changed, 29 insertions(+), 1 deletion(-)
 create mode 100644 pkgs/development/libraries/sqlite/3.39.4-autoconf-CVE-2022-46908.patch

diff --git a/pkgs/development/libraries/sqlite/3.39.4-autoconf-CVE-2022-46908.patch b/pkgs/development/libraries/sqlite/3.39.4-autoconf-CVE-2022-46908.patch
new file mode 100644
index 000000000000..27ab2af2014a
--- /dev/null
+++ b/pkgs/development/libraries/sqlite/3.39.4-autoconf-CVE-2022-46908.patch
@@ -0,0 +1,25 @@
+adapted for preprocessed source files from upstream
+https://sqlite.org/src/vpatch?from=a60e56627fc0ef88&to=cefc032473ac5ad2
+
+diff --git a/shell.c b/shell.c
+index e66ae08..d423278 100644
+--- a/shell.c
++++ b/shell.c
+@@ -12921,7 +12921,7 @@ static int safeModeAuth(
+     "zipfile",
+     "zipfile_cds",
+   };
+-  UNUSED_PARAMETER(zA2);
++  UNUSED_PARAMETER(zA1);
+   UNUSED_PARAMETER(zA3);
+   UNUSED_PARAMETER(zA4);
+   switch( op ){
+@@ -12936,7 +12936,7 @@ static int safeModeAuth(
+     case SQLITE_FUNCTION: {
+       int i;
+       for(i=0; i<ArraySize(azProhibitedFunctions); i++){
+-        if( sqlite3_stricmp(zA1, azProhibitedFunctions[i])==0 ){
++        if( sqlite3_stricmp(zA2, azProhibitedFunctions[i])==0 ){
+           failIfSafeMode(p, "cannot use the %s() function in safe mode",
+                          azProhibitedFunctions[i]);
+         }
diff --git a/pkgs/development/libraries/sqlite/default.nix b/pkgs/development/libraries/sqlite/default.nix
index 70b8c777e978..36753e419a8a 100644
--- a/pkgs/development/libraries/sqlite/default.nix
+++ b/pkgs/development/libraries/sqlite/default.nix
@@ -21,7 +21,10 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-WvB96YK6ZY/ZGgMXDJRfmclx9pVbx53zJmVENz45hpw=";
   };
 
-  patches = [ ./CVE-2022-35737.patch ];
+  patches = [
+    ./CVE-2022-35737.patch
+    ./3.39.4-autoconf-CVE-2022-46908.patch
+  ];
 
   outputs = [ "bin" "dev" "out" ];
   separateDebugInfo = stdenv.isLinux;