From patchwork Thu Oct 15 04:53:52 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 100731 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 615E8CC6B2F for ; Thu, 15 Oct 2026 04:54:30 +0000 (UTC) Received: from rcdn-iport-4.cisco.com (rcdn-iport-4.cisco.com [173.37.86.75]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.32294.1792040060883025091 for ; Wed, 14 Oct 2026 21:54:21 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=fRlyVmco; spf=pass (domain: cisco.com, ip: 173.37.86.75, mailfrom: dkelaiya@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=8571; q=dns/txt; s=iport01; t=1792040060; x=1793249660; h=from:to:cc:subject:date:message-id:mime-version: content-transfer-encoding; bh=iyg8ATptB7kOlAG8C5FV7jCd2fbQkERaRy6M7sxiWsQ=; b=fRlyVmcoRkN0Y3Qc7SApaTI0uea216L+4FDJbB0u5GBCJ2ez7SEIV/SO pOHISLETg0mkRH7JJibMuJOnzpudNaj2t9vuelV3Kj0briYGJTHzaK9h0 wBjx1HDCwVEby7vZWaZ+MCZAAbeFVG6MXHPM2tkVREnXEVlxUbwLRZ2At t1+Ag8AZMtNvRZ53qdEHLZ/5Q/e5cfM3H5y01k4yBjM1Bt+OwNSBrZQol xisaCVedZgq0VGG3Gve1MSoO3vGQ/y5aOwCs4SrlcYmEPvXHLal3NenTG XIC71+8x8HVnsQzYBjsTWQy9HbM7Ri9D9hmv9AnshCGkcg/5ZTZTtFGUr Q==; X-CSE-ConnectionGUID: ctARUwEsS/y/LD//yYcifA== X-CSE-MsgGUID: jw2ynt+VTIygPkgX8AVWvA== X-IPAS-Result: A0BFAgAoW9Bq/5P/Ja1aglmCV3VgQ0kDlkeeHYF+DwEBAQ9EDQQBAYUFjhYCJjQJDgECBAMCAwEBAQEBAQEBAQEBAQoBAQUBAQECAQcFgQ4ThhUIMg2QEgECASoLAUYsAwECWiMhgwIBgjoDNwMRulKBeTOBAYNpAkNQ2zIBCxQBgTiFQIgjXRgBhHwnGxuBcoR+gQWBGkICgScRhm0EgiJ6EoFaHoJtkiVIgR4DWSwBVRMNCgsHBYFoAzUSKhVuMh2BIz4XgQcbBgWBHYEgghYjGTZ6gQlegSspYAEQF4EJggcCglSCAAIBSUEOB0VTCSVDEkcmIggSCQETGjALgRs4PAkoQRcMcwwdBXIIAg0JDRgNSBEsNxUZBD5uB5F8HoJlgQ4BK4EFgQgfkz+SN6EPCiiDdowilToaM4QEgVelFAuYfYJZizGVND9dhGmBaDyBWXAVgyIJShkPiVyEUgsLg2CFR8kTJzILAy8BAQcCBw4DC4FokAABJ4FWAQE IronPort-Data: A9a23:Ahb0oaAJewQIRhVW/3niw5YqxClBgxIJ4kV8jS/XYbTApGwn02QAm GcZWjrSbP2DM2Oged1+Otiyp0IPvZTczYI1OVdlrnsFo1CmBibm6XV1Cm+qYkt+++WaFBoPA /02M4eGcYZsCCCM/n9BC5C5xVFkz6aEW7HgP+DNPyF1VGdMRTwo4f5Zs7ZRbrVA357jXGthh fuo+5eBYQf8hmYtWo4pw/vrRC1H7ayaVAww5jTSVdgT1HfCmn8cCo4oJK3ZBxPQXolOE+emc P3Ixbe/83mx109F5gSNy+uTnuUiG9Y+DCDW4pZkc/HKbitq+kTe5p0G2M80Mi+7vdkmc+dZk 72hvbToIesg0zaldO41C3G0GAkmVUFKFSOuzXWX6aSuI0P6n3TEyOlHNnwpEJYjvfcwJU0Js u0pIzEDR0XW7w626OrTpuhEnM8vKozveYgYoHwllGmfBvc9SpeFSKLPjTNa9G5v3YYVQrCEO pdfMGYwBPjDS0Un1lM/BJEzmO6pl3DXeDxDo1XTrq0yi4TW5FEqjeazb4SOKrRmQ+1XgRyJo H6FwVjYEx4iN9OvmRO7zWyF07qncSTTHdh6+KeD3vlyjVuew2YeBBEbWR63rOe0jma6WslDM AoT4icooK04+UCnQ9W7WAe3yENopTYGUNZWVul/4waXx++Nu0CSB3MPSXhKb9lOWNIKeAHGH 2Shx7vBbQGDepXMIZ5B3t94dQ+PBBU= IronPort-HdrOrdr: A9a23:R1o0YKHkkGFazLiMpLqE3seALOsnbusQ8zAXPo5KJiC9Ffbo8v xG88576faZslsssRIb6LK90de7IU80nKQdieJ6AV7IZmfbUQWTQL2KlbGSoAHIKmnZ6vNX07 tmfuxVDd39CkU/sOPBiTPId+rJBLK8gcaVbSC09QYLcT1X X-Talos-CUID: 9a23:kq1iX25VLxDoSPmvNdss/1I9IP06X2bmi2aXB2P/TndYQ7ybYArF X-Talos-MUID: 9a23:XA2sIwzj9goujyyss0wkbDn4xV6aqKaxUlELjdY4h+iVOhRzNAfNpQqIXKZyfw== X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,159,1787011200"; d="scan'208";a="535667638" Received: from rcdn-l-core-10.cisco.com ([173.37.255.147]) by rcdn-iport-4.