libdbi-perl: Fix CVE-2026-10879

This patch applies the upstream fix as referenced in [2], using the
commit shown in [1].

[1] https://github.com/perl5-dbi/dbi/commit/af79036c07aa9a457971c0f4136e37c85dc20978
[2] https://security-tracker.debian.org/tracker/CVE-2026-10879

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>

meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-10879.patch

@@ -0,0 +1,34 @@
+From 2a69c8a256fa83dee2e532c97d3f60f39795c861 Mon Sep 17 00:00:00 2001
+From: "H.Merijn Brand - Tux" <linux@tux.freedom.nl>
+Date: Thu, 28 May 2026 14:14:50 +0200
+Subject: [PATCH] Replacing `?` with `:p#` in `preparse ()` with more than 9
+ `?` causes buffer overflow
+
+`:p1` is length 3, `?` just 1, but `:p1003` is length 6!
+
+CVE: CVE-2026-10879
+Upstream-Status: Backport [https://github.com/perl5-dbi/dbi/commit/af79036c07aa9a457971c0f4136e37c85dc20978]
+
+Backport Changes:
+ - Omit ChangeLog, dbixs_rev.h, and lib/DBI/Changes.pm release metadata because the target remains DBI 1.643.
+ - Omit generated doc/DBI.3 and doc/DBI.man changes; the DBI.xs security hunk is unchanged.
+
+(cherry picked from commit af79036c07aa9a457971c0f4136e37c85dc20978)
+Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
+---
+ DBI.xs | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/DBI.xs b/DBI.xs
+index c549d15..8858e21 100644
+--- a/DBI.xs
++++ b/DBI.xs
+@@ -4201,7 +4201,7 @@ preparse(SV *dbh, const char *statement, IV ps_return, IV ps_accept, void *foo)
+     }
+ 
+     /* XXX this allocation strategy won't work when we get to more advanced stuff */
+-    new_stmt_sv = newSV(strlen(statement) * 3);
++    new_stmt_sv = newSV(strlen(statement) * 6 + 16);
+     sv_setpv(new_stmt_sv,"");
+     src  = statement;
+     dest = SvPVX(new_stmt_sv);

meta-oe/recipes-devtools/perl/libdbi-perl_1.643.bb

@@ -12,6 +12,7 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=10982c7148e0a012c0fd80534522f5c5"
 SRC_URI = "http://search.cpan.org/CPAN/authors/id/T/TI/TIMB/DBI-${PV}.tar.gz \
            file://CVE-2014-10402.patch \
            file://CVE-2026-9698.patch \
+           file://CVE-2026-10879.patch \
            "
 SRC_URI[md5sum] = "352f80b1e23769c116082a90905d7398"
 SRC_URI[sha256sum] = "8a2b993db560a2c373c174ee976a51027dd780ec766ae17620c20393d2e836fa"