Version in base suite: 5.0.0+ds1-1

Base version: node-sqlite3_5.0.0+ds1-1
Target version: node-sqlite3_5.0.0+ds1-1+deb11u1
Base file: /srv/ftp-master.debian.org/ftp/pool/main/n/node-sqlite3/node-sqlite3_5.0.0+ds1-1.dsc
Target file: /srv/ftp-master.debian.org/policy/pool/main/n/node-sqlite3/node-sqlite3_5.0.0+ds1-1+deb11u1.dsc

 changelog                    |    7 +++++++
 patches/CVE-2022-21227.patch |   41 +++++++++++++++++++++++++++++++++++++++++
 patches/series               |    1 +
 3 files changed, 49 insertions(+)

diff -Nru node-sqlite3-5.0.0+ds1/debian/changelog node-sqlite3-5.0.0+ds1/debian/changelog
--- node-sqlite3-5.0.0+ds1/debian/changelog	2020-10-06 11:26:32.000000000 +0000
+++ node-sqlite3-5.0.0+ds1/debian/changelog	2022-05-01 15:33:33.000000000 +0000
@@ -1,3 +1,10 @@
+node-sqlite3 (5.0.0+ds1-1+deb11u1) bullseye; urgency=medium
+
+  * Team upload
+  * Fix denial-of-service (Closes: CVE-2022-21227)
+
+ -- Yadd <yadd@debian.org>  Sun, 01 May 2022 17:33:33 +0200
+
 node-sqlite3 (5.0.0+ds1-1) unstable; urgency=medium
 
   * Team upload
diff -Nru node-sqlite3-5.0.0+ds1/debian/patches/CVE-2022-21227.patch node-sqlite3-5.0.0+ds1/debian/patches/CVE-2022-21227.patch
--- node-sqlite3-5.0.0+ds1/debian/patches/CVE-2022-21227.patch	1970-01-01 00:00:00.000000000 +0000
+++ node-sqlite3-5.0.0+ds1/debian/patches/CVE-2022-21227.patch	2022-05-01 15:33:33.000000000 +0000
@@ -0,0 +1,41 @@
+Description: fix segfault of invalid toString() object
+Author: Kewde <kewde@particl.io>
+Origin: upstream, https://github.com/TryGhost/node-sqlite3/commit/593c9d49
+Bug: https://github.com/advisories/GHSA-9qrh-qjmc-5w2p
+Forwarded: not-needed
+Reviewed-By: Yadd <yadd@debian.org>
+Last-Update: 2022-05-01
+
+--- a/src/statement.cc
++++ b/src/statement.cc
+@@ -210,7 +210,13 @@
+         return new Values::Float(pos, source.ToNumber().DoubleValue());
+     }
+     else if (source.IsObject()) {
+-        std::string val = source.ToString().Utf8Value();
++        Napi::String napiVal = source.ToString();
++        // Check whether toString returned a value that is not undefined.
++        if(napiVal.Type() == 0) {
++            return NULL;
++        }
++
++        std::string val = napiVal.Utf8Value();
+         return new Values::Text(pos, val.length(), val.c_str());
+     }
+     else {
+--- a/test/other_objects.test.js
++++ b/test/other_objects.test.js
+@@ -86,4 +86,13 @@
+             });
+         });
+     });
++
++    it('should ignore faulty toString', function(done) {
++        const faulty = { toString: 23 };
++        db.run("INSERT INTO txt_table VALUES(?)", faulty, function (err) {
++            assert.notEqual(err, undefined);
++            done();
++        });
++    });
++
+ });
diff -Nru node-sqlite3-5.0.0+ds1/debian/patches/series node-sqlite3-5.0.0+ds1/debian/patches/series
--- node-sqlite3-5.0.0+ds1/debian/patches/series	2020-10-06 11:26:32.000000000 +0000
+++ node-sqlite3-5.0.0+ds1/debian/patches/series	2022-05-01 15:33:33.000000000 +0000
@@ -1 +1,2 @@
 disable-hard-test.patch
+CVE-2022-21227.patch