mirrors/meta-openembedded
1
0
Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-08-30 00:33:19 +00:00
Code Issues Projects Releases Wiki Activity

libdbi-perl: Fix CVE-2026-9698

Browse Source 
This patch applies the upstream fix as referenced in [2], using the
commit shown in [1].

[1] https://github.com/perl5-dbi/dbi/commit/bfe5d73c162d2d1f761a639a0aa33aad6a9eb54e
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-9698

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
This commit is contained in:
Hetvi Thakar
2026-07-29 02:18:36 -07:00
committed by Anuj Mittal
parent cd1dc3ec50
commit 419ca9a1fe
2 changed files with 54 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-9698.patch
+51
View File
@@ -0,0 +1,51 @@
From 9a85c9bc1c1fafa42a223d3310f9c5a6305902f0 Mon Sep 17 00:00:00 2001
From: "H.Merijn Brand - Tux" <linux@tux.freedom.nl>
Date: Wed, 27 May 2026 11:16:50 +0200
Subject: [PATCH] Fix possible stack overflow (old issue already noted by Tim)
CVE: CVE-2026-9698
Upstream-Status: Backport [https://github.com/perl5-dbi/dbi/commit/bfe5d73c162d2d1f761a639a0aa33aad6a9eb54e]
Backport Changes:
- Applied the DBI.xs security fix without functional changes.
- Omitted ChangeLog and lib/DBI/Changes.pm because they contain only
DBI 1.648 release-note updates.
- Omitted dbixs_rev.h because it is generated from upstream Git history
and its hunk depends on DBIXS_RELEASE and DBIXS_VERSION metadata added
after DBI 1.647. The fix does not change the DBIXS or DBISTATE
interface.
- Omitted the Makefile.PL addition that runs dbixs_rev.pl from the doc
target. It only regenerates dbixs_rev.h and is not required to compile
or activate the DBI.xs security fix.
(cherry picked from commit bfe5d73c162d2d1f761a639a0aa33aad6a9eb54e)
Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
---
DBI.xs | 7 ++-----
1 file changed, 2 insertions(+), 5 deletions(-)
diff --git a/DBI.xs b/DBI.xs
index 97d9378..1f06d4d 100644
--- a/DBI.xs
+++ b/DBI.xs
@@ -4000,7 +4000,6 @@ XS(XS_DBI_dispatch)
SV **statement_svp = NULL;
const int is_warning = (!SvTRUE(err_sv) && strlen(SvPV_nolen(err_sv))==1);
const char *err_meth_name = meth_name;
- char intro[200];
if (meth_type == methtype_set_err) {
SV **sem_svp = hv_fetch((HV*)SvRV(h), "dbi_set_err_method", 18, GV_ADDWARN);
@@ -4008,10 +4007,8 @@ XS(XS_DBI_dispatch)
err_meth_name = SvPV_nolen(*sem_svp);
}
- /* XXX change to vsprintf into sv directly */
- sprintf(intro,"%s %s %s: ", HvNAME(DBIc_IMP_STASH(imp_xxh)), err_meth_name,
- SvTRUE(err_sv) ? "failed" : is_warning ? "warning" : "information");
- msg = sv_2mortal(newSVpv(intro,0));
+ msg = sv_2mortal(newSVpvf("%s %s %s: ", HvNAME(DBIc_IMP_STASH(imp_xxh)), err_meth_name,
+ SvTRUE(err_sv) ? "failed" : is_warning ? "warning" : "information"));
if (SvOK(DBIc_ERRSTR(imp_xxh)))
sv_catsv(msg, DBIc_ERRSTR(imp_xxh));
else
meta-oe/recipes-devtools/perl/libdbi-perl_1.647.bb
+3 -1
View File
@@ -9,7 +9,9 @@ SECTION = "libs"
LICENSE = "Artistic-1.0 | GPL-1.0-or-later"
LIC_FILES_CHKSUM = "file://LICENSE;md5=65f65488c774efe1da488e36ad6c4a36"
SRC_URI = "${CPAN_MIRROR}/authors/id/H/HM/HMBRAND/DBI-${PV}.tgz"
SRC_URI = "${CPAN_MIRROR}/authors/id/H/HM/HMBRAND/DBI-${PV}.tgz \
file://CVE-2026-9698.patch \
"
SRC_URI[sha256sum] = "0df16af8e5b3225a68b7b592ab531004ddb35a9682b50300ce50174ad867d9aa"
S = "${UNPACKDIR}/DBI-${PV}"