diff mbox series

[meta-oe,wrynose,2/5] libdbi-perl: Fix CVE-2026-10879

Message ID 20260729091840.84531-2-hthakar@cisco.com
State New
Headers show
Series [meta-oe,wrynose,1/5] libdbi-perl: Fix CVE-2026-9698 | expand

Commit Message

Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) July 29, 2026, 9:18 a.m. UTC 
From: Hetvi Thakar <hthakar@cisco.com>

This patch applies the upstream fix as referenced in [2], using the
commit shown in [1].

[1] https://github.com/perl5-dbi/dbi/commit/af79036c07aa9a457971c0f4136e37c85dc20978
[2] https://security-tracker.debian.org/tracker/CVE-2026-10879

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
---
 .../perl/libdbi-perl/CVE-2026-10879.patch     | 41 +++++++++++++++++++
 .../perl/libdbi-perl_1.647.bb                 |  1 +
 2 files changed, 42 insertions(+)
 create mode 100644 meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-10879.patch
diff mbox series

Patch

diff --git a/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-10879.patch b/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-10879.patch
new file mode 100644
index 0000000000..06668adf07
--- /dev/null
+++ b/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-10879.patch
@@ -0,0 +1,41 @@ 
+From 37f2f9149944fa265ea65a8344a9efcdebc0d717 Mon Sep 17 00:00:00 2001
+From: "H.Merijn Brand - Tux" <linux@tux.freedom.nl>
+Date: Thu, 28 May 2026 14:14:50 +0200
+Subject: [PATCH] Replacing `?` with `:p#` in `preparse ()` with more than 9
+ `?` causes buffer overflow
+
+`:p1` is length 3, `?` just 1, but `:p1003` is length 6!
+
+CVE: CVE-2026-10879
+Upstream-Status: Backport [https://github.com/perl5-dbi/dbi/commit/af79036c07aa9a457971c0f4136e37c85dc20978]
+
+Backport Changes:
+- Applied the DBI.xs security fix without functional changes.
+- Omitted ChangeLog and lib/DBI/Changes.pm because they contain only
+  DBI 1.648 release-note updates.
+- Omitted dbixs_rev.h because it is generated from upstream Git history
+  and its hunk only updates the generated timestamp and revision. The
+  fix does not change the DBIXS or DBISTATE interface.
+- Omitted doc/DBI.3 and doc/DBI.man because they are generated manual
+  pages that only contain regenerated dates and are absent from the
+  DBI 1.647 CPAN source.
+
+(cherry picked from commit af79036c07aa9a457971c0f4136e37c85dc20978)
+Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
+---
+ DBI.xs | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/DBI.xs b/DBI.xs
+index 1f06d4d..fbfe405 100644
+--- a/DBI.xs
++++ b/DBI.xs
+@@ -4203,7 +4203,7 @@ preparse(SV *dbh, const char *statement, IV ps_return, IV ps_accept, void *foo)
+     }
+ 
+     /* XXX this allocation strategy won't work when we get to more advanced stuff */
+-    new_stmt_sv = newSV(strlen(statement) * 3);
++    new_stmt_sv = newSV(strlen(statement) * 6 + 16);
+     sv_setpv(new_stmt_sv,"");
+     src  = statement;
+     dest = SvPVX(new_stmt_sv);
diff --git a/meta-oe/recipes-devtools/perl/libdbi-perl_1.647.bb b/meta-oe/recipes-devtools/perl/libdbi-perl_1.647.bb
index f676f73d67..5a76924560 100644
--- a/meta-oe/recipes-devtools/perl/libdbi-perl_1.647.bb
+++ b/meta-oe/recipes-devtools/perl/libdbi-perl_1.647.bb
@@ -11,6 +11,7 @@  LIC_FILES_CHKSUM = "file://LICENSE;md5=65f65488c774efe1da488e36ad6c4a36"
 
 SRC_URI = "${CPAN_MIRROR}/authors/id/H/HM/HMBRAND/DBI-${PV}.tgz \
            file://CVE-2026-9698.patch \
+           file://CVE-2026-10879.patch \
            "
 SRC_URI[sha256sum] = "0df16af8e5b3225a68b7b592ab531004ddb35a9682b50300ce50174ad867d9aa"