Arch Linux User Repository

Based on the SQLite release notes for the CVE fix and the linked discussion on the SQLite development forum [2], it seems that CVE-2025-3277 only affects the CONCAT_WS() function. This function was introduced for the first time in SQLite in v3.44.0.

So, perhaps we can conclude that the "sqlite2" package version 2.8.17 is not affected by CVE-2025-3277.

[1] https://sqlite.org/changes.html?ref=cve.news [2] https://sqlite.org/forum/forumpost/52503ac21d [3] https://sqlite.org/releaselog/3_44_0.html

PLEASE look at my comment on 2025-06-27 below b4 doing anything EXCEPT submitting an improvement.

Build fails as of 7/12/2025: /tool/lemon.c

https://bugzilla.redhat.com/show_bug.cgi?id=2359553

SO... I'm not sure this merits further attention ... any ideas anyone ?

PLUS; I'm gonna remove the "out-of-date" flag until the above matter is properly processed upstream.

The build fails after the latest update of GCC from 14 to 15: https://pastebin.com/XM1qKgHH

I suggest taking the necessary patches from other distributions to make things easier, for example from here: https://src.fedoraproject.org/rpms/sqlite2/tree/rawhide

Updated ... many thanks everyone !!

Here is a simple patch to add to the PKGBUILD

diff -ruNb a/Makefile.in b/Makefile.in
--- a/Makefile.in       2005-04-23 17:43:23.000000000 -0500
+++ b/Makefile.in       2025-04-01 04:23:53.353005839 -0500
@@ -269,8 +269,9 @@
 #
 config.h:
        echo '#include <stdio.h>' >temp.c
+       echo '#include <stdlib.h>' >>temp.c
        echo 'int main(){printf(' >>temp.c
-       echo '"#define SQLITE_PTR_SZ %d",sizeof(char*));' >>temp.c
+       echo '"#define SQLITE_PTR_SZ %lu",sizeof(char*));' >>temp.c
        echo 'exit(0);}' >>temp.c
        $(BCC) -o temp temp.c
        ./temp >config.h
diff -ruNb a/main.mk b/main.mk
--- a/main.mk   2005-04-23 17:43:23.000000000 -0500
+++ b/main.mk   2025-04-01 04:23:58.513298767 -0500
@@ -240,8 +240,9 @@
 #
 config.h:
        echo '#include <stdio.h>' >temp.c
+       echo '#include <stdlib.h>' >>temp.c
        echo 'int main(){printf(' >>temp.c
-       echo '"#define SQLITE_PTR_SZ %d",sizeof(char*));' >>temp.c
+       echo '"#define SQLITE_PTR_SZ %lu",sizeof(char*));' >>temp.c
        echo 'exit(0);}' >>temp.c
        $(BCC) -o temp temp.c
        ./temp >config.h
diff -ruNb a/tool/lemon.c b/tool/lemon.c
--- a/tool/lemon.c      2005-04-23 17:43:22.000000000 -0500
+++ b/tool/lemon.c      2025-04-01 04:23:39.421298977 -0500
@@ -11,6 +11,7 @@
 #include <string.h>
 #include <ctype.h>
 #include <stdlib.h>
+#include <unistd.h>

 #ifndef __WIN32__
 #   if defined(_WIN32) || defined(WIN32)

That will take care of the makefile generation of temp.c and it missing header and type mismatch (int, long unsigned). It will also take care of tool/lemon.c missing the #include <unistd.h>. Apply the patch -p1.

To build this from source, do the following:

In sqlite-2.8.17/tool/lemon.c, add the following header to line 14:

and after doing

add to Makefile:272

    echo '#include <stdlib.h>' >>temp.c

then run

and it should compile.

Sorry for the bad formatting. I don't care to make it better.

@not_anonymous It'd be cool if you could make a patch that does this. I don't have the time, as midterms are coming up.

I get an error when trying to build

temp.c:4:1: error: implicit declaration of function ‘exit’ [-Wimplicit-function-declaration]
    4 | exit(0);}
      | ^~~~
temp.c:2:1: note: include ‘<stdlib.h>’ or provide a declaration of ‘exit’
    1 | #include <stdio.h>
  +++ |+#include <stdlib.h>
    2 | int main(){printf(
temp.c:4:1: warning: incompatible implicit declaration of built-in function ‘exit’ [-Wbuiltin-declaration-mismatch]
    4 | exit(0);}
      | ^~~~
temp.c:4:1: note: include ‘<stdlib.h>’ or provide a declaration of ‘exit’
make: *** [Makefile:275: config.h] Error 1
==> ERROR: A failure occurred in build().
    Aborting...

Please consider using the following;

$ sudo grep -i cflag -r /etc/makepkg.conf CFLAGS="-march=x86-64 -mtune=generic -O2 -pipe -fstack-protector-strong" DEBUG_CFLAGS="-g -fvar-tracking-assignments"

TIA

(I compiled successfully 4 days ago....)