mirrors/meta-openembedded
1
0
Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-08-31 03:45:41 +00:00
Code Issues Projects Releases Wiki Activity

libdbi-perl: Fix CVE-2026-14740

Browse Source 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/perl5-dbi/dbi/commit/fc16f9e8b3dd5c65caf1867781ab2bfe2fadcc01
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-14740

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
This commit is contained in:
Hetvi Thakar
2026-07-29 02:18:40 -07:00
committed by Anuj Mittal
parent ffe5d007f6
commit 3a570116aa
2 changed files with 40 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-14740.patch
+39
View File
@@ -0,0 +1,39 @@
From 65a5eecd6845ed1c29ede9bbe0b651fa3ba3cc2d Mon Sep 17 00:00:00 2001
From: Robert Rothenberg <perl@rhizomnic.com>
Date: Sat, 4 Jul 2026 10:49:42 +0100
Subject: [PATCH] Fix out-of-bounds read in preparse when an initial comment is
deleted
This fixes CVE-2026-14740
CVE: CVE-2026-14740
Upstream-Status: Backport [https://github.com/perl5-dbi/dbi/commit/fc16f9e8b3dd5c65caf1867781ab2bfe2fadcc01]
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Robert Rothenberg <rrwo@cpansec.org>
(cherry picked from commit fc16f9e8b3dd5c65caf1867781ab2bfe2fadcc01)
Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
---
DBI.xs | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/DBI.xs b/DBI.xs
index 0f9ea9c..da5d137 100644
--- a/DBI.xs
+++ b/DBI.xs
@@ -4239,7 +4239,13 @@ preparse(SV *dbh, const char *statement, IV ps_return, IV ps_accept, void *foo)
}
if (in_comment == '/')
src++;
- src += (*src != '\n' || *(dest-1)=='\n') ? 1 : 0;
+ /* Only inspect the previously-emitted byte if one exists;
+ when an initial line comment is deleted, dest is still at
+ the start of the output buffer and *(dest-1) would read
+ one byte before it (OOB read). */
+ src += (*src != '\n'
+ || (dest > SvPVX(new_stmt_sv) && *(dest-1)=='\n'))
+ ? 1 : 0;
in_comment = '\0';
rt_comment = '\0';
}
meta-oe/recipes-devtools/perl/libdbi-perl_1.647.bb
+1
View File
@@ -14,6 +14,7 @@ SRC_URI = "${CPAN_MIRROR}/authors/id/H/HM/HMBRAND/DBI-${PV}.tgz \
file://CVE-2026-10879.patch \
file://CVE-2026-14380.patch \
file://CVE-2026-14739.patch \
file://CVE-2026-14740.patch \
"
SRC_URI[sha256sum] = "0df16af8e5b3225a68b7b592ab531004ddb35a9682b50300ce50174ad867d9aa"