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 15 Oct 2026 04:54:20 +0000 Received: from sjc-ads-5675.cisco.com (sjc-ads-5675.cisco.com [10.28.88.189]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-10.cisco.com (Postfix) with ESMTPS id CEC4D18000273; Thu, 15 Oct 2026 04:54:19 +0000 (GMT) Received: by sjc-ads-5675.cisco.com (Postfix, from userid 1887444) id 42034CC1611; Wed, 14 Oct 2026 21:54:19 -0700 (PDT) From: "Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-devel@lists.openembedded.org Cc: Darsh Kelaiya Subject: [oe][meta-oe][wrynose][PATCH 1/2] libdbi-perl: fix CVE-2026-73194 Date: Wed, 14 Oct 2026 21:53:52 -0700 Message-Id: <20261015045353.236229-1-dkelaiya@cisco.com> X-Mailer: git-send-email 2.35.6 MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-5675.cisco.com [10.28.88.189];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.28.88.189, sjc-ads-5675.cisco.com X-Outbound-Node: rcdn-l-core-10.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 04:54:30 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130914 From: Darsh Kelaiya These patches apply the upstream fix as referenced in [2], using the commit shown in [1]. The overflow correction [3] and portable 32-bit regression assertion [4] are separate patches. [1] https://github.com/perl5-dbi/dbi/commit/29b72ae7d2a8114a734a55840bf1c45b89207809 [2] https://access.redhat.com/security/cve/cve-2026-73194 [3] https://github.com/perl5-dbi/dbi/commit/9ffafab2369d7214f88967645feb3beadb900712 [4] https://github.com/perl5-dbi/dbi/commit/acc903db3086a737936643a5dbbc0e22f9d5c421 Signed-off-by: Darsh Kelaiya --- .../perl/libdbi-perl/CVE-2026-73194_p1.patch | 80 +++++++++++++++++++ .../perl/libdbi-perl/CVE-2026-73194_p2.patch | 37 +++++++++ .../perl/libdbi-perl/CVE-2026-73194_p3.patch | 34 ++++++++ .../perl/libdbi-perl_1.647.bb | 3 + 4 files changed, 154 insertions(+) create mode 100644 meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-73194_p1.patch create mode 100644 meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-73194_p2.patch create mode 100644 meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-73194_p3.patch diff --git a/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-73194_p1.patch b/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-73194_p1.patch new file mode 100644 index 0000000000..e2aeab9130 --- /dev/null +++ b/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-73194_p1.patch @@ -0,0 +1,80 @@ +From 0ddf850ca8e31344cb8bd50f11f950328e23da0b Mon Sep 17 00:00:00 2001 +From: "H.Merijn Brand - Tux" +Date: Tue, 11 Aug 2026 14:30:58 +0200 +Subject: [PATCH] Force placeholder limit on :# and :p# too (CVE-2026-73194) + +CVE: CVE-2026-73194 +Upstream-Status: Backport [https://github.com/perl5-dbi/dbi/commit/29b72ae7d2a8114a734a55840bf1c45b89207809] + +Backport Changes: +- Adjusted the test plan: 39 existing + 12 added = 51 tests. +- Omitted ChangeLog and Changes.pm release notes for DBI 1.652. +- Omitted the dbixs_rev.h timestamp and revision update, which does + not affect the preparse fix. + +(cherry picked from commit 