From 26dc43e3dffc59500fe472ab4f85d02ad920779e Mon Sep 17 00:00:00 2001 From: Darsh Kelaiya Date: Wed, 14 Oct 2026 21:53:52 -0700 Subject: [PATCH] libdbi-perl: fix CVE-2026-73194 These patches apply the upstream fix as referenced in [2], using the commit shown in [1]. The overflow correction [3] and portable 32-bit regression assertion [4] are separate patches. [1] https://github.com/perl5-dbi/dbi/commit/29b72ae7d2a8114a734a55840bf1c45b89207809 [2] https://access.redhat.com/security/cve/cve-2026-73194 [3] https://github.com/perl5-dbi/dbi/commit/9ffafab2369d7214f88967645feb3beadb900712 [4] https://github.com/perl5-dbi/dbi/commit/acc903db3086a737936643a5dbbc0e22f9d5c421 Signed-off-by: Darsh Kelaiya Signed-off-by: Anuj Mittal --- .../perl/libdbi-perl/CVE-2026-73194_p1.patch | 80 +++++++++++++++++++ .../perl/libdbi-perl/CVE-2026-73194_p2.patch | 37 +++++++++ .../perl/libdbi-perl/CVE-2026-73194_p3.patch | 34 ++++++++ .../perl/libdbi-perl_1.647.bb | 3 + 4 files changed, 154 insertions(+) create mode 100644 meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-73194_p1.patch create mode 100644 meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-73194_p2.patch create mode 100644 meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-73194_p3.patch diff --git a/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-73194_p1.patch b/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-73194_p1.patch new file mode 100644 index 0000000000..e2aeab9130 --- /dev/null +++ b/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-73194_p1.patch @@ -0,0 +1,80 @@ +From 0ddf850ca8e31344cb8bd50f11f950328e23da0b Mon Sep 17 00:00:00 2001 +From: "H.Merijn Brand - Tux" +Date: Tue, 11 Aug 2026 14:30:58 +0200 +Subject: [PATCH] Force placeholder limit on :# and :p# too (CVE-2026-73194) + +CVE: CVE-2026-73194 +Upstream-Status: Backport [https://github.com/perl5-dbi/dbi/commit/29b72ae7d2a8114a734a55840bf1c45b89207809] + +Backport Changes: +- Adjusted the test plan: 39 existing + 12 added = 51 tests. +- Omitted ChangeLog and Changes.pm release notes for DBI 1.652. +- Omitted the dbixs_rev.h timestamp and revision update, which does + not affect the preparse fix. + +(cherry picked from commit 29b72ae7d2a8114a734a55840bf1c45b89207809) +Signed-off-by: Darsh Kelaiya +--- + DBI.xs | 10 +++++++++- + t/60preparse.t | 15 ++++++++++++++- + 2 files changed, 23 insertions(+), 2 deletions(-) + +diff --git a/DBI.xs b/DBI.xs +index da5d137..cfc241b 100644 +--- a/DBI.xs ++++ b/DBI.xs +@@ -4392,9 +4392,17 @@ preparse(SV *dbh, const char *statement, IV ps_return, IV ps_accept, void *foo) + } + else if (isDIGIT(*src)) { /* :1 */ + const int pln = atoi(src); ++ ++ if (pln > 99999 || pln <= 0) { ++ char buf[99]; ++ sprintf(buf, "preparse found :p%d which is outside the allowed range.", pln); ++ set_err_char(dbh, imp_xxh, "1", 1, buf, 0, "preparse"); ++ return &PL_sv_undef; ++ } ++ + style = ":1"; + +- if (PS_return(DBIpp_ph_cn)) { /* ':1'->':p1' */ ++ if (PS_return(DBIpp_ph_cn)) { /* ':1'-> ':p1' */ + idx = pln; + *dest++ = 'p'; + while(isDIGIT(*src)) +diff --git a/t/60preparse.t b/t/60preparse.t +index 6432feb..6856460 100755 +--- a/t/60preparse.t ++++ b/t/60preparse.t +@@ -11,7 +11,7 @@ BEGIN { + plan skip_all => 'preparse not supported for DBI::PurePerl'; + } + else { +- plan tests => 39; ++ plan tests => 51; + } + } + +@@ -143,6 +143,19 @@ is( $DBI::errstr, "preparse found unterminated bracketed {...} comment" ); + + # --------------------------------------------------------------------- # + ++is( pp($dbh, 'a = :99999', DBIpp_ph_qm, DBIpp_ph_cs|DBIpp_ph_cn), undef, 'out of sequence'); ++ok( $DBI::err ); ++is( $DBI::errstr, "preparse found placeholder :99999 out of sequence, expected :1"); ++is( pp($dbh, 'a = :100000', DBIpp_ph_qm, DBIpp_ph_cs|DBIpp_ph_cn), undef, 'exceeds limit'); ++ok( $DBI::err ); ++is( $DBI::errstr, "preparse found :p100000 which is outside the allowed range."); ++is( pp($dbh, 'a = :2147483648', DBIpp_ph_qm, DBIpp_ph_cs|DBIpp_ph_cn), undef, 'exceeds limit'); ++ok( $DBI::err ); ++is( $DBI::errstr, "preparse found :p-2147483648 which is outside the allowed range."); ++is( pp($dbh, 'a = :12345678987654321', DBIpp_ph_qm, DBIpp_ph_cs|DBIpp_ph_cn), undef, 'exceeds limit'); ++ok( $DBI::err ); ++like( $DBI::errstr, qr{^preparse found :p\d+ which is outside the allowed range.