package/sqlite: patch CVE-2025-70873

- CVE-2025-70873:
    An information disclosure issue in the zipfileInflate function in the
    zipfile extension in SQLite v3.51.1 and earlier allows attackers to
    obtain heap memory via supplying a crafted ZIP file.

For more information, see:
  - https://www.cve.org/CVERecord?id=CVE-2025-70873
  - https://sqlite.org/src/info/9766b47beb9ec72f
  - 5a05c59d4d

Signed-off-by: Thomas Perale <thomas.perale@mind.be>

package/sqlite/0002-CVE-2025-70873.patch

@@ -0,0 +1,30 @@
+From 5a05c59d4d75c03f23d5fb70feac9f789954bf8a Mon Sep 17 00:00:00 2001
+From: drh <>
+Date: Sat, 6 Dec 2025 20:41:24 +0000
+Subject: [PATCH] In the zipfile extension, only return as many bytes as
+ Inflate actually generated.  [forum:/forumpost/761eac3c82|Forum post
+ 761eac3c82]. Adjust ./configure so that it builds zipfile into testfixture if
+ ZLIB is available, so that tests get run on unix platforms.
+
+Upstream: https://sqlite.org/src/info/9766b47beb9ec72f
+Upstream: https://github.com/sqlite/sqlite/commit/5a05c59d4d75c03f23d5fb70feac9f789954bf8a
+CVE: CVE-2025-70873
+[thomas: backport to 3.50.4]
+Signed-off-by: Thomas Perale <thomas.perale@mind.be>
+---
+ shell.c |  2 +-
+ 1 files changed, 1 insertions(+), 1 deletions(-)
+
+diff --git a/shell.c b/shell.c
+index de401b89ec..e2640fd874 100644
+--- a/shell.c
++++ b/shell.c
+@@ -11184,7 +11184,7 @@ static void zipfileInflate(
+       if( err!=Z_STREAM_END ){
+         zipfileCtxErrorMsg(pCtx, "inflate() failed (%d)", err);
+       }else{
+-        sqlite3_result_blob(pCtx, aRes, nOut, zipfileFree);
++        sqlite3_result_blob(pCtx, aRes, (int)str.total_out, zipfileFree);
+         aRes = 0;
+       }
+     }

package/sqlite/sqlite.mk

@@ -13,6 +13,9 @@ SQLITE_LICENSE_FILES = tea/license.terms
 SQLITE_CPE_ID_VENDOR = sqlite
 SQLITE_INSTALL_STAGING = YES
 
+# 0002-CVE-2025-70873.patch
+SQLITE_IGNORE_CVES += CVE-2025-70873
+
 ifeq ($(BR2_PACKAGE_SQLITE_STAT4),y)
 SQLITE_CFLAGS += -DSQLITE_ENABLE_STAT4
 endif