29b72ae7d2a8114a734a55840bf1c45b89207809) +Signed-off-by: Darsh Kelaiya +--- + DBI.xs | 10 +++++++++- + t/60preparse.t | 15 ++++++++++++++- + 2 files changed, 23 insertions(+), 2 deletions(-) + +diff --git a/DBI.xs b/DBI.xs +index da5d137..cfc241b 100644 +--- a/DBI.xs ++++ b/DBI.xs +@@ -4392,9 +4392,17 @@ preparse(SV *dbh, const char *statement, IV ps_return, IV ps_accept, void *foo) + } + else if (isDIGIT(*src)) { /* :1 */ + const int pln = atoi(src); ++ ++ if (pln > 99999 || pln <= 0) { ++ char buf[99]; ++ sprintf(buf, "preparse found :p%d which is outside the allowed range.", pln); ++ set_err_char(dbh, imp_xxh, "1", 1, buf, 0, "preparse"); ++ return &PL_sv_undef; ++ } ++ + style = ":1"; + +- if (PS_return(DBIpp_ph_cn)) { /* ':1'->':p1' */ ++ if (PS_return(DBIpp_ph_cn)) { /* ':1'-> ':p1' */ + idx = pln; + *dest++ = 'p'; + while(isDIGIT(*src)) +diff --git a/t/60preparse.t b/t/60preparse.t +index 6432feb..6856460 100755 +--- a/t/60preparse.t ++++ b/t/60preparse.t +@@ -11,7 +11,7 @@ BEGIN { + plan skip_all => 'preparse not supported for DBI::PurePerl'; + } + else { +- plan tests => 39; ++ plan tests => 51; + } + } + +@@ -143,6 +143,19 @@ is( $DBI::errstr, "preparse found unterminated bracketed {...} comment" ); + + # --------------------------------------------------------------------- # + ++is( pp($dbh, 'a = :99999', DBIpp_ph_qm, DBIpp_ph_cs|DBIpp_ph_cn), undef, 'out of sequence'); ++ok( $DBI::err ); ++is( $DBI::errstr, "preparse found placeholder :99999 out of sequence, expected :1"); ++is( pp($dbh, 'a = :100000', DBIpp_ph_qm, DBIpp_ph_cs|DBIpp_ph_cn), undef, 'exceeds limit'); ++ok( $DBI::err ); ++is( $DBI::errstr, "preparse found :p100000 which is outside the allowed range."); ++is( pp($dbh, 'a = :2147483648', DBIpp_ph_qm, DBIpp_ph_cs|DBIpp_ph_cn), undef, 'exceeds limit'); ++ok( $DBI::err ); ++is( $DBI::errstr, "preparse found :p-2147483648 which is outside the allowed range."); ++is( pp($dbh, 'a = :12345678987654321', DBIpp_ph_qm, DBIpp_ph_cs|DBIpp_ph_cn), undef, 'exceeds limit'); ++ok( $DBI::err ); ++like( $DBI::errstr, qr{^preparse found :p\d+ which is outside the allowed range.$}); ++ + $dbh->disconnect; + + 1; +-- +2.35.6 + diff --git a/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-73194_p2.patch b/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-73194_p2.patch new file mode 100644 index 0000000000..a75c4b468d --- /dev/null +++ b/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-73194_p2.patch @@ -0,0 +1,37 @@ +From d7930d38ecb71cd69492bf405cc2d8c7b9647652 Mon Sep 17 00:00:00 2001 +From: Alexander Bluhm +Date: Mon, 17 Aug 2026 13:34:30 +0200 +Subject: [PATCH] Detect atoi() integer overflow. + +A nasty feature of atoi() is its missing overflow detection. As +we expect integer between 0 and 99999, the number of the input +digits can be restricted to 5. Then integer overflow is not possible. + +CVE: CVE-2026-73194 +Upstream-Status: Backport [https://github.com/perl5-dbi/dbi/commit/9ffafab2369d7214f88967645feb3beadb900712] + +Backport Changes: +- Applied the DBI.xs correction without functional