[meta-oe,wrynose,1/2] libdbi-perl: fix CVE-2026-73194

diff --git a/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-73194_p1.patch b/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-73194_p1.patch
new file mode 100644
index 0000000000..e2aeab9130
--- /dev/null
+++ b/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-73194_p1.patch
@@ -0,0 +1,80 @@ 
+From 0ddf850ca8e31344cb8bd50f11f950328e23da0b Mon Sep 17 00:00:00 2001
+From: "H.Merijn Brand - Tux" <linux@tux.freedom.nl>
+Date: Tue, 11 Aug 2026 14:30:58 +0200
+Subject: [PATCH] Force placeholder limit on :# and :p# too (CVE-2026-73194)
+
+CVE: CVE-2026-73194
+Upstream-Status: Backport [https://github.com/perl5-dbi/dbi/commit/29b72ae7d2a8114a734a55840bf1c45b89207809]
+
+Backport Changes:
+- Adjusted the test plan: 39 existing + 12 added = 51 tests.
+- Omitted ChangeLog and Changes.pm release notes for DBI 1.652.
+- Omitted the dbixs_rev.h timestamp and revision update, which does
+  not affect the preparse fix.
+
+(cherry picked from commit 29b72ae7d2a8114a734a55840bf1c45b89207809)
+Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
+---
+ DBI.xs         | 10 +++++++++-
+ t/60preparse.t | 15 ++++++++++++++-
+ 2 files changed, 23 insertions(+), 2 deletions(-)
+
+diff --git a/DBI.xs b/DBI.xs
+index da5d137..cfc241b 100644
+--- a/DBI.xs
++++ b/DBI.xs
+@@ -4392,9 +4392,17 @@ preparse(SV *dbh, const char *statement, IV ps_return, IV ps_accept, void *foo)
+         }
+         else if (isDIGIT(*src)) {   /* :1 */
+             const int pln = atoi(src);
++
++            if (pln > 99999 || pln <= 0) {
++                char buf[99];
++                sprintf(buf, "preparse found :p%d which is outside the allowed range.", pln);
++                set_err_char(dbh, imp_xxh, "1", 1, buf, 0, "preparse");
++                return &PL_sv_undef;
++            }
++
+             style = ":1";
+ 
+-            if (PS_return(DBIpp_ph_cn)) { /* ':1'->':p1'  */
++            if (PS_return(DBIpp_ph_cn)) { /* ':1'-> ':p1'  */
+                 idx = pln;
+                 *dest++ = 'p';
+                 while(isDIGIT(*src))
+diff --git a/t/60preparse.t b/t/60preparse.t
+index 6432feb..6856460 100755
+--- a/t/60preparse.t
++++ b/t/60preparse.t
+@@ -11,7 +11,7 @@ BEGIN {
+ 		plan skip_all => 'preparse not supported for DBI::PurePerl';
+ 	}
+ 	else {
+-		plan tests => 39;
++		plan tests => 51;
+ 	}
+ }
+ 
+@@ -143,6 +143,19 @@ is( $DBI::errstr, "preparse found unterminated bracketed {...} comment" );
+ 
+ # --------------------------------------------------------------------- #
+ 
++is( pp($dbh, 'a = :99999', DBIpp_ph_qm, DBIpp_ph_cs|DBIpp_ph_cn), undef, 'out of sequence');
++ok( $DBI::err );
++is( $DBI::errstr, "preparse found placeholder :99999 out of sequence, expected :1");
++is( pp($dbh, 'a = :100000', DBIpp_ph_qm, DBIpp_ph_cs|DBIpp_ph_cn), undef, 'exceeds limit');
++ok( $DBI::err );
++is( $DBI::errstr, "preparse found :p100000 which is outside the allowed range.");
++is( pp($dbh, 'a = :2147483648', DBIpp_ph_qm, DBIpp_ph_cs|DBIpp_ph_cn), undef, 'exceeds limit');
++ok( $DBI::err );
++is( $DBI::errstr, "preparse found :p-2147483648 which is outside the allowed range.");
++is( pp($dbh, 'a = :12345678987654321', DBIpp_ph_qm, DBIpp_ph_cs|DBIpp_ph_cn), undef, 'exceeds limit');
++ok( $DBI::err );
++like( $DBI::errstr, qr{^preparse found :p\d+ which is outside the allowed range.$});
++
+ $dbh->disconnect;
+ 
+ 1;
+-- 
+2.35.6
+
diff --git a/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-73194_p2.patch b/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-73194_p2.patch
new file mode 100644
index 0000000000..a75c4b468d
--- /dev/null
+++ b/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-73194_p2.patch
@@ -0,0 +1,37 @@ 
+From d7930d38ecb71cd69492bf405cc2d8c7b9647652 Mon Sep 17 00:00:00 2001
+From: Alexander Bluhm <alexander.bluhm@gmx.net>
+Date: Mon, 17 Aug 2026 13:34:30 +0200
+Subject: [PATCH] Detect atoi() integer overflow.
