How to fix the CVE from integrated upstream sqlite 3.30.1

[WenYuLuo]

Because of the security, the CVE of sqlcipher should be fixed in my software. although Sqlcipher(4.3.0) wasnt publish any CVE, the integrated upstream Sqlite 3.30.1 has introduced fews of it. Could any one tell me how to fix the CVE of integrated upstream Sqlite 3.30.1? or how to acknowlege the security bug had been fixed?
Thanks~~

[sjlombardo]

Hello @WenYuLuo - SQLCipher 4.3.0 is based on SQLite 3.30.1. An future release will likely be based on 3.31.1. If you have an urgent need to update you could patch the source yourself, though we generally do not recommend doing so.

[WenYuLuo]

thanks for reply!
because of the different baseline, i failed to modify the source code according the patch published in sqlite offical web. it appeared some compile error like some macro undeclared. Does any guide for patching ? I would appreciate it if you could provide.

[WenYuLuo]

thanks for reply! @sjlombardo
because of the different baseline, i failed to modify the source code according the patch published in sqlite offical web. it appeared some compile error like some macro undeclared. Does any guide for patching ? I would appreciate it if you could provide.

[sjlombardo]

Hello @WenYuLuo - this thread includes one option for patching / updating, but please note the risks involved:

SQLCipher & SQLite update

Hello @GJRTimmer - In that case, one option would be to take a diff between the current upstream SQLite 3.20.1 source tree and the new SQLite 3.21.0 source tree. Then take the results of that diff and apply it to the SQLCipher 3.4.2 sources, resolve any merge failures, etc. You could then build and run the crypto.test locally to perform some basic validation and do your own testing as needed. For clarity, this is not the approach we use internally, but would probably yield similar results. Again…