Patches for stable/10 to address the sqlite3 the tmpdir selection vulnerability (CVE-2016-6153).

[cy]

Summary

This patch addresses he sqlite3 the tmpdir selection vulnerability (CVE-2016-6153) for stable/10. The patches are discussed by Debian here: https://lists.debian.org/debian-lts/2016/07/msg00004.html. Upline sqlite patches are as follows:

http://www.sqlite.org/cgi/src/info/67985761aa93fb61
http://www.sqlite.org/cgi/src/info/b38fe522cfc971b3
http://www.sqlite.org/cgi/src/info/614bb709d34e1148

Since code for sqlite 1.8 in stable/10's sqlite3 source files is laid out much differently I had to glean the changed statements from the upline patches to build a patch for stable/10. I'd appreciate a review.

Should anyone else review this?

Would we prefer to MFC sqlite3 1.14.1 to stable/10 instead?

Test Plan

make tinderbox on universe10a succeeded.

Testing using svnlite on 10.3-STABLE (on my testbed) worked.

[kib]

sqlite is the internal library in base, nothing non-base should ever access its symbols. I believe that the database files are compatible or auto-upgraded between sqlite versions.

As such, I think that all data point out that upgrade to 1.14 is much better route for stable/10 as well, because it avoids diverging from mainline.

[cy]

Excellent! I wasn't sure if it was acceptable to MFC such a large revision jump to stable/10, it made a lot more sense but I wasn't sure until I asked. I'll MFC to stable/10 then. Thanks for the input.