$}); ++ + $dbh->disconnect; + + 1; +-- +2.35.6 + diff --git a/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-73194_p2.patch b/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-73194_p2.patch new file mode 100644 index 0000000000..a75c4b468d --- /dev/null +++ b/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-73194_p2.patch @@ -0,0 +1,37 @@ +From d7930d38ecb71cd69492bf405cc2d8c7b9647652 Mon Sep 17 00:00:00 2001 +From: Alexander Bluhm +Date: Mon, 17 Aug 2026 13:34:30 +0200 +Subject: [PATCH] Detect atoi() integer overflow. + +A nasty feature of atoi() is its missing overflow detection. As +we expect integer between 0 and 99999, the number of the input +digits can be restricted to 5. Then integer overflow is not possible. + +CVE: CVE-2026-73194 +Upstream-Status: Backport [https://github.com/perl5-dbi/dbi/commit/9ffafab2369d7214f88967645feb3beadb900712] + +Backport Changes: +- Applied the DBI.xs correction without functional edits. + +(cherry picked from commit 9ffafab2369d7214f88967645feb3beadb900712) +Signed-off-by: Darsh Kelaiya +--- + DBI.xs | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/DBI.xs b/DBI.xs +index cfc241b..b2fd892 100644 +--- a/DBI.xs ++++ b/DBI.xs +@@ -4393,7 +4393,7 @@ preparse(SV *dbh, const char *statement, IV ps_return, IV ps_accept, void *foo) + else if (isDIGIT(*src)) { /* :1 */ + const int pln = atoi(src); + +- if (pln > 99999 || pln <= 0) { ++ if (strspn(src, "0123456789") > 5 || pln > 99999 || pln <= 0) { + char buf[99]; + sprintf(buf, "preparse found :p%d which is outside the allowed range.", pln); + set_err_char(dbh, imp_xxh, "1", 1, buf, 0, "preparse"); +-- +2.35.6 + diff --git a/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-73194_p3.patch b/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-73194_p3.patch new file mode 100644 index 0000000000..6fbfe420d3 --- /dev/null +++ b/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-73194_p3.patch @@ -0,0 +1,34 @@ +From 9e063a906fb058c3b23e31b374a4287c27887871 Mon Sep 17 00:00:00 2001 +From: "H.Merijn Brand - Tux" +Date: Mon, 17 Aug 2026 09:49:56 +0200 +Subject: [PATCH] Fix test for 32bit-perl (report in PR#189) + +CVE: CVE-2026-73194 +Upstream-Status: Backport [https://github.com/perl5-dbi/dbi/commit/acc903db3086a737936643a5dbbc0e22f9d5c421] + +Backport Changes: +- Applied the t/60preparse.t assertion without functional edits. +- Omitted DBI 1.653 version, release note, and generated doc updates. + +(cherry picked from commit acc903db3086a737936643a5dbbc0e22f9d5c421) +Signed-off-by: Darsh Kelaiya +--- + t/60preparse.t | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/t/60preparse.t b/t/60preparse.t +index 6856460..1520ae7 100755 +--- a/t/60preparse.t ++++ b/t/60preparse.t +@@ -151,7 +151,7 @@ ok( $DBI::err ); + is( $DBI::errstr, "preparse found :p100000 which is outside the allowed range."); + is( pp($dbh, 'a = :2147483648', DBIpp_ph_qm, DBIpp_ph_cs|DBIpp_ph_cn), undef, 'exceeds limit'); + ok( $DBI::err ); +-is( $DBI::errstr, "preparse found :p-2147483648 which is outside the allowed range."); ++like( $DBI::errstr, qr{^preparse found :p(?:-2147483648|2147483647) which is outside the allowed range.$}); + is( pp($dbh, 'a = :12345678987654321', DBIpp_ph_qm, DBIpp_ph_cs|DBIpp_ph_cn), undef, 'exceeds limit'); + ok( $DBI::err ); + like( $DBI::errstr, qr{^preparse found :p\d+ which is outside the allowed range.$}); +-- +2.35.6 + diff --git a/meta-oe/recipes-devtools/perl/libdbi-perl_1.647.bb b/meta-oe/recipes-devtools/perl/libdbi-perl_1.647.bb index 883827e270..1e74a17e4b 100644 --- a/meta-oe/recipes-devtools/perl/libdbi-perl_1.647.bb +++ b/meta-oe/recipes-devtools/perl/libdbi-perl_1.647.bb @@ -15,6 +15,9 @@ SRC_URI = "${CPAN_MIRROR}/authors/id/H/HM/HMBRAND/DBI-${PV}.tgz \ file://CVE-2026-14380.patch \ file://CVE-2026-14739.patch \ file://CVE-2026-14740.patch \ + file://CVE-2026-73194_p1.patch \ + file://CVE-2026-73194_p2.patch \ + file://CVE-2026-73194_p3.patch \ " SRC_URI[sha256sum] = "0df16af8e5b3225a68b7b592ab531004ddb35a9682b50300ce50174ad867d9aa"