From 5b746f28bbe39c44d17f1b0e3193efab8fd15865 Mon Sep 17 00:00:00 2001 From: Darsh Kelaiya Date: Wed, 14 Oct 2026 21:53:53 -0700 Subject: [PATCH] libdbi-perl: fix CVE-2026-73193 These patches apply the upstream fix as referenced in [2], using the commit shown in [1]. The STRLEN correction [3] is a separate patch. [1] https://github.com/perl5-dbi/dbi/commit/c751ae5a5a6f56c2f8284f37c1f4d43500352ef1 [2] https://access.redhat.com/security/cve/cve-2026-73193 [3] https://github.com/perl5-dbi/dbi/commit/afba6751f2acbc1f55ad55aac9f0b58d4f511308 Signed-off-by: Darsh Kelaiya Signed-off-by: Anuj Mittal --- .../perl/libdbi-perl/CVE-2026-73193_p1.patch | 51 +++++++++++++++++++ .../perl/libdbi-perl/CVE-2026-73193_p2.patch | 38 ++++++++++++++ .../perl/libdbi-perl_1.647.bb | 2 + 3 files changed, 91 insertions(+) create mode 100644 meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-73193_p1.patch create mode 100644 meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-73193_p2.patch diff --git a/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-73193_p1.patch b/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-73193_p1.patch new file mode 100644 index 0000000000..c32d74c7f2 --- /dev/null +++ b/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-73193_p1.patch @@ -0,0 +1,51 @@ +From eaf24226efba1e0628868b236c59d2e23bd6236a Mon Sep 17 00:00:00 2001 +From: "H.Merijn Brand - Tux" +Date: Tue, 11 Aug 2026 15:02:52 +0200 +Subject: [PATCH] Limit statements to 292 Mb in preparse (CVE-2026-73193) + +CVE: CVE-2026-73193 +Upstream-Status: Backport [https://github.com/perl5-dbi/dbi/commit/c751ae5a5a6f56c2f8284f37c1f4d43500352ef1] + +Backport Changes: +- Applied the DBI.xs security change without functional edits. +- Omitted ChangeLog and Changes.pm release notes for DBI 1.652. +- Omitted the dbixs_rev.h timestamp and revision update, which does + not affect the preparse fix. + +(cherry picked from commit c751ae5a5a6f56c2f8284f37c1f4d43500352ef1) +Signed-off-by: Darsh Kelaiya +--- + DBI.xs | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/DBI.xs b/DBI.xs +index b2fd892..db8e005 100644 +--- a/DBI.xs ++++ b/DBI.xs +@@ -4187,6 +4187,7 @@ preparse(SV *dbh, const char *statement, IV ps_return, IV ps_accept, void *foo) + we add support for odbc escape sequences. + */ + int idx = 1; ++ int sln; + + char in_quote = '\0'; + char in_comment = '\0'; +@@ -4210,7 +4211,14 @@ preparse(SV *dbh, const char *statement, IV ps_return, IV ps_accept, void *foo) + * using factor 6: :p1 .. :p11106 + * using factor 7: :p1 .. :p111105 + * and that count is insane already */ +- new_stmt_sv = newSV(strlen(statement) * 7 + 16); ++ sln = strlen(statement); ++ if (sln > 306783375) { /* x * 7 + 16 would overflow maxint on 32bit ints */ ++ char buf[99]; ++ sprintf(buf, "preparse statement length exceeds maximum length (306783375)."); ++ set_err_char(dbh, imp_xxh, "1", 1, buf, 0, "preparse"); ++ return &PL_sv_undef; ++ } ++ new_stmt_sv = newSV(sln * 7 + 16); + sv_setpv(new_stmt_sv,""); + src = statement; + dest = SvPVX(new_stmt_sv); +-- +2.35.6 + diff --git a/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-73193_p2.patch b/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-73193_p2.patch new file mode 100644 index 0000000000..968521d91d --- /dev/null +++ b/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-73193_p2.patch @@ -0,0 +1,38 @@ +From f46355f7578f796ad50e650f371f02864bf39b7b Mon Sep 17 00:00:00 2001 +From: Alexander Bluhm +Date: Mon, 17 Aug 2026 13:11:38 +0200 +Subject: [PATCH] Fix integer overflow after strlen(). + +In preparse() the integer variable sln is used the store the return +value of strlen(). By that the real length is truncated to 32 bit +and made signed. This way the overflow check sln > 306783375 can +be circumvented. Make sln of type STRLEN. + +CVE: CVE-2026-73193 +Upstream-Status: Backport [https://github.com/perl5-dbi/dbi/commit/afba6751f2acbc1f55ad55aac9f0b58d4f511308] + +Backport Changes: +- Applied the DBI.xs correction without functional edits. + +(cherry picked from commit afba6751f2acbc1f55ad55aac9f0b58d4f511308) +Signed-off-by: Darsh Kelaiya +--- + DBI.xs | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/DBI.xs b/DBI.xs +index db8e005..f5c7c29 100644 +--- a/DBI.xs ++++ b/DBI.xs +@@ -4187,7 +4187,7 @@ preparse(SV *dbh, const char *statement, IV ps_return, IV ps_accept, void *foo) + we add support for odbc escape sequences. + */ + int idx = 1; +- int sln; ++ STRLEN sln; + + char in_quote = '\0'; + char in_comment = '\0'; +-- +2.35.6 + diff --git a/meta-oe/recipes-devtools/perl/libdbi-perl_1.647.bb b/meta-oe/recipes-devtools/perl/libdbi-perl_1.647.bb index 1e74a17e4b..03be7eabea 100644 --- a/meta-oe/recipes-devtools/perl/libdbi-perl_1.647.bb +++ b/meta-oe/recipes-devtools/perl/libdbi-perl_1.647.bb @@ -18,6 +18,8 @@ SRC_URI = "${CPAN_MIRROR}/authors/id/H/HM/HMBRAND/DBI-${PV}.tgz \ file://CVE-2026-73194_p1.patch \ file://CVE-2026-73194_p2.patch \ file://CVE-2026-73194_p3.patch \ + file://CVE-2026-73193_p1.patch \ + file://CVE-2026-73193_p2.patch \ " SRC_URI[sha256sum] = "0df16af8e5b3225a68b7b592ab531004ddb35a9682b50300ce50174ad867d9aa"