+
+A nasty feature of atoi() is its missing overflow detection.  As
+we expect integer between 0 and 99999, the number of the input
+digits can be restricted to 5.  Then integer overflow is not possible.
+
+CVE: CVE-2026-73194
+Upstream-Status: Backport [https://github.com/perl5-dbi/dbi/commit/9ffafab2369d7214f88967645feb3beadb900712]
+
+Backport Changes:
+- Applied the DBI.xs correction without functional edits.
+
+(cherry picked from commit 9ffafab2369d7214f88967645feb3beadb900712)
+Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
+---
+ DBI.xs | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/DBI.xs b/DBI.xs
+index cfc241b..b2fd892 100644
+--- a/DBI.xs
++++ b/DBI.xs
+@@ -4393,7 +4393,7 @@ preparse(SV *dbh, const char *statement, IV ps_return, IV ps_accept, void *foo)
+         else if (isDIGIT(*src)) {   /* :1 */
+             const int pln = atoi(src);
+ 
+-            if (pln > 99999 || pln <= 0) {
++            if (strspn(src, "0123456789") > 5 || pln > 99999 || pln <= 0) {
+                 char buf[99];
+                 sprintf(buf, "preparse found :p%d which is outside the allowed range.", pln);
+                 set_err_char(dbh, imp_xxh, "1", 1, buf, 0, "preparse");
+-- 
+2.35.6
+
diff --git a/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-73194_p3.patch b/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-73194_p3.patch
new file mode 100644
index 0000000000..6fbfe420d3
--- /dev/null
+++ b/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-73194_p3.patch
@@ -0,0 +1,34 @@ 
+From 9e063a906fb058c3b23e31b374a4287c27887871 Mon Sep 17 00:00:00 2001
+From: "H.Merijn Brand - Tux" <linux@tux.freedom.nl>
+Date: Mon, 17 Aug 2026 09:49:56 +0200
+Subject: [PATCH] Fix test for 32bit-perl (report in PR#189)
+
+CVE: CVE-2026-73194
+Upstream-Status: Backport [https://github.com/perl5-dbi/dbi/commit/acc903db3086a737936643a5dbbc0e22f9d5c421]
+
+Backport Changes:
+- Applied the t/60preparse.t assertion without functional edits.
+- Omitted DBI 1.653 version, release note, and generated doc updates.
+
+(cherry picked from commit acc903db3086a737936643a5dbbc0e22f9d5c421)
+Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
+---
+ t/60preparse.t | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/t/60preparse.t b/t/60preparse.t
+index 6856460..1520ae7 100755
+--- a/t/60preparse.t
++++ b/t/60preparse.t
+@@ -151,7 +151,7 @@ ok( $DBI::err );
+ is( $DBI::errstr, "preparse found :p100000 which is outside the allowed range.");
+ is( pp($dbh, 'a = :2147483648', DBIpp_ph_qm, DBIpp_ph_cs|DBIpp_ph_cn), undef, 'exceeds limit');
+ ok( $DBI::err );
+-is( $DBI::errstr, "preparse found :p-2147483648 which is outside the allowed range.");
++like( $DBI::errstr, qr{^preparse found :p(?:-2147483648|2147483647) which is outside the allowed range.$});
+ is( pp($dbh, 'a = :12345678987654321', DBIpp_ph_qm, DBIpp_ph_cs|DBIpp_ph_cn), undef, 'exceeds limit');
+ ok( $DBI::err );
+ like( $DBI::errstr, qr{^preparse found :p\d+ which is outside the allowed range.$});
+-- 
+2.35.6
+
diff --git a/meta-oe/recipes-devtools/perl/libdbi-perl_1.647.bb b/meta-oe/recipes-devtools/perl/libdbi-perl_1.647.bb
index 883827e270..1e74a17e4b 100644
--- a/meta-oe/recipes-devtools/perl/libdbi-perl_1.647.bb
+++ b/meta-oe/recipes-devtools/perl/libdbi-perl_1.647.bb
@@ -15,6 +15,9 @@  SRC_URI = "${CPAN_MIRROR}/authors/id/H/HM/HMBRAND/DBI-${PV}.tgz \
            file://CVE-2026-14380.patch \
            file://CVE-2026-14739.patch \
            file://CVE-2026-14740.patch \
+           file://CVE-2026-73194_p1.patch \
+           file://CVE-2026-73194_p2.patch \
+           file://CVE-2026-73194_p3.patch \
            "
 SRC_URI[sha256sum] = "0df16af8e5b3225a68b7b592ab531004ddb35a9682b50300ce50174ad867d9aa"