edits. + +(cherry picked from commit 9ffafab2369d7214f88967645feb3beadb900712) +Signed-off-by: Darsh Kelaiya +--- + DBI.xs | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/DBI.xs b/DBI.xs +index cfc241b..b2fd892 100644 +--- a/DBI.xs ++++ b/DBI.xs +@@ -4393,7 +4393,7 @@ preparse(SV *dbh, const char *statement, IV ps_return, IV ps_accept, void *foo) + else if (isDIGIT(*src)) { /* :1 */ + const int pln = atoi(src); + +- if (pln > 99999 || pln <= 0) { ++ if (strspn(src, "0123456789") > 5 || pln > 99999 || pln <= 0) { + char buf[99]; + sprintf(buf, "preparse found :p%d which is outside the allowed range.", pln); + set_err_char(dbh, imp_xxh, "1", 1, buf, 0, "preparse"); +-- +2.35.6 + diff --git a/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-73194_p3.patch b/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-73194_p3.patch new file mode 100644 index 0000000000..6fbfe420d3 --- /dev/null +++ b/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-73194_p3.patch @@ -0,0 +1,34 @@ +From 9e063a906fb058c3b23e31b374a4287c27887871 Mon Sep 17 00:00:00 2001 +From: "H.Merijn Brand - Tux" +Date: Mon, 17 Aug 2026 09:49:56 +0200 +Subject: [PATCH] Fix test for 32bit-perl (report in PR#189) + +CVE: CVE-2026-73194 +Upstream-Status: Backport [https://github.com/perl5-dbi/dbi/commit/acc903db3086a737936643a5dbbc0e22f9d5c421] + +Backport Changes: +- Applied the t/60preparse.t assertion without functional edits. +- Omitted DBI 1.653 version, release note, and generated doc updates. + +(cherry picked from commit acc903db3086a737936643a5dbbc0e22f9d5c421) +Signed-off-by: Darsh Kelaiya +--- + t/60preparse.t | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/t/60preparse.t b/t/60preparse.t +index 6856460..1520ae7 100755 +--- a/t/60preparse.t ++++ b/t/60preparse.t +@@ -151,7 +151,7 @@ ok( $DBI::err ); + is( $DBI::errstr, "preparse found :p100000 which is outside the allowed range."); + is( pp($dbh, 'a = :2147483648', DBIpp_ph_qm, DBIpp_ph_cs|DBIpp_ph_cn), undef, 'exceeds limit'); + ok( $DBI::err ); +-is( $DBI::errstr, "preparse found :p-2147483648 which is outside the allowed range."); ++like( $DBI::errstr, qr{^preparse found :p(?:-2147483648|2147483647) which is outside the allowed range.$}); + is( pp($dbh, 'a = :12345678987654321', DBIpp_ph_qm, DBIpp_ph_cs|DBIpp_ph_cn), undef, 'exceeds limit'); + ok( $DBI::err ); + like( $DBI::errstr, qr{^preparse found :p\d+ which is outside the allowed range.$}); +-- +2.35.6 + diff --git a/meta-oe/recipes-devtools/perl/libdbi-perl_1.647.bb b/meta-oe/recipes-devtools/perl/libdbi-perl_1.647.bb index 883827e270..1e74a17e4b 100644 --- a/meta-oe/recipes-devtools/perl/libdbi-perl_1.647.bb +++ b/meta-oe/recipes-devtools/perl/libdbi-perl_1.647.bb @@ -15,6 +15,9 @@ SRC_URI = "${CPAN_MIRROR}/authors/id/H/HM/HMBRAND/DBI-${PV}.tgz \ file://CVE-2026-14380.patch \ file://CVE-2026-14739.patch \ file://CVE-2026-14740.patch \ + file://CVE-2026-73194_p1.patch \ + file://CVE-2026-73194_p2.patch \ + file://CVE-2026-73194_p3.patch \ " SRC_URI[sha256sum] = "0df16af8e5b3225a68b7b592ab531004ddb35a9682b50300ce50174ad867d9aa" From