libdbi-perl: fix CVE-2026-73193

These patches apply the upstream fix as referenced in [2], using the
commit shown in [1]. The STRLEN correction [3] is a separate patch.

[1] https://github.com/perl5-dbi/dbi/commit/c751ae5a5a6f56c2f8284f37c1f4d43500352ef1
[2] https://access.redhat.com/security/cve/cve-2026-73193
[3] https://github.com/perl5-dbi/dbi/commit/afba6751f2acbc1f55ad55aac9f0b58d4f511308

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>

meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-73193_p1.patch

@@ -0,0 +1,51 @@
+From eaf24226efba1e0628868b236c59d2e23bd6236a Mon Sep 17 00:00:00 2001
+From: "H.Merijn Brand - Tux" <linux@tux.freedom.nl>
+Date: Tue, 11 Aug 2026 15:02:52 +0200
+Subject: [PATCH] Limit statements to 292 Mb in preparse (CVE-2026-73193)
+
+CVE: CVE-2026-73193
+Upstream-Status: Backport [https://github.com/perl5-dbi/dbi/commit/c751ae5a5a6f56c2f8284f37c1f4d43500352ef1]
+
+Backport Changes:
+- Applied the DBI.xs security change without functional edits.
+- Omitted ChangeLog and Changes.pm release notes for DBI 1.652.
+- Omitted the dbixs_rev.h timestamp and revision update, which does
+  not affect the preparse fix.
+
+(cherry picked from commit c751ae5a5a6f56c2f8284f37c1f4d43500352ef1)
+Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
+---
+ DBI.xs | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/DBI.xs b/DBI.xs
+index b2fd892..db8e005 100644
+--- a/DBI.xs
++++ b/DBI.xs
+@@ -4187,6 +4187,7 @@ preparse(SV *dbh, const char *statement, IV ps_return, IV ps_accept, void *foo)
+         we add support for odbc escape sequences.
+ */
+     int idx = 1;
++    int sln;
+ 
+     char in_quote = '\0';
+     char in_comment = '\0';
+@@ -4210,7 +4211,14 @@ preparse(SV *dbh, const char *statement, IV ps_return, IV ps_accept, void *foo)
+      * using factor 6: :p1 .. :p11106
+      * using factor 7: :p1 .. :p111105
+      * and that count is insane already */
+-    new_stmt_sv = newSV(strlen(statement) * 7 + 16);
++    sln = strlen(statement);
++    if (sln > 306783375) { /* x * 7 + 16 would overflow maxint on 32bit ints */
++        char buf[99];
++        sprintf(buf, "preparse statement length exceeds maximum length (306783375).");
++        set_err_char(dbh, imp_xxh, "1", 1, buf, 0, "preparse");
++        return &PL_sv_undef;
++    }
++    new_stmt_sv = newSV(sln * 7 + 16);
+     sv_setpv(new_stmt_sv,"");
+     src  = statement;
+     dest = SvPVX(new_stmt_sv);
+-- 
+2.35.6
+

meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-73193_p2.patch

@@ -0,0 +1,38 @@
+From f46355f7578f796ad50e650f371f02864bf39b7b Mon Sep 17 00:00:00 2001
+From: Alexander Bluhm <alexander.bluhm@gmx.net>
+Date: Mon, 17 Aug 2026 13:11:38 +0200
+Subject: [PATCH] Fix integer overflow after strlen().
+
+In preparse() the integer variable sln is used the store the return
+value of strlen().  By that the real length is truncated to 32 bit
+and made signed.  This way the overflow check sln > 306783375 can
+be circumvented.  Make sln of type STRLEN.
+
+CVE: CVE-2026-73193
+Upstream-Status: Backport [https://github.com/perl5-dbi/dbi/commit/afba6751f2acbc1f55ad55aac9f0b58d4f511308]
+
+Backport Changes:
+- Applied the DBI.xs correction without functional edits.
+
+(cherry picked from commit afba6751f2acbc1f55ad55aac9f0b58d4f511308)
+Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
+---
+ DBI.xs | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/DBI.xs b/DBI.xs
+index db8e005..f5c7c29 100644
+--- a/DBI.xs
++++ b/DBI.xs
+@@ -4187,7 +4187,7 @@ preparse(SV *dbh, const char *statement, IV ps_return, IV ps_accept, void *foo)
+         we add support for odbc escape sequences.
+ */
+     int idx = 1;
+-    int sln;
++    STRLEN sln;
+ 
+     char in_quote = '\0';
+     char in_comment = '\0';
+-- 
+2.35.6
+

meta-oe/recipes-devtools/perl/libdbi-perl_1.647.bb

@@ -18,6 +18,8 @@ SRC_URI = "${CPAN_MIRROR}/authors/id/H/HM/HMBRAND/DBI-${PV}.tgz \
            file://CVE-2026-73194_p1.patch \
            file://CVE-2026-73194_p2.patch \
            file://CVE-2026-73194_p3.patch \
+           file://CVE-2026-73193_p1.patch \
+           file://CVE-2026-73193_p2.patch \
            "
 SRC_URI[sha256sum] = "0df16af8e5b3225a68b7b592ab531004ddb35a9682b50300ce50174ad867d9aa"