patchwork Thu Oct 15 04:53:53 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 100730 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5130BCC6B2E for ; Thu, 15 Oct 2026 04:54:30 +0000 (UTC) Received: from rcdn-iport-1.cisco.com (rcdn-iport-1.cisco.com [173.37.86.72]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.32293.1792040060867446466 for ; Wed, 14 Oct 2026 21:54:21 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=fGZc+sN7; spf=pass (domain: cisco.com, ip: 173.37.86.72, mailfrom: dkelaiya@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=5257; q=dns/txt; s=iport01; t=1792040060; x=1793249660; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=fAc7CAMjtyr1dXwEfHX3eWK+Va7qye+1TCjs0J3o208=; b=fGZc+sN7ARA/gRRQuUyWiIR6Z8ZgINJ3sIzGfduHoV9dcqYYZfTLc7Uc siB77ylsozDiBNFexFQ3L/jvfnwcQ1FFCVmH+9mUz57Xg3uED1FG5RqQw dadG9VjqT7qmBocOD16mTzxaT3diS4VTuo5i3iid0CJX3mbKrIfEzHqa0 zV+7BFojzc0uOEFpXPKWrDO8FCFqCE5IYi7Btv6XVUzYakM/BGVSk7Gtz sBLYN7PteeQjmmPLjwun1lNSegr/7xtAAIb2bIUZwd/viyjvnZkUo9qcL CV6P63vpAC97ImKKJQs2wA/rtl0EN19SKIFPhXyfr1cZpxW9yaqeKnUl8 w==; X-CSE-ConnectionGUID: JDlotk7VQO+BkX8yCl8JEw== X-CSE-MsgGUID: 8msPWQqERZuTtB2yp/5bQw== X-IPAS-Result: A0BHAgAoW9Bq/43/Ja1aglmCV3VgQ0kDlkcDnhqBfg8BAQEPRA0EAQGFBQKOFAImNAkOAQIEAwIDAQEBAQEBAQEBAQEBCgEBBQEBAQIBBwWBDhOGTw2QEgECAQMyAUYQHAMBAi8rIwgZgwIBgjoDNwMRulKCLIEBg2kCQ1DbMgELFAGBOIVAiCNdGAGEfCcbG4FyhH6BBYEaQgKBJxGGbQSCInoSgVoelRJIgR4DWSwBVRMNCgsHBYFoAzUSKhVuMh2BIz4XgQcbBgWBHYEgghYjGTZ6gQlegSspYAEQF4EJggcCglSCAAIBSUEOB0VTCSVDEkcmIggSCQETGjALgRs4PAkoQRcMcwwdBXIIAg0JDRgNSBEsNxUZBD5uB5F8HoJkAQGBDQErgiwRpWWhDwoog3aMIpU6GjOEBIFXpRQLmH2CWYsxlTSBHIRpgWg8gVlwFYMiCUoZD44uCwuDYIVHyRMnMgsDLwEBBwIHDgMLgWiQAAEngVYBAQ IronPort-Data: A9a23:eAyYKayUG/E2DSGrTmF6t+dnxyrEfRIJ4+MujC+fZmUNrF6WrkUHz mNMDG7SP/7ZZGX9fdFyOoi3o0kDvceAytFlTwI//1hgHilAwSbn6Xt1DatR0we6dJCroJdPt p1GAjX4BJlqCCKa/lHyYuCJQUBUjcmgXqD7BPPPJhd/TAplTDZJoR94kobVuKYw6TSCK13L4 4yaT/H3Ygf/hWcsaz9MsspvlTs21BjMkGJA1rABTagjUG/2zxE9EJ8ZLKetGHr0KqE8NvK6X evK0Iai9Wrf+Ro3Yvv9+losWhRXKlJ6FVHmZkt+A8BOsDAbzsAB+vpT2M4nVKtio27hc+adZ zl6ncfYpQ8BZsUgkQmGOvVSO3kW0aZuoNcrLZUj2CCe5xWuTpfi/xlhJGMaOYoE+blJOEYN3 /8oeCEmakChqv3jldpXSsE07igiBNPgMIVavjRryivUSK56B5vCWK7No9Rf2V/chOgXQq2YP JVfM2cyKk2cOnWjOX9PYH46tOuri332cixRgFmUvqEwpWPUyWSd1ZCwa4eJJ4XUGJo9ckCw9 mfdx1vAGzwgBsGj1RDf42rr2+X2gnauMG4VPPjinhJwu3WU3mEVBRgcWFe3rPX8hkOgVtZ3L 00P5jFoqrA/8kGuRNTxUxC05nmesXYht8F4CeY27kSJj6HT+QvcXjRCRT9aY9tgv8gzLdA36 mK0cxrSLWQHmNWopbi1r994cRva1fApEFI/ IronPort-HdrOrdr: A9a23:qou/d63x3W6Og2vZ6TT47gqjBJAkLtp133Aq2lEZdPWaSKOlfq eV7ZMmPHDP6Qr5NEtMpTnEAtjjfZq+z+8Q3WBuB9eftWDd0QPCRr2Kr7GSpgEIcBeRygcy78 tdmtBFeb7NJGk/q9rm6w+lFNtl6tyG/Ke0wdr69R5WPGdXg2UK1XYANu5deXcGPTV7OQ== X-Talos-CUID: 9a23:C7CdP2mD3Mn38BxRcoDRyRVWOEnXOV/xyHDMIBCGMEEqYr6lGU67/PNGvtU7zg== X-Talos-MUID: 9a23:a82tgg91rZWA6raRUbFSAVOQf5dt+JyRMVkgq6cbh9Wubz1ofGqXtSviFw== X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,159,1787011200"; d="scan'208";a="535451657" Received: from rcdn-l-core-04.cisco.com ([173.37.255.141]) by rcdn-iport-1.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 15 Oct 2026 04:54:20 +0000 Received: from sjc-ads-5675.cisco.com (sjc-ads-5675.cisco.com [10.28.88.189]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-04.cisco.com (Postfix) with ESMTPS id D327918000182; Thu, 15 Oct 2026 04:54:19 +0000 (GMT) Received: by sjc-ads-5675.cisco.com (Postfix, from userid 1887444) id 45394CBF201; Wed, 14 Oct 2026 21:54:19 -0700 (PDT) From: "Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-devel@lists.openembedded.org Cc: Darsh Kelaiya Subject: [oe][meta-oe][wrynose][PATCH 2/2] libdbi-perl: fix CVE-2026-73193 Date: Wed, 14 Oct 2026 21:53:53 -0700 Message-Id: <20261015045353.236229-2-dkelaiya@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261015045353.236229-1-dkelaiya@cisco.com> References: <20261015045353.236229-1-dkelaiya@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-5675.cisco.com [10.28.88.189];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.28.88.189, sjc-ads-5675.cisco.com X-Outbound-Node: rcdn-l-core-04.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 15 Oct 2026 04:54:30 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130913 From: Darsh Kelaiya These patches apply the upstream fix as referenced in [2], using the commit shown in [1]. The STRLEN correction [3] is a separate patch. [1] https://github.com/perl5-dbi/dbi/commit/c751ae5a5a6f56c2f8284f37c1f4d43500352ef1 [2] https://access.redhat.com/security/cve/cve-2026-73193 [3] https://github.com/perl5-dbi/dbi/commit/afba6751f2acbc1f55ad55aac9f0b58d4f511308 Signed-off-by: Darsh Kelaiya --- .../perl/libdbi-perl/CVE-2026-73193_p1.patch | 51 +++++++++++++++++++ .../perl/libdbi-perl/CVE-2026-73193_p2.patch | 38 ++++++++++++++ .../perl/libdbi-perl_1.647.bb | 2 + 3 files changed, 91 insertions(+) create mode 100644 meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-73193_p1.patch create mode 100644 meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-73193_p2.patch diff --git a/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-73193_p1.patch b/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-73193_p1.patch new file mode 100644 index 0000000000..c32d74c7f2 --- /dev/null +++ b/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-73193_p1.patch @@ -0,0 +1,51 @@ +From eaf24226efba1e0628868b236c59d2e23bd6236a Mon Sep 17 00:00:00 2001 +From: "H.Merijn Brand - Tux" +Date: Tue, 11 Aug 2026 15:02:52 +0200 +Subject: [PATCH] Limit statements to 292 Mb in preparse (CVE-2026-73193) + +CVE: CVE-2026-73193 +Upstream-Status: Backport [https://github.com/perl5-dbi/dbi/commit/c751ae5a5a6f56c2f8284f37c1f4d43500352ef1] + +Backport Changes: +- Applied the DBI.xs security change without functional edits. +- Omitted ChangeLog and Changes.pm release notes for DBI 1.652. +- Omitted the dbixs_rev.h timestamp and revision update, which does + not affect the preparse fix. + +(cherry picked from commit c751ae5a5a6f56c2f8284f37c1f4d43500352ef1) +Signed-off-by: Darsh Kelaiya +--- + DBI.xs | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/DBI.xs b/DBI.xs +index b2fd892..db8e005 100644 +--- a/DBI.xs ++++ b/DBI.xs +@@ -4187,6 +4187,7 @@ preparse(SV *dbh, const char *statement, IV ps_return, IV ps_accept, void *foo) + we add support for odbc escape sequences. + */ + int idx = 1; ++ int sln; + + char in_quote = '\0'; + char in_comment = '\0'; +@@ -4210,7 +4211,14 @@ preparse(SV *dbh, const char *statement, IV ps_return, IV ps_accept, void *foo) + * using factor 6: :p1 .. :p11106 + * using factor 7: :p1 .. :p111105 + * and that count is insane already */ +- new_stmt_sv = newSV(strlen(statement) * 7 + 16); ++ sln = strlen(statement); ++ if (sln > 306783375) { /* x * 7 + 16 would overflow maxint on 32bit ints */ ++ char buf[99]; ++ sprintf(buf, "preparse statement length exceeds maximum length (306783375)."); ++ set_err_char(dbh, imp_xxh, "1", 1, buf, 0, "preparse"); ++ return &PL_sv_undef; ++ } ++ new_stmt_sv = newSV(sln * 7 + 16); + sv_setpv(new_stmt_sv,""); + src = statement; + dest = SvPVX(new_stmt_sv); +-- +2.35.6 + diff --git a/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-73193_p2.patch b/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-73193_p2.patch new file mode 100644 index 0000000000..968521d91d --- /dev/null +++ b/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-73193_p2.patch @@ -0,0 +1,38 @@ +From f46355f7578f796ad50e650f371f02864bf39b7b Mon Sep 17 00:00:00 2001 +From: Alexander Bluhm +Date: Mon, 17 Aug 2026 13:11:38 +0200 +Subject: [PATCH] Fix integer overflow after strlen(). + +In preparse() the integer variable sln is used the store the return +value of strlen(). By that the real length is truncated to 32 bit +and made signed. This way the overflow check sln > 306783375 can +be circumvented. Make sln of type STRLEN. + +CVE: CVE-2026-73193 +Upstream-Status: Backport [https://github.com/perl5-dbi/dbi/commit/afba6751f2acbc1f55ad55aac9f0b58d4f511308] + +Backport Changes: +- Applied the DBI.xs correction without functional edits. + +(cherry picked from commit afba6751f2acbc1f55ad55aac9f0b58d4f511308) +Signed-off-by: Darsh Kelaiya +--- + DBI.xs | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/DBI.xs b/DBI.xs +index db8e005..f5c7c29 100644 +--- a/DBI.xs ++++ b/DBI.xs +@@ -4187,7 +4187,7 @@ preparse(SV *dbh, const char *statement, IV ps_return, IV ps_accept, void *foo) + we add support for odbc escape sequences. + */ + int idx = 1; +- int sln; ++ STRLEN sln; + + char in_quote = '\0'; + char in_comment = '\0'; +-- +2.35.6 + diff --git a/meta-oe/recipes-devtools/perl/libdbi-perl_1.647.bb b/meta-oe/recipes-devtools/perl/libdbi-perl_1.647.bb index 1e74a17e4b..03be7eabea 100644 --- a/meta-oe/recipes-devtools/perl/libdbi-perl_1.647.bb +++ b/meta-oe/recipes-devtools/perl/libdbi-perl_1.647.bb @@ -18,6 +18,8 @@ SRC_URI = "${CPAN_MIRROR}/authors/id/H/HM/HMBRAND/DBI-${PV}.tgz \ file://CVE-2026-73194_p1.patch \ file://CVE-2026-73194_p2.patch \ file://CVE-2026-73194_p3.patch \ + file://CVE-2026-73193_p1.patch \ + file://CVE-2026-73193_p2.patch \ " SRC_URI[sha256sum] = "0df16af8e5b3225a68b7b592ab531004ddb35a9682b50300ce50174ad